Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
FFbd.dll

Overview

General Information

Sample name:FFbd.dll
Analysis ID:1467959
MD5:ff70a29ec9361ec5c5107788dfa3fcb3
SHA1:3a8206eba21c66c2955f970dbb8ceac36dbab917
SHA256:87904f0d8a76ca68a802faa3987df9490b8bd213937c9028afe6089f036a864c
Infos:

Detection

Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
AI detected suspicious sample
Machine Learning detection for dropped file
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
Internet Provider seen in connection with other malware
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • loaddll32.exe (PID: 6816 cmdline: loaddll32.exe "C:\Users\user\Desktop\FFbd.dll" MD5: 51E6071F9CBA48E79F10C84515AAE618)
    • conhost.exe (PID: 6836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 6956 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\FFbd.dll",#1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • rundll32.exe (PID: 7048 cmdline: rundll32.exe "C:\Users\user\Desktop\FFbd.dll",#1 MD5: 889B99C52A60DD49227C5E485A016679)
        • rkn.exe (PID: 4960 cmdline: "C:\Users\user\AppData\Local\Temp\rkn.exe" MD5: 4B683807246FC18189D63DD9A4E9429F)
          • Acrobat.exe (PID: 6768 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\unity.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
            • AcroCEF.exe (PID: 7280 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
              • AcroCEF.exe (PID: 7504 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2068 --field-trial-handle=1668,i,5790033669171981686,32294422139624892,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
    • rundll32.exe (PID: 6976 cmdline: rundll32.exe C:\Users\user\Desktop\FFbd.dll,apt66 MD5: 889B99C52A60DD49227C5E485A016679)
      • rkn.exe (PID: 2500 cmdline: "C:\Users\user\AppData\Local\Temp\rkn.exe" MD5: 4B683807246FC18189D63DD9A4E9429F)
        • Acrobat.exe (PID: 8624 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\unity.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
        • apt66ext.exe (PID: 8740 cmdline: "C:\Users\user\AppData\Local\Temp\apt66ext.exe" MD5: 494A19DC7E5EAA0E516ECE245D2661DE)
          • staged_out.exe (PID: 8844 cmdline: "C:\Users\user\AppData\Local\Temp\apt66ext.exe" MD5: D735279B3606F59AAD13FAB2AA9E9CD5)
    • rundll32.exe (PID: 7072 cmdline: rundll32.exe "C:\Users\user\Desktop\FFbd.dll",apt66 MD5: 889B99C52A60DD49227C5E485A016679)
      • rkn.exe (PID: 7304 cmdline: "C:\Users\user\AppData\Local\Temp\rkn.exe" MD5: 4B683807246FC18189D63DD9A4E9429F)
        • Acrobat.exe (PID: 7120 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\unity.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
dump.pcapWindows_Trojan_Donutloader_f40e3759unknownunknown
  • 0x9d2d:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
  • 0xd80b:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\rkn[1].logWindows_Trojan_Donutloader_f40e3759unknownunknown
  • 0x519c:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
  • 0x86d2:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
C:\Users\user\AppData\Local\Temp\rkn.exeWindows_Trojan_Donutloader_f40e3759unknownunknown
  • 0x519c:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
  • 0x86d2:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000006.00000000.1716817368.0000000000583000.00000008.00000001.01000000.00000005.sdmpWindows_Trojan_Donutloader_f40e3759unknownunknown
  • 0x319c:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
  • 0x66d2:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000007.00000002.1859570340.00000000005D0000.00000040.10000000.00040000.00000000.sdmpWindows_Trojan_Donutloader_f40e3759unknownunknown
  • 0x317c:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
  • 0x66b2:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000007.00000002.1859480878.0000000000584000.00000008.00000001.01000000.00000005.sdmpWindows_Trojan_Donutloader_f40e3759unknownunknown
  • 0x219c:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
  • 0x56d2:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000006.00000002.2394995201.00000000014F0000.00000040.10000000.00040000.00000000.sdmpWindows_Trojan_Donutloader_f40e3759unknownunknown
  • 0x317c:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
  • 0x66b2:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
0000000A.00000002.1906067523.0000000001510000.00000040.10000000.00040000.00000000.sdmpWindows_Trojan_Donutloader_f40e3759unknownunknown
  • 0x317c:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
  • 0x66b2:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
Click to see the 4 entries

Unpacked PEs

SourceRuleDescriptionAuthorStrings
6.2.rkn.exe.580000.0.unpackWindows_Trojan_Donutloader_f40e3759unknownunknown
  • 0x519c:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
  • 0x86d2:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
7.0.rkn.exe.580000.0.unpackWindows_Trojan_Donutloader_f40e3759unknownunknown
  • 0x519c:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
  • 0x86d2:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
7.2.rkn.exe.580000.0.unpackWindows_Trojan_Donutloader_f40e3759unknownunknown
  • 0x519c:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
  • 0x86d2:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
6.0.rkn.exe.580000.0.unpackWindows_Trojan_Donutloader_f40e3759unknownunknown
  • 0x519c:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
  • 0x86d2:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
10.2.rkn.exe.580000.0.unpackWindows_Trojan_Donutloader_f40e3759unknownunknown
  • 0x519c:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
  • 0x86d2:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
Click to see the 1 entries

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus detection for URL or domain
Source: http://121.127.33.39/rkn.logAvira URL Cloud: Label: malware
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\rkn[1].logAvira: detection malicious, Label: HEUR/AGEN.1318484
Multi AV Scanner detection for domain / URL
Source: http://121.127.33.39/rkn.logVirustotal: Detection: 10%Perma Link
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\rkn[1].logReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\apt66ext[1].logReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeReversingLabs: Detection: 18%
Multi AV Scanner detection for submitted file
Source: FFbd.dllVirustotal: Detection: 9%Perma Link
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.9% probability
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\rkn[1].logJoe Sandbox ML: detected
Source: FFbd.dllStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
Source: FFbd.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
Source: Binary string: C:\Users\narut\source\repos\stage2test\Release\stage2test.pdb source: FFbd.dll
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: libcrypto-1_1.dll.20.dr
Source: Binary string: ~/.pdbrc source: staged_out.exe, 00000016.00000002.2274762745.00000295FDB10000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1g 21 Apr 2020built on: Fri Jun 12 19:40:20 2020 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: libcrypto-1_1.dll.20.dr
Source: Binary string: .pdbrc source: staged_out.exe, 00000016.00000002.2274762745.00000295FDB10000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: placed in the .pdbrc file): source: staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2273421053.00000295FD16A000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251888617.00000295FD169000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: -c are executed after commands from .pdbrc files. source: staged_out.exe, 00000016.00000002.2272538615.00000295FCE02000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCDF1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\18\s\PCbuild\amd64\_decimal.pdb source: _decimal.pyd.20.dr
Source: Binary string: If a file ".pdbrc" exists in your home directory or in the current source: staged_out.exe, 00000016.00000002.2272538615.00000295FCE02000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000002.2273403885.00000295FD168000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCDF1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\narut\source\repos\shellcoderunner\Release\shellcoderunner.pdb source: rkn.exe, 00000006.00000000.1716807213.0000000000582000.00000002.00000001.01000000.00000005.sdmp, rkn.exe, 00000006.00000002.2394697025.0000000000582000.00000002.00000001.01000000.00000005.sdmp, rkn.exe, 00000007.00000000.1719993020.0000000000582000.00000002.00000001.01000000.00000005.sdmp, rkn.exe, 00000007.00000002.1859446569.0000000000582000.00000002.00000001.01000000.00000005.sdmp, rkn.exe, 0000000A.00000000.1748192962.0000000000582000.00000002.00000001.01000000.00000005.sdmp, rkn.exe, 0000000A.00000002.1905527280.0000000000582000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: T.pdb source: rkn.exe, 00000006.00000002.2395016615.0000000001500000.00000004.00001000.00020000.00000000.sdmp, rkn.exe, 00000007.00000002.1859593411.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, rkn.exe, 0000000A.00000002.1906141293.0000000001520000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: Initial commands are read from .pdbrc files in your home directory source: staged_out.exe, 00000016.00000002.2272538615.00000295FCE02000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCDF1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\6\b\libcrypto-1_1.pdb source: libcrypto-1_1.dll.20.dr
Source: Binary string: .pdbrc source: staged_out.exe, 00000016.00000002.2274762745.00000295FDB10000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ~/.pdbrcz source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: D:\a\opencv-python\opencv-python\_skbuild\win-amd64-3.7\cmake-build\lib\python3\Release\cv2.pdb source: apt66ext.exe, 00000014.00000003.2229701481.0000017004268000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: :jC:\Users\narut\source\repos\stage2test\Release\stage2test.pdb source: FFbd.dll
Source: Binary string: C:\Users\narut\source\repos\fromshellcode\Release\fromshellcode.pdb source: rkn.exe, 00000006.00000002.2395343407.0000000002FC3000.00000002.10000000.00040000.00000000.sdmp, rkn.exe, 00000006.00000002.2395272404.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, rkn.exe, 00000007.00000002.1859609747.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, rkn.exe, 00000007.00000002.1859676876.00000000009D3000.00000002.10000000.00040000.00000000.sdmp, rkn.exe, 0000000A.00000002.1906412300.0000000001690000.00000004.00001000.00020000.00000000.sdmp, rkn.exe, 0000000A.00000002.1906499521.00000000016A3000.00000002.10000000.00040000.00000000.sdmp
Source: Binary string: C:\Users\narut\source\repos\shellcoderunner\Release\shellcoderunner.pdb source: rkn.exe, 00000006.00000000.1716807213.0000000000582000.00000002.00000001.01000000.00000005.sdmp, rkn.exe, 00000006.00000002.2394697025.0000000000582000.00000002.00000001.01000000.00000005.sdmp, rkn.exe, 00000007.00000000.1719993020.0000000000582000.00000002.00000001.01000000.00000005.sdmp, rkn.exe, 00000007.00000002.1859446569.0000000000582000.00000002.00000001.01000000.00000005.sdmp, rkn.exe, 0000000A.00000000.1748192962.0000000000582000.00000002.00000001.01000000.00000005.sdmp, rkn.exe, 0000000A.00000002.1905527280.0000000000582000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: .pdbrc) source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtdeclarative\lib\Qt5Qml.pdb source: apt66ext.exe, 00000014.00000003.2229701481.0000017005524000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\narut\source\repos\fromshellcode\Release\fromshellcode.pdb source: rkn.exe, 00000006.00000002.2395343407.0000000002FC3000.00000002.10000000.00040000.00000000.sdmp, rkn.exe, 00000006.00000002.2395272404.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, rkn.exe, 00000007.00000002.1859609747.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, rkn.exe, 00000007.00000002.1859676876.00000000009D3000.00000002.10000000.00040000.00000000.sdmp, rkn.exe, 0000000A.00000002.1906412300.0000000001690000.00000004.00001000.00020000.00000000.sdmp, rkn.exe, 0000000A.00000002.1906499521.00000000016A3000.00000002.10000000.00040000.00000000.sdmp
Source: Binary string: The standard debugger class (pdb.Pdb) is an example. source: staged_out.exe, 00000016.00000002.2272538615.00000295FCE02000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250931979.00000295FCF99000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272958187.00000295FCFC5000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCDF1000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251695950.00000295FCFBF000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2252140280.00000295FCFC4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\18\s\PCbuild\amd64\_decimal.pdb$$ source: _decimal.pyd.20.dr
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF638518370 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,20_2_00007FF638518370

Networking

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 121.127.33.39 80Jump to behavior
Source: Joe Sandbox ViewASN Name: RANATECHNET-AFRANATechnologiesKabulAF RANATECHNET-AFRANATechnologiesKabulAF
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 6_2_02FC1050 InternetOpenW,InternetOpenUrlW,GetTempPathW,PathCombineW,CreateFileW,InternetReadFile,WriteFile,InternetReadFile,CloseHandle,InternetCloseHandle,InternetCloseHandle,6_2_02FC1050
Source: rundll32.exe, 00000003.00000002.2396183226.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.2396183226.00000000030AD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1861211680.0000000002AEB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1908626749.000000000291A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1908626749.000000000295B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://121.127.33.39/
Source: rkn.exe, rkn.exe, 0000000A.00000002.1906582152.00000000017A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://121.127.33.39/apt66ext.log
Source: rkn.exe, 00000007.00000002.1859848122.0000000000AD4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://121.127.33.39/apt66ext.logQ
Source: rkn.exe, 00000006.00000002.2395036782.000000000155F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://121.127.33.39/apt66ext.logt6
Source: rkn.exe, 00000007.00000002.1859848122.0000000000AD4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://121.127.33.39/apt66ext.logy
Source: rundll32.exe, 00000005.00000002.1908626749.000000000291A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1908626749.000000000295B000.00000004.00000020.00020000.00000000.sdmp, FFbd.dllString found in binary or memory: http://121.127.33.39/rkn.log
Source: rundll32.exe, 00000005.00000002.1908626749.000000000295B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://121.127.33.39/rkn.log)
Source: rundll32.exe, 00000005.00000002.1908626749.000000000295B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://121.127.33.39/rkn.log-
Source: rundll32.exe, 00000003.00000002.2396183226.00000000030AD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://121.127.33.39/rkn.log0
Source: rundll32.exe, 00000004.00000002.1861211680.0000000002AAA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://121.127.33.39/rkn.log5g
Source: rundll32.exe, 00000005.00000002.1908626749.000000000291A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://121.127.33.39/rkn.logQ
Source: rundll32.exe, 00000004.00000002.1861211680.0000000002AEB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://121.127.33.39/rkn.logSystem32
Source: rundll32.exe, 00000004.00000002.1861211680.0000000002AAA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://121.127.33.39/rkn.loga
Source: rundll32.exe, 00000003.00000002.2396183226.000000000309A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://121.127.33.39/rkn.logg
Source: rundll32.exe, 00000004.00000002.1861211680.0000000002AEB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://121.127.33.39/rkn.logl
Source: rundll32.exe, 00000003.00000002.2396183226.000000000306A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://121.127.33.39/rkn.logll
Source: rundll32.exe, 00000005.00000002.1908626749.000000000291A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://121.127.33.39/rkn.logo
Source: rkn.exe, 0000000A.00000002.1906582152.00000000017A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://121.127.33.39/unity.pdf
Source: rkn.exe, 00000006.00000002.2395036782.000000000155F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://121.127.33.39/unity.pdfR
Source: rkn.exe, 00000006.00000002.2395343407.0000000002FC3000.00000002.10000000.00040000.00000000.sdmp, rkn.exe, 00000006.00000002.2395272404.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, rkn.exe, 00000007.00000002.1859609747.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, rkn.exe, 00000007.00000002.1859676876.00000000009D3000.00000002.10000000.00040000.00000000.sdmp, rkn.exe, 0000000A.00000002.1906412300.0000000001690000.00000004.00001000.00020000.00000000.sdmp, rkn.exe, 0000000A.00000002.1906499521.00000000016A3000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: http://121.127.33.39/unity.pdfapt66ext.exehttp://121.127.33.39/apt66ext.logapt66.exemsupdate.exeC
Source: rkn.exe, 00000006.00000002.2395036782.000000000155F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://121.127.33.39/unity.pdfu
Source: apt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, _generator.pyd.20.drString found in binary or memory: http://arxiv.org/abs/1805.10941.
Source: staged_out.exe, 00000016.00000002.2274006172.00000295FD770000.00000004.00001000.00020000.00000000.sdmp, staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://bugs.python.org/issue23606)
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://bugs.python.org/issue23606)uctypes.util.find_library()
Source: _decimal.pyd.20.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: _decimal.pyd.20.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://caffe.berkeleyvision.org
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://caffe.berkeleyvision.org/)
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://campar.in.tum.de/Chair/HandEyeCalibration).
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://cffi.readthedocs.io/en/latest/cdef.html#ffi-cdef-limitations
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.476.5736&rep=rep1&type=pdf
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.131.6394
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://code.activestate.com/recipes/577916/
Source: _decimal.pyd.20.drString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: _decimal.pyd.20.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: _decimal.pyd.20.drString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: _decimal.pyd.20.drString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: _decimal.pyd.20.drString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: staged_out.exe, 00000016.00000003.2251555312.00000295FC975000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC975000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://digitalassets.lib.berkeley.edu/sdtr/ucb/text/34.pdf
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: staged_out.exe, 00000016.00000002.2272538615.00000295FCE02000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCDF1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/library/unittest.html
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://dx.doi.org/10.1016/j.cviu.2010.01.011
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://foo/bar.tar.gz
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://foo/bar.tgz
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://graphics.berkeley.edu/papers/Tao-SAN-2012-05/
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://homepages.inf.ed.ac.uk/rbf/HIPR2/hough.htm
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://json.org
Source: staged_out.exe, 00000016.00000003.2251555312.00000295FC975000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC975000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://kobesearch.cpan.org/htdocs/Math-Cephes/Math/Cephes.html
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://lear.inrialpes.fr/src/deepmatching/
Source: apt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251193956.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, _generator.pyd.20.drString found in binary or memory: http://mathworld.wolfram.com/BinomialDistribution.html
Source: apt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251193956.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, _generator.pyd.20.drString found in binary or memory: http://mathworld.wolfram.com/CauchyDistribution.html
Source: apt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF04000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251193956.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, _generator.pyd.20.drString found in binary or memory: http://mathworld.wolfram.com/GammaDistribution.html
Source: apt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251193956.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, _generator.pyd.20.drString found in binary or memory: http://mathworld.wolfram.com/HypergeometricDistribution.html
Source: apt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251193956.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, _generator.pyd.20.drString found in binary or memory: http://mathworld.wolfram.com/LaplaceDistribution.html
Source: apt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251193956.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, _generator.pyd.20.drString found in binary or memory: http://mathworld.wolfram.com/LogisticDistribution.html
Source: apt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251193956.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, _generator.pyd.20.drString found in binary or memory: http://mathworld.wolfram.com/NegativeBinomialDistribution.html
Source: apt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251193956.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, _generator.pyd.20.drString found in binary or memory: http://mathworld.wolfram.com/NoncentralF-Distribution.html
Source: apt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251193956.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, _generator.pyd.20.drString found in binary or memory: http://mathworld.wolfram.com/PoissonDistribution.html
Source: staged_out.exe, 00000016.00000003.2251555312.00000295FC975000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC975000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://mathworld.wolfram.com/SincFunction.html
Source: _decimal.pyd.20.drString found in binary or memory: http://ocsp.digicert.com0C
Source: _decimal.pyd.20.drString found in binary or memory: http://ocsp.digicert.com0N
Source: _decimal.pyd.20.drString found in binary or memory: http://ocsp.thawte.com0
Source: apt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCE86000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCE86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://pracrand.sourceforge.net/RNG_engines.txt
Source: staged_out.exe, 00000016.00000002.2273973720.00000295FD720000.00000004.00001000.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2273941997.00000295FD6D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: staged_out.exe, 00000016.00000002.2272538615.00000295FCE02000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCDF1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://speleotrove.com/decimal/decarith.html
Source: staged_out.exe, 00000016.00000003.2251888617.00000295FD177000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2273421053.00000295FD177000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://tip.tcl.tk/48)
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://torch.ch
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://torch.ch/)
Source: _decimal.pyd.20.drString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: _decimal.pyd.20.drString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: _decimal.pyd.20.drString found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: staged_out.exe, 00000016.00000002.2273799570.00000295FD480000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://ubuntuforums.org/showthread.php?t=1751455
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://underdestruction.com/2004/02/25/stackblur-2004.
Source: staged_out.exe, 00000016.00000003.2251555312.00000295FC975000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC975000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ams.org/journals/mcom/1988-51-184/
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000002.2271903544.00000295F47D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cs.tut.fi/~foi/GCF-BM3D/BM3D_TIP_2007.pdf
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.dabeaz.com/ply)Fz
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.dai.ed.ac.uk/CVonline/LOCAL_COPIES/MANDUCHI1/Bilateral_Filtering.html
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gdal.org)
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gdal.org/formats_list.html)
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gdal.org/ogr_formats.html).
Source: staged_out.exe, 00000016.00000003.2251499316.00000295F2B88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/
Source: staged_out.exe, 00000016.00000002.2271651715.00000295F2B88000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251555312.00000295FC975000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC975000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251499316.00000295F2B88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/index.html
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000002.2273941997.00000295FD6D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/character-sets
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000002.2271903544.00000295F47D0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.ibiblio.org/xml/examples/shakespeare/hamlet.xml)-r(
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ifp.illinois.edu/~vuongle2/helen/
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.inf.ufrgs.br/~eslgastal/DomainTransform/).
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.inf.ufrgs.br/~eslgastal/DomainTransform/).COLOR_SPACE_Lab_D75_2MORPH_CROSSCAP_PROP_DC1394
Source: apt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251193956.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, _generator.pyd.20.drString found in binary or memory: http://www.inference.org.uk/mackay/itila/
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ipol.im/pub/algo/bcm_non_local_means_denoising
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ipol.im/pub/algo/bcm_non_local_means_denoising/
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ipol.im/pub/art/2011/ys-dct/
Source: apt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.math.sci.hiroshima-u.ac.jp/~m-mat/MT/JUMP/
Source: staged_out.exe, 00000016.00000003.2251193956.00000295FCF51000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.math.sfu.ca/~cbm/aands/
Source: staged_out.exe, 00000016.00000003.2251555312.00000295FC975000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC975000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.math.sfu.ca/~cbm/aands/page_379.htm
Source: apt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251811266.00000295FCF81000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF51000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251193956.00000295FCF51000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.math.sfu.ca/~cbm/aands/page_69.htm
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.megginson.com/SAX/.
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.nightmare.com/squirl/python-ext/misc/syslog.py
Source: staged_out.exe, 00000016.00000002.2272538615.00000295FCE02000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCDF1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.oasis-open.org/committees/documents.php
Source: staged_out.exe, 00000016.00000002.2272538615.00000295FCE02000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCDF1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.oasis-open.org/committees/documents.php?wg_abbrev=office-formula
Source: apt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pcg-random.org/
Source: apt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pcg-random.org/posts/developing-a-seed_seq-alternative.html
Source: apt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCE86000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCE86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pcg-random.org/posts/random-invertible-mapping-statistics.html
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000002.2271946338.00000295F4830000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.python.org/
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000002.2273539712.00000295FD1B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.python.org/dev/peps/pep-0205/
Source: staged_out.exe, 00000016.00000002.2271502517.00000295F2610000.00000004.00001000.00020000.00000000.sdmp, staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.python.org/download/releases/2.3/mro/.
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.rfc-editor.org/rfc/rfc%d.txtz(http://www.python.org/dev/peps/pep-%04d/r2
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.robotstxt.org/norobots-rfc.txt
Source: staged_out.exe, 00000016.00000003.2251555312.00000295FC975000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC975000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.scipy.org/not/real/data.txt
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.xmlrpc.com/discuss/msgReader$1208
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://www.xmlrpc.com/discuss/msgReader$1208z
Source: staged_out.exe, 00000016.00000002.2271651715.00000295F2B88000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251555312.00000295FC975000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC975000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251499316.00000295F2B88000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.xyz.edu/data
Source: staged_out.exe, 00000016.00000002.2270219476.0000000062EA2000.00000008.00000001.01000000.0000001D.sdmp, zlib1.dll.20.drString found in binary or memory: http://www.zlib.net/D
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://wwwsearch.sf.net/):
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://xml.org/sax/features/external-general-entities
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://xml.org/sax/features/external-parameter-entities
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://xml.org/sax/features/namespaces
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://xml.org/sax/features/namespacesz.http://xml.org/sax/features/namespace-prefixesz
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://xml.org/sax/features/string-interningz&http://xml.org/sax/features/validationz5http://xml.org
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://xml.python.org/entities/fragment-builder/internalz
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://xmlrpc.usefulinc.com/doc/reserved.html
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://arxiv.org/abs/1704.04503
Source: staged_out.exe, 00000016.00000002.2272538615.00000295FCE02000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCDF1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://askubuntu.com/questions/697397/python3-is-not-supporting-gtk-module
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://code.google.com/archive/p/casadebender/wikis/Win32IconImagePlugin.wiki
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://creativecommons.org/publicdomain/zero/1.0/
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.metadata.html
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://docs.python.org/3/library/importlib.resources.html
Source: staged_out.exe, 00000016.00000003.2251555312.00000295FC975000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC975000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/library/string.html#format-specification-mini-language
Source: staged_out.exe, 00000016.00000003.2251555312.00000295FC975000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC975000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.scipy.org/doc/numpy/reference/c-api.generalized-ufuncs.html
Source: staged_out.exe, 00000016.00000003.2251555312.00000295FC975000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC975000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.scipy.org/doc/numpy/user/basics.io.genfromtxt.html
Source: staged_out.exe, 00000016.00000002.2272421254.00000295FCCD0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.scipy.org/doc/numpy/user/numpy-for-matlab-users.html).
Source: staged_out.exe, 00000016.00000003.2250204397.00000295FCF51000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://en.wik
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://engineering.purdue.edu/~malcolm/pct/CTI_Ch03.pdf
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://exiv2.org/tags.html)
Source: apt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gist.github.com/imneme/540829265469e673d045
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/NVIDIA/caffe.
Source: staged_out.exe, 00000016.00000002.2274006172.00000295FD770000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/asweigart/pygetwindow
Source: staged_out.exe, 00000016.00000002.2274888906.00000295FDBD0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/asweigart/pyperclip/issues/55
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/baidut/BIMEF).
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: staged_out.exe, 00000016.00000003.2251555312.00000295FC975000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC975000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/joblib/threadpoolctl
Source: staged_out.exe, 00000016.00000002.2273669702.00000295FD2E0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/numpy/numpy/issues/4763
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000002.2271847177.00000295F4570000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/numpy/numpy/issues/8577
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv/issues/16736
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv/issues/16739
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv/issues/16739cv::MatOp_AddEx::assign
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv/issues/19634
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv/issues/19634cv::mjpeg::MjpegEncoder::MjpegEncodercv::mjpeg::MotionJ
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv/issues/20833
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv/issues/20833.
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv/issues/20833DNN/OpenCL:
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv/issues/21326
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv/issues/21326cv::initOpenEXRD:
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv/issues/5412.
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv/issues/6293
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv/issues/6293u-
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv_contrib/blob/master/modules/text/samples/OCRHMM_transitions_table.x
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv_contrib/blob/master/modules/text/samples/webcam_demo.cpp
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv_contrib/issues/2235
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/opencv/opencv_contrib/issues/2235cv::text::extract_features(
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/openvinotoolkit/open_model_zoo/blob/master/models/public/yolo-v2-tiny-tf/yolo-v2-
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://github.com/pypa/packagingz
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000002.2273765155.00000295FD440000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-pillow/Pillow/
Source: staged_out.exe, 00000016.00000003.2251555312.00000295FC8DB000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC8DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.7/Objects/listsort.txt
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/torch/nn/blob/master/doc/module.md
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
Source: staged_out.exe, 00000016.00000003.2252027013.00000295F2BAD000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2271694928.00000295F2BAE000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251499316.00000295F2B88000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://ipython.org
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
Source: staged_out.exe, 00000016.00000002.2274929166.00000295FDC10000.00000004.00001000.00020000.00000000.sdmp, staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://mouseinfo.readthedocs.io
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://mouseinfo.readthedocs.ioaMouseInfoWindowu
Source: staged_out.exe, 00000016.00000003.2252027013.00000295F2BAD000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2271694928.00000295F2BAE000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251499316.00000295F2B88000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://numpy.org/devdocs/user/troubleshooting-importerror.html
Source: staged_out.exe, 00000016.00000002.2272538615.00000295FCE02000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2271651715.00000295F2B88000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251555312.00000295FC8DB000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251499316.00000295F2B88000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCDF1000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC8DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://numpy.org/neps/nep-0032-remove-financial-functions.html
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://onnx.ai/
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://onnx.ai/)
Source: staged_out.exe, 00000016.00000003.2251555312.00000295FC8DB000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC8DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://people.eecs.berkeley.edu/~wkahan/Mindless.pdf
Source: staged_out.exe, 00000016.00000003.2251555312.00000295FC8DB000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC8DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://people.eecs.berkeley.edu/~wkahan/ieee754status/IEEE754.PDF
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pjreddie.com/darknet/
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pjreddie.com/darknet/)
Source: staged_out.exe, 00000016.00000002.2274929166.00000295FDC10000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-error
Source: staged_out.exe, 00000016.00000002.2272538615.00000295FCE02000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2271651715.00000295F2B88000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251555312.00000295FC8DB000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251499316.00000295F2B88000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCDF1000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC8DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/numpy-financial.
Source: staged_out.exe, 00000016.00000002.2273539712.00000295FD1B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://pypi.org/project/numpy-financial/).
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: staged_out.exe, 00000016.00000003.2251555312.00000295FC975000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC975000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://scipy-cookbook.readthedocs.io/items/Ctypes.html
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr7
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr7)
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://software.intel.com/openvino-toolkit)
Source: staged_out.exe, 00000016.00000002.2274888906.00000295FDBD0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/18905702/python-ctypes-and-mutable-buffers
Source: staged_out.exe, 00000016.00000002.2274888906.00000295FDBD0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/455434/how-should-i-use-formatmessage-properly-in-c
Source: staged_out.exe, 00000016.00000002.2273799570.00000295FD480000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/7648200/pip-install-pil-e-tickets-1-no-jpeg-png-support
Source: apt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251193956.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, _generator.pyd.20.drString found in binary or memory: https://stat.ethz.ch/~stahel/lognormal/bioscience.pdf
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000002.2271847177.00000295F4570000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://tinyurl.com/y3dm3h86
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://tinyurl.com/y3dm3h86u
Source: apt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, _generator.pyd.20.drString found in binary or memory: https://web.archive.org/web/20090423014010/http://www.brighton-webs.co.uk:80/distributions/wald.asp
Source: apt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251193956.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, _generator.pyd.20.drString found in binary or memory: https://web.archive.org/web/20090514091424/http://brighton-webs.co.uk:80/distributions/rayleigh.asp
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://web.archive.org/web/20120328125543/http://www.jpegcameras.com/libjpeg/libjpeg-3.html
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://web.archive.org/web/20170802060935/http://oss.sgi.com/projects/ogl-sample/registry/EXT/textu
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.cazabon.com
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.cazabon.com/pyCMS
Source: apt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.cs.hmc.edu/tr/hmc-cs-2014-0905.pdf
Source: _decimal.pyd.20.drString found in binary or memory: https://www.digicert.com/CPS0
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.ibm.com/support/knowledgecenter/en/ssw_aix_61/com.ibm.aix.basetrf1/dlopen.htm
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.ibm.com/support/knowledgecenter/en/ssw_aix_61/com.ibm.aix.basetrf1/load.htm
Source: apt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251193956.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, _generator.pyd.20.drString found in binary or memory: https://www.itl.nist.gov/div898/handbook/eda/section3/eda3663.htm
Source: apt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251193956.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, _generator.pyd.20.drString found in binary or memory: https://www.itl.nist.gov/div898/handbook/eda/section3/eda3666.htm
Source: apt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251193956.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, _generator.pyd.20.drString found in binary or memory: https://www.itl.nist.gov/div898/software/dataplot/refman2/auxillar/powpdf.pdf
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.learnopencv.com/convex-hull-using-opencv-in-python-and-c/
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.learnopencv.com/convex-hull-using-opencv-in-python-and-c/cornersQualityOOOO
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.littlecms.com
Source: staged_out.exe, 00000016.00000002.2272572945.00000295FCE86000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCE86000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.math.hmc.edu/~benjamin/papers/CombTrig.pdf
Source: staged_out.exe, 00000016.00000003.2251555312.00000295FC975000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC975000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mathworks.com/help/techdoc/ref/rank.html
Source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.mia.uni-saarland.de/Publications/gwosdek-ssvm11.pdf
Source: staged_out.exe, 00000016.00000003.2251555312.00000295FC975000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC975000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.numpy.org/neps/nep-0001-npy-format.html
Source: staged_out.exe, 00000016.00000003.2251555312.00000295FC975000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC975000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.openblas.net/
Source: staged_out.exe, 00000016.00000002.2271754317.00000295F2C30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.pygame.org/contribute.html
Source: staged_out.exe, 00000016.00000002.2271754317.00000295F2C30000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.pygame.org/docs/ref/color_list.html
Source: staged_out.exe, 00000016.00000002.2273637841.00000295FD290000.00000004.00001000.00020000.00000000.sdmp, staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.python.org/dev/peps/pep-0506/
Source: staged_out.exe, 00000016.00000003.2252027013.00000295F2BAD000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2271694928.00000295F2BAE000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251499316.00000295F2B88000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.scipy.org
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.tensorflow.org/
Source: apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.tensorflow.org/)

System Summary

barindex
Malicious sample detected (through community Yara rule)
Source: dump.pcap, type: PCAPMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 6.2.rkn.exe.580000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 7.0.rkn.exe.580000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 7.2.rkn.exe.580000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 6.0.rkn.exe.580000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 10.2.rkn.exe.580000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 10.0.rkn.exe.580000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000006.00000000.1716817368.0000000000583000.00000008.00000001.01000000.00000005.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000007.00000002.1859570340.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000007.00000002.1859480878.0000000000584000.00000008.00000001.01000000.00000005.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000006.00000002.2394995201.00000000014F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000000A.00000002.1906067523.0000000001510000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000006.00000002.2394739280.0000000000584000.00000008.00000001.01000000.00000005.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000007.00000000.1720009194.0000000000583000.00000008.00000001.01000000.00000005.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000000A.00000002.1905614691.0000000000584000.00000008.00000001.01000000.00000005.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 0000000A.00000000.1748245426.0000000000583000.00000008.00000001.01000000.00000005.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\rkn[1].log, type: DROPPEDMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: C:\Users\user\AppData\Local\Temp\rkn.exe, type: DROPPEDMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 6_2_014F7EC8 NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtUnmapViewOfSection,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,6_2_014F7EC8
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 7_2_005D7EC8 NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtUnmapViewOfSection,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,7_2_005D7EC8
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 10_2_01517EC8 NtCreateSection,NtMapViewOfSection,VirtualAlloc,NtUnmapViewOfSection,NtMapViewOfSection,VirtualProtect,VirtualProtect,VirtualProtect,10_2_01517EC8
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 6_2_014F7EC86_2_014F7EC8
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 6_2_014F35346_2_014F3534
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 6_2_014F47EC6_2_014F47EC
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 6_2_014F4C1C6_2_014F4C1C
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 6_2_014F44106_2_014F4410
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 6_2_014F56D06_2_014F56D0
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 7_2_005D7EC87_2_005D7EC8
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 7_2_005D4C1C7_2_005D4C1C
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 7_2_005D44107_2_005D4410
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 7_2_005D56D07_2_005D56D0
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 7_2_005D35347_2_005D3534
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 7_2_005D47EC7_2_005D47EC
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 10_2_01517EC810_2_01517EC8
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 10_2_0151353410_2_01513534
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 10_2_015147EC10_2_015147EC
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 10_2_0151441010_2_01514410
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 10_2_01514C1C10_2_01514C1C
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 10_2_015156D010_2_015156D0
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF63850AC9020_2_00007FF63850AC90
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF638508D8020_2_00007FF638508D80
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF6385015A020_2_00007FF6385015A0
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF63851719020_2_00007FF638517190
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF638502D7020_2_00007FF638502D70
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF638510E2820_2_00007FF638510E28
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF638507A3020_2_00007FF638507A30
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF6385111C020_2_00007FF6385111C0
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF63850225020_2_00007FF638502250
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF63850425020_2_00007FF638504250
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF63851F66820_2_00007FF63851F668
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF638513E7020_2_00007FF638513E70
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF638507E7020_2_00007FF638507E70
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF638503F0020_2_00007FF638503F00
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF6385102C020_2_00007FF6385102C0
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF6385106C820_2_00007FF6385106C8
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF63851BB7020_2_00007FF63851BB70
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF63851837020_2_00007FF638518370
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF638502B6020_2_00007FF638502B60
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF63850943020_2_00007FF638509430
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF63851C00C20_2_00007FF63851C00C
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF63851781020_2_00007FF638517810
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF6385063F020_2_00007FF6385063F0
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF63850208020_2_00007FF638502080
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF638511C8820_2_00007FF638511C88
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF63851185020_2_00007FF638511850
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF638516CFC20_2_00007FF638516CFC
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF6385104C420_2_00007FF6385104C4
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_62E8A2BB22_2_62E8A2BB
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_62E8B3B022_2_62E8B3B0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_62E81C9022_2_62E81C90
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_62E83C4022_2_62E83C40
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_62E8296022_2_62E82960
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_62E8211022_2_62E82110
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_62E8351022_2_62E83510
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_67883FA022_2_67883FA0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_678837D022_2_678837D0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_67884BD022_2_67884BD0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_67883BE022_2_67883BE0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6788230022_2_67882300
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6788332022_2_67883320
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_67882E8022_2_67882E80
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_67882A9022_2_67882A90
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_67892EA022_2_67892EA0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_67886EB022_2_67886EB0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6788DAE022_2_6788DAE0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_67891AE022_2_67891AE0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6789420022_2_67894200
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6788C66022_2_6788C660
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6788149022_2_67881490
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_67885CC022_2_67885CC0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_678924D022_2_678924D0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6788E41022_2_6788E410
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6788205022_2_67882050
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6788186022_2_67881860
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_68B4B0B022_2_68B4B0B0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_68B4C1F022_2_68B4C1F0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_68B442F022_2_68B442F0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_68B6420922_2_68B64209
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_68B4EB8022_2_68B4EB80
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_68B623E022_2_68B623E0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_68B58BC022_2_68B58BC0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_68B5F30022_2_68B5F300
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_68B664C622_2_68B664C6
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_68B515A022_2_68B515A0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_68B5859022_2_68B58590
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_68B4A5F022_2_68B4A5F0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_68B6271022_2_68B62710
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_68B4F70022_2_68B4F700
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_68B4576022_2_68B45760
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_69A025F022_2_69A025F0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_69A341D122_2_69A341D1
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_69A2A53022_2_69A2A530
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_69A068E022_2_69A068E0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_69A1173022_2_69A11730
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_69A08B7022_2_69A08B70
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6A896ED022_2_6A896ED0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6A88EF8022_2_6A88EF80
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6A890B9222_2_6A890B92
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6A8923A022_2_6A8923A0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6A889BF022_2_6A889BF0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6A88DBF022_2_6A88DBF0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6A893BF022_2_6A893BF0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6A881F5022_2_6A881F50
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6A89336022_2_6A893360
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6A88A37022_2_6A88A370
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6A894C8F22_2_6A894C8F
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6A884C9022_2_6A884C90
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6A895C9022_2_6A895C90
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6A88A8D022_2_6A88A8D0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6A8874D022_2_6A8874D0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6A88A8D222_2_6A88A8D2
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6A8858F022_2_6A8858F0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6A88182022_2_6A881820
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6A88659022_2_6A886590
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6A8911D322_2_6A8911D3
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6A8901E022_2_6A8901E0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6A88C92022_2_6A88C920
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6A887D2022_2_6A887D20
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6A88913022_2_6A889130
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6A886D4022_2_6A886D40
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AE82AE022_2_6AE82AE0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEC7AB022_2_6AEC7AB0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AE95A9022_2_6AE95A90
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AE8ABD022_2_6AE8ABD0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AE9AB7022_2_6AE9AB70
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AED6B7022_2_6AED6B70
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEB0B4022_2_6AEB0B40
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AE97B5022_2_6AE97B50
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AE8FB1022_2_6AE8FB10
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEA88C022_2_6AEA88C0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEB886022_2_6AEB8860
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AECE85022_2_6AECE850
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEB182022_2_6AEB1820
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEBC9F022_2_6AEBC9F0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEC49A022_2_6AEC49A0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AE96EA022_2_6AE96EA0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEC5EB022_2_6AEC5EB0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEA6E2022_2_6AEA6E20
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AE89FE022_2_6AE89FE0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEAFF7022_2_6AEAFF70
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEADF5022_2_6AEADF50
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEC1CF022_2_6AEC1CF0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEC3CA022_2_6AEC3CA0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEAAC9022_2_6AEAAC90
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEB8C7022_2_6AEB8C70
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEB5D7022_2_6AEB5D70
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEB3D2022_2_6AEB3D20
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AE9A2E022_2_6AE9A2E0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEE02F022_2_6AEE02F0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEC72C022_2_6AEC72C0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEDD27022_2_6AEDD270
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AE9F3B022_2_6AE9F3B0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AE8A36022_2_6AE8A360
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEDE35022_2_6AEDE350
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEDF35022_2_6AEDF350
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AE900E022_2_6AE900E0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEE50B022_2_6AEE50B0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEAD06022_2_6AEAD060
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEA001022_2_6AEA0010
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AECB01022_2_6AECB010
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AE9511022_2_6AE95110
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AE9B6F022_2_6AE9B6F0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEC64F122_2_6AEC64F1
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AED44B022_2_6AED44B0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEB65B022_2_6AEB65B0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AED655022_2_6AED6550
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_71002B3022_2_71002B30
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_710017C022_2_710017C0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_710023D022_2_710023D0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_7100382022_2_71003820
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_71003E4022_2_71003E40
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_710030A022_2_710030A0
Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\apt66ext[1].log 7FF47DCE0AD262F4C0818170213A2A5C97B098258F5B2E85B3DF5A48EED05183
Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\apt66ext.exe 7FF47DCE0AD262F4C0818170213A2A5C97B098258F5B2E85B3DF5A48EED05183
Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PIL\_imaging.pyd 6D21AC76315885570BDCBF7B54CDD212E430F4CA2708F6F641EB5F6FEEAFC6E2
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: String function: 68B46740 appears 73 times
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: String function: 67895E38 appears 140 times
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: String function: 71005D80 appears 51 times
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: String function: 68B46150 appears 62 times
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: String function: 67895EA0 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: String function: 68B46530 appears 166 times
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: String function: 6A8990A0 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: String function: 6A8991C8 appears 52 times
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: String function: 6A899180 appears 52 times
Source: sdl2.dll.20.drStatic PE information: Number of sections : 12 > 10
Source: sdl2_mixer.dll.20.drStatic PE information: Number of sections : 12 > 10
Source: sdl2_ttf.dll.20.drStatic PE information: Number of sections : 12 > 10
Source: libjpeg-9.dll.20.drStatic PE information: Number of sections : 11 > 10
Source: zlib1.dll.20.drStatic PE information: Number of sections : 12 > 10
Source: sdl2_image.dll.20.drStatic PE information: Number of sections : 12 > 10
Source: libpng16-16.dll.20.drStatic PE information: Number of sections : 11 > 10
Source: cv2.pyd.20.drStatic PE information: Number of sections : 11 > 10
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.20.drStatic PE information: Number of sections : 19 > 10
Source: libfreetype-6.dll.20.drStatic PE information: Number of sections : 12 > 10
Source: python3.dll.20.drStatic PE information: No import functions for PE file found
Source: FFbd.dllStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
Source: dump.pcap, type: PCAPMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 6.2.rkn.exe.580000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 7.0.rkn.exe.580000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 7.2.rkn.exe.580000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 6.0.rkn.exe.580000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 10.2.rkn.exe.580000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 10.0.rkn.exe.580000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000006.00000000.1716817368.0000000000583000.00000008.00000001.01000000.00000005.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000007.00000002.1859570340.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000007.00000002.1859480878.0000000000584000.00000008.00000001.01000000.00000005.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000006.00000002.2394995201.00000000014F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000000A.00000002.1906067523.0000000001510000.00000040.10000000.00040000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000006.00000002.2394739280.0000000000584000.00000008.00000001.01000000.00000005.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000007.00000000.1720009194.0000000000583000.00000008.00000001.01000000.00000005.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000000A.00000002.1905614691.0000000000584000.00000008.00000001.01000000.00000005.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 0000000A.00000000.1748245426.0000000000583000.00000008.00000001.01000000.00000005.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\rkn[1].log, type: DROPPEDMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: C:\Users\user\AppData\Local\Temp\rkn.exe, type: DROPPEDMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: qt5core.dll.20.drStatic PE information: Section: .qtmimed ZLIB complexity 0.997458770800317
Source: classification engineClassification label: mal100.evad.winDLL@43/179@0/1
Source: unity[1].pdf.7.drInitial sample: mailto:trademarks@unity.com
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF63850AB70 GetProcessId,GenerateConsoleCtrlEvent,GetLastError,FormatMessageA,WaitForSingleObject,CloseHandle,SHFileOperationW,20_2_00007FF63850AB70
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\rkn[2].logJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6836:120:WilError_03
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\rkn.exeJump to behavior
Source: FFbd.dllStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\AppData\Local\Temp\rkn.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\FFbd.dll,apt66
Source: FFbd.dllVirustotal: Detection: 9%
Source: unknownProcess created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\FFbd.dll"
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\FFbd.dll",#1
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\FFbd.dll,apt66
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\FFbd.dll",#1
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\FFbd.dll",apt66
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Users\user\AppData\Local\Temp\rkn.exe "C:\Users\user\AppData\Local\Temp\rkn.exe"
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Users\user\AppData\Local\Temp\rkn.exe "C:\Users\user\AppData\Local\Temp\rkn.exe"
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\unity.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Users\user\AppData\Local\Temp\rkn.exe "C:\Users\user\AppData\Local\Temp\rkn.exe"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2068 --field-trial-handle=1668,i,5790033669171981686,32294422139624892,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\unity.pdf"
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\unity.pdf"
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess created: C:\Users\user\AppData\Local\Temp\apt66ext.exe "C:\Users\user\AppData\Local\Temp\apt66ext.exe"
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeProcess created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exe "C:\Users\user\AppData\Local\Temp\apt66ext.exe"
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\FFbd.dll",#1Jump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\FFbd.dll,apt66Jump to behavior
Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\FFbd.dll",apt66Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\FFbd.dll",#1Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Users\user\AppData\Local\Temp\rkn.exe "C:\Users\user\AppData\Local\Temp\rkn.exe"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Users\user\AppData\Local\Temp\rkn.exe "C:\Users\user\AppData\Local\Temp\rkn.exe"Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Users\user\AppData\Local\Temp\rkn.exe "C:\Users\user\AppData\Local\Temp\rkn.exe"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\unity.pdf"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess created: C:\Users\user\AppData\Local\Temp\apt66ext.exe "C:\Users\user\AppData\Local\Temp\apt66ext.exe"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\unity.pdf"Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2068 --field-trial-handle=1668,i,5790033669171981686,32294422139624892,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\unity.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeProcess created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exe "C:\Users\user\AppData\Local\Temp\apt66ext.exe"
Source: C:\Windows\System32\loaddll32.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: wininet.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\loaddll32.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: msvcp140.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: amsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: slc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: msvcp140.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: amsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: edputil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: policymanager.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: msvcp110_win.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: slc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: sppc.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\rkn.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeSection loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeSection loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeSection loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeSection loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeSection loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeSection loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeSection loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeSection loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeSection loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: python37.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: sdl2.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: sdl2_image.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: libpng16-16.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: libjpeg-9.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: zlib1.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: sdl2_ttf.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: libfreetype-6.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: sdl2_mixer.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: libopenblas.wcdjnk7yvmpzq2me2zzhjjrj3jikndb7.gfortran-win_amd64.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: libcrypto-1_1.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: tcl86t.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: tk86t.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: logoncli.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: mfplat.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: mf.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: mfreadwrite.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: d3d11.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: mfcore.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: ksuser.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: rtworkq.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeSection loaded: umpdc.dll
Source: C:\Windows\SysWOW64\rundll32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: FFbd.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: FFbd.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: FFbd.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: FFbd.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: FFbd.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: FFbd.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: FFbd.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
Source: FFbd.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\Users\narut\source\repos\stage2test\Release\stage2test.pdb source: FFbd.dll
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: libcrypto-1_1.dll.20.dr
Source: Binary string: ~/.pdbrc source: staged_out.exe, 00000016.00000002.2274762745.00000295FDB10000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1g 21 Apr 2020built on: Fri Jun 12 19:40:20 2020 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: libcrypto-1_1.dll.20.dr
Source: Binary string: .pdbrc source: staged_out.exe, 00000016.00000002.2274762745.00000295FDB10000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: placed in the .pdbrc file): source: staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2273421053.00000295FD16A000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251888617.00000295FD169000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: -c are executed after commands from .pdbrc files. source: staged_out.exe, 00000016.00000002.2272538615.00000295FCE02000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCDF1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\18\s\PCbuild\amd64\_decimal.pdb source: _decimal.pyd.20.dr
Source: Binary string: If a file ".pdbrc" exists in your home directory or in the current source: staged_out.exe, 00000016.00000002.2272538615.00000295FCE02000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000002.2273403885.00000295FD168000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCDF1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\narut\source\repos\shellcoderunner\Release\shellcoderunner.pdb source: rkn.exe, 00000006.00000000.1716807213.0000000000582000.00000002.00000001.01000000.00000005.sdmp, rkn.exe, 00000006.00000002.2394697025.0000000000582000.00000002.00000001.01000000.00000005.sdmp, rkn.exe, 00000007.00000000.1719993020.0000000000582000.00000002.00000001.01000000.00000005.sdmp, rkn.exe, 00000007.00000002.1859446569.0000000000582000.00000002.00000001.01000000.00000005.sdmp, rkn.exe, 0000000A.00000000.1748192962.0000000000582000.00000002.00000001.01000000.00000005.sdmp, rkn.exe, 0000000A.00000002.1905527280.0000000000582000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: T.pdb source: rkn.exe, 00000006.00000002.2395016615.0000000001500000.00000004.00001000.00020000.00000000.sdmp, rkn.exe, 00000007.00000002.1859593411.00000000005E0000.00000004.00001000.00020000.00000000.sdmp, rkn.exe, 0000000A.00000002.1906141293.0000000001520000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: Initial commands are read from .pdbrc files in your home directory source: staged_out.exe, 00000016.00000002.2272538615.00000295FCE02000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCDF1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\6\b\libcrypto-1_1.pdb source: libcrypto-1_1.dll.20.dr
Source: Binary string: .pdbrc source: staged_out.exe, 00000016.00000002.2274762745.00000295FDB10000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: ~/.pdbrcz source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: D:\a\opencv-python\opencv-python\_skbuild\win-amd64-3.7\cmake-build\lib\python3\Release\cv2.pdb source: apt66ext.exe, 00000014.00000003.2229701481.0000017004268000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: :jC:\Users\narut\source\repos\stage2test\Release\stage2test.pdb source: FFbd.dll
Source: Binary string: C:\Users\narut\source\repos\fromshellcode\Release\fromshellcode.pdb source: rkn.exe, 00000006.00000002.2395343407.0000000002FC3000.00000002.10000000.00040000.00000000.sdmp, rkn.exe, 00000006.00000002.2395272404.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, rkn.exe, 00000007.00000002.1859609747.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, rkn.exe, 00000007.00000002.1859676876.00000000009D3000.00000002.10000000.00040000.00000000.sdmp, rkn.exe, 0000000A.00000002.1906412300.0000000001690000.00000004.00001000.00020000.00000000.sdmp, rkn.exe, 0000000A.00000002.1906499521.00000000016A3000.00000002.10000000.00040000.00000000.sdmp
Source: Binary string: C:\Users\narut\source\repos\shellcoderunner\Release\shellcoderunner.pdb source: rkn.exe, 00000006.00000000.1716807213.0000000000582000.00000002.00000001.01000000.00000005.sdmp, rkn.exe, 00000006.00000002.2394697025.0000000000582000.00000002.00000001.01000000.00000005.sdmp, rkn.exe, 00000007.00000000.1719993020.0000000000582000.00000002.00000001.01000000.00000005.sdmp, rkn.exe, 00000007.00000002.1859446569.0000000000582000.00000002.00000001.01000000.00000005.sdmp, rkn.exe, 0000000A.00000000.1748192962.0000000000582000.00000002.00000001.01000000.00000005.sdmp, rkn.exe, 0000000A.00000002.1905527280.0000000000582000.00000002.00000001.01000000.00000005.sdmp
Source: Binary string: .pdbrc) source: staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtdeclarative\lib\Qt5Qml.pdb source: apt66ext.exe, 00000014.00000003.2229701481.0000017005524000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\narut\source\repos\fromshellcode\Release\fromshellcode.pdb source: rkn.exe, 00000006.00000002.2395343407.0000000002FC3000.00000002.10000000.00040000.00000000.sdmp, rkn.exe, 00000006.00000002.2395272404.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, rkn.exe, 00000007.00000002.1859609747.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, rkn.exe, 00000007.00000002.1859676876.00000000009D3000.00000002.10000000.00040000.00000000.sdmp, rkn.exe, 0000000A.00000002.1906412300.0000000001690000.00000004.00001000.00020000.00000000.sdmp, rkn.exe, 0000000A.00000002.1906499521.00000000016A3000.00000002.10000000.00040000.00000000.sdmp
Source: Binary string: The standard debugger class (pdb.Pdb) is an example. source: staged_out.exe, 00000016.00000002.2272538615.00000295FCE02000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250931979.00000295FCF99000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272958187.00000295FCFC5000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCDF1000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251695950.00000295FCFBF000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2252140280.00000295FCFC4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\18\s\PCbuild\amd64\_decimal.pdb$$ source: _decimal.pyd.20.dr
Source: FFbd.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: FFbd.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: FFbd.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: FFbd.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: FFbd.dllStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: apt66ext.exe.6.drStatic PE information: section name: _RDATA
Source: apt66ext[1].log.6.drStatic PE information: section name: _RDATA
Source: staged_out.exe.20.drStatic PE information: section name: _RDATA
Source: libcrypto-1_1.dll.20.drStatic PE information: section name: .00cfg
Source: libfreetype-6.dll.20.drStatic PE information: section name: .xdata
Source: libjpeg-9.dll.20.drStatic PE information: section name: .xdata
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.20.drStatic PE information: section name: .xdata
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.20.drStatic PE information: section name: /4
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.20.drStatic PE information: section name: /19
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.20.drStatic PE information: section name: /31
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.20.drStatic PE information: section name: /45
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.20.drStatic PE information: section name: /57
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.20.drStatic PE information: section name: /70
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.20.drStatic PE information: section name: /81
Source: libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll.20.drStatic PE information: section name: /92
Source: libpng16-16.dll.20.drStatic PE information: section name: .xdata
Source: libssl-1_1.dll.20.drStatic PE information: section name: .00cfg
Source: msvcp140.dll.20.drStatic PE information: section name: .didat
Source: qt5core.dll.20.drStatic PE information: section name: .qtmimed
Source: sdl2.dll.20.drStatic PE information: section name: .xdata
Source: sdl2_image.dll.20.drStatic PE information: section name: .xdata
Source: sdl2_mixer.dll.20.drStatic PE information: section name: .xdata
Source: sdl2_ttf.dll.20.drStatic PE information: section name: .xdata
Source: vcruntime140.dll.20.drStatic PE information: section name: _RDATA
Source: zlib1.dll.20.drStatic PE information: section name: .xdata
Source: qsvgicon.dll.20.drStatic PE information: section name: .qtmetad
Source: qgif.dll.20.drStatic PE information: section name: .qtmetad
Source: qicns.dll.20.drStatic PE information: section name: .qtmetad
Source: qico.dll.20.drStatic PE information: section name: .qtmetad
Source: qjpeg.dll.20.drStatic PE information: section name: .qtmetad
Source: qsvg.dll.20.drStatic PE information: section name: .qtmetad
Source: qtga.dll.20.drStatic PE information: section name: .qtmetad
Source: qtiff.dll.20.drStatic PE information: section name: .qtmetad
Source: qwbmp.dll.20.drStatic PE information: section name: .qtmetad
Source: qwebp.dll.20.drStatic PE information: section name: .qtmetad
Source: dsengine.dll.20.drStatic PE information: section name: .qtmetad
Source: qtmedia_audioengine.dll.20.drStatic PE information: section name: .qtmetad
Source: wmfengine.dll.20.drStatic PE information: section name: .qtmetad
Source: qminimal.dll.20.drStatic PE information: section name: .qtmetad
Source: qoffscreen.dll.20.drStatic PE information: section name: .qtmetad
Source: qwebgl.dll.20.drStatic PE information: section name: .qtmetad
Source: qwindows.dll.20.drStatic PE information: section name: .qtmetad
Source: qxdgdesktopportal.dll.20.drStatic PE information: section name: .qtmetad
Source: windowsprintersupport.dll.20.drStatic PE information: section name: .qtmetad
Source: qwindowsvistastyle.dll.20.drStatic PE information: section name: .qtmetad
Source: math.pyd.20.drStatic PE information: section name: _RDATA
Source: cv2.pyd.20.drStatic PE information: section name: IPPCODE
Source: cv2.pyd.20.drStatic PE information: section name: IPPDATA
Source: cv2.pyd.20.drStatic PE information: section name: _RDATA
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 6_2_014F2B53 push ebx; ret 6_2_014F2B54
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 6_2_014F0DB2 push esp; retf 6_2_014F0DB8
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 7_2_005D2B53 push ebx; ret 7_2_005D2B54
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 7_2_005D0DB2 push esp; retf 7_2_005D0DB8
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 10_2_01512B53 push ebx; ret 10_2_01512B54
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 10_2_01510DB2 push esp; retf 10_2_01510DB8
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_62E9642E push rbx; ret 22_2_62E9642F
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_67895923 push rbp; retf 22_2_67895924
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_69A367D0 push rax; iretd 22_2_69A367D1
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEECA88 push rax; iretd 22_2_6AEECA89
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEE9B65 push rbp; retn 0001h22_2_6AEE9B73
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\mediaservice\dsengine.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PIL\_imagingcms.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\core\_multiarray_umath.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\surflock.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\sdl2.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5network.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\joystick.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5core.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\python37.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\iconengines\qsvgicon.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PIL\_imagingtk.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\linalg\lapack_lite.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\mask.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qico.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\libjpeg-9.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\color.pydJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\rkn.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\event.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\msvcp140.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\platformthemes\qxdgdesktopportal.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PIL\_imaging.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\libeay32.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\rkn.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\apt66ext[1].logJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\platforms\qwindows.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_bz2.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\vcruntime140.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\random\_pcg64.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5quick.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5gui.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\ssleay32.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\mediaservice\wmfengine.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\zlib1.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\QtWidgets.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\random\_bounded_integers.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_ctypes.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\libcrypto-1_1.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\bufferproxy.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PIL\_webp.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\random\_generator.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\msvcp140_1.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_asyncio.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5widgets.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\sdl2_mixer.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\key.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_multiprocessing.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\tk86t.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\random\_common.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5printsupport.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\sip.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\platforms\qoffscreen.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\mixer_music.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\scrap.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\python3.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\concrt140.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\platforms\qwebgl.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_hashlib.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\draw.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_cffi_backend.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5websockets.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\rwobject.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\unicodedata.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\math.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\random\mtrand.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_ssl.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_overlapped.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_lzma.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qjpeg.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\platforms\qminimal.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\image.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_socket.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\transform.pydJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\rkn[1].logJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_decimal.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\random\bit_generator.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\select.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\rkn.exeFile created: C:\Users\user\AppData\Local\Temp\apt66ext.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qtiff.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\pixelarray.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\sdl2_image.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\font.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\mixer.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\styles\qwindowsvistastyle.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\random\_sfc64.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qicns.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_queue.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\random\_philox.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\cv2\cv2.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\core\_multiarray_tests.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\sdl2_ttf.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5qml.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5svg.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\imageext.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\base.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\libpng16-16.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\display.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_elementtree.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\printsupport\windowsprintersupport.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qgif.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\libfreetype-6.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qtga.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\tcl86t.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\QtGui.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\linalg\_umath_linalg.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\vcruntime140_1.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PIL\_imagingft.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qwebp.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pyexpat.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qsvg.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\_freetype.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5multimedia.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\QtCore.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\random\_mt19937.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\time.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\surface.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\libssl-1_1.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\pixelcopy.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_tkinter.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\mediaservice\qtmedia_audioengine.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\constants.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\rect.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qwbmp.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5dbus.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\fft\_pocketfft_internal.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5qmlmodels.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile created: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\mouse.pydJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\rkn[1].logJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\rkn.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\apt66ext[1].logJump to dropped file
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\mediaservice\dsengine.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PIL\_imagingcms.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\core\_multiarray_umath.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\surflock.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5network.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\joystick.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5core.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\iconengines\qsvgicon.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PIL\_imagingtk.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\linalg\lapack_lite.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\mask.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qico.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\color.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\event.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\platformthemes\qxdgdesktopportal.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PIL\_imaging.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\libeay32.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\platforms\qwindows.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_bz2.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\random\_pcg64.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5quick.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5gui.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\ssleay32.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\mediaservice\wmfengine.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\QtWidgets.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\random\_bounded_integers.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_ctypes.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\bufferproxy.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PIL\_webp.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\random\_generator.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\msvcp140_1.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_asyncio.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5widgets.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\key.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_multiprocessing.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\random\_common.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5printsupport.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\sip.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\platforms\qoffscreen.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\scrap.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\mixer_music.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\python3.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\concrt140.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\platforms\qwebgl.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_hashlib.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\draw.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_cffi_backend.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5websockets.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\rwobject.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\unicodedata.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\math.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\random\mtrand.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_ssl.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_overlapped.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_lzma.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qjpeg.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\platforms\qminimal.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\image.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_socket.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\transform.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_decimal.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\random\bit_generator.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\select.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qtiff.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\pixelarray.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\font.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\mixer.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\random\_sfc64.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\styles\qwindowsvistastyle.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qicns.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_queue.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\random\_philox.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\cv2\cv2.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\core\_multiarray_tests.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5qml.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5svg.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\imageext.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\base.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\display.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_elementtree.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\printsupport\windowsprintersupport.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qgif.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qtga.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\QtGui.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\linalg\_umath_linalg.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PIL\_imagingft.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qwebp.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pyexpat.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qsvg.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\_freetype.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5multimedia.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\QtCore.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\random\_mt19937.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\surface.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\time.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\libssl-1_1.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\pixelcopy.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_tkinter.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\mediaservice\qtmedia_audioengine.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\constants.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\rect.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qwbmp.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5dbus.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\fft\_pocketfft_internal.pydJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5qmlmodels.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\mouse.pydJump to dropped file
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF638518370 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,20_2_00007FF638518370
Source: C:\Windows\System32\loaddll32.exeThread delayed: delay time: 120000Jump to behavior
Source: rundll32.exe, 00000004.00000002.1861211680.0000000002AAA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWx
Source: rkn.exe, 00000007.00000002.1859848122.0000000000AD4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y
Source: rkn.exe, 0000000A.00000002.1906582152.0000000001767000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWh*|
Source: rundll32.exe, 00000005.00000002.1908626749.000000000291A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWp
Source: rkn.exe, 00000007.00000002.1859848122.0000000000AEB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWKS@
Source: rundll32.exe, 00000003.00000002.2396183226.000000000309A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.2396183226.00000000030C6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1861211680.0000000002B04000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1908626749.0000000002977000.00000004.00000020.00020000.00000000.sdmp, rkn.exe, 00000006.00000002.2395036782.000000000151E000.00000004.00000020.00020000.00000000.sdmp, rkn.exe, 00000006.00000002.2395036782.0000000001576000.00000004.00000020.00020000.00000000.sdmp, rkn.exe, 00000007.00000002.1859848122.0000000000A97000.00000004.00000020.00020000.00000000.sdmp, rkn.exe, 00000007.00000002.1859848122.0000000000AEB000.00000004.00000020.00020000.00000000.sdmp, rkn.exe, 0000000A.00000002.1906582152.00000000017BB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information queried: ProcessInformation
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 6_2_00581668 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_00581668
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF63851A11C GetProcessHeap,20_2_00007FF63851A11C
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 6_2_005817CB SetUnhandledExceptionFilter,6_2_005817CB
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 6_2_00581668 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_00581668
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 6_2_00581904 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,6_2_00581904
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 6_2_02FC1AC6 SetUnhandledExceptionFilter,6_2_02FC1AC6
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 6_2_02FC1963 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_02FC1963
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 6_2_02FC1C04 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,6_2_02FC1C04
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 7_2_009D1AC6 SetUnhandledExceptionFilter,7_2_009D1AC6
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 7_2_009D1C04 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,7_2_009D1C04
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 7_2_009D1963 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,7_2_009D1963
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 10_2_016A1963 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,10_2_016A1963
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 10_2_016A1C04 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,10_2_016A1C04
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 10_2_016A1AC6 SetUnhandledExceptionFilter,10_2_016A1AC6
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF63850BD58 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,20_2_00007FF63850BD58
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF63850B600 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,20_2_00007FF63850B600
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF63850BF3C SetUnhandledExceptionFilter,20_2_00007FF63850BF3C
Source: C:\Users\user\AppData\Local\Temp\apt66ext.exeCode function: 20_2_00007FF6385148F0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,20_2_00007FF6385148F0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_62E925B6 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,22_2_62E925B6
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_67895016 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,22_2_67895016
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_68B632A6 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,22_2_68B632A6
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_69A2C3D0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,22_2_69A2C3D0
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6A8982C6 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,22_2_6A8982C6
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_6AEE6866 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,22_2_6AEE6866
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeCode function: 22_2_71004FA6 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,22_2_71004FA6

HIPS / PFW / Operating System Protection Evasion

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 121.127.33.39 80Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\FFbd.dll",#1Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\unity.pdf"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\unity.pdf"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rkn.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\unity.pdf"
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 6_2_00581A26 cpuid 6_2_00581A26
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeQueries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeQueries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeQueries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeQueries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeQueries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeQueries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeQueries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeQueries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeQueries volume information: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\rkn.exeCode function: 6_2_0058154F GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,6_2_0058154F
Source: C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire Infrastructure1
Spearphishing Link		Windows Management Instrumentation1
DLL Side-Loading		111
Process Injection		11
Masquerading		OS Credential Dumping1
System Time Discovery		Remote Services1
Archive Collected Data		1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Virtualization/Sandbox Evasion		LSASS Memory121
Security Software Discovery		Remote Desktop ProtocolData from Removable Media1
Ingress Tool Transfer		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)111
Process Injection		Security Account Manager1
Process Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
Deobfuscate/Decode Files or Information		NTDS1
Virtualization/Sandbox Evasion		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script2
Obfuscated Files or Information		LSA Secrets2
File and Directory Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
Rundll32		Cached Domain Credentials24
System Information Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
Software Packing		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
DLL Side-Loading		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1467959 Sample: FFbd.dll Startdate: 05/07/2024 Architecture: WINDOWS Score: 100 68 Multi AV Scanner detection for domain / URL 2->68 70 Malicious sample detected (through community Yara rule) 2->70 72 Antivirus detection for URL or domain 2->72 74 5 other signatures 2->74 11 loaddll32.exe 1 2->11         started        process3 process4 13 rundll32.exe 14 11->13         started        15 cmd.exe 1 11->15         started        17 rundll32.exe 13 11->17         started        20 conhost.exe 11->20         started        signatures5 22 rkn.exe 17 13->22         started        25 rundll32.exe 14 15->25         started        66 System process connects to network (likely due to code injection or exploit) 17->66 28 rkn.exe 17->28         started        process6 dnsIp7 48 C:\Users\user\AppData\Local\...\apt66ext.exe, PE32+ 22->48 dropped 50 C:\Users\user\AppData\...\apt66ext[1].log, PE32+ 22->50 dropped 30 apt66ext.exe 22->30         started        34 Acrobat.exe 22->34         started        64 121.127.33.39 RANATECHNET-AFRANATechnologiesKabulAF Afghanistan 25->64 52 C:\Users\user\AppData\Local\Temp\rkn.exe, PE32 25->52 dropped 54 C:\Users\user\AppData\Local\...\rkn[1].log, PE32 25->54 dropped 36 rkn.exe 3 15 25->36         started        38 Acrobat.exe 28->38         started        file8 process9 file10 56 C:\Users\user\AppData\Local\...\zlib1.dll, PE32+ 30->56 dropped 58 C:\Users\user\AppData\...\vcruntime140.dll, PE32+ 30->58 dropped 60 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 30->60 dropped 62 120 other files (86 malicious) 30->62 dropped 76 Multi AV Scanner detection for dropped file 30->76 40 staged_out.exe 30->40         started        42 Acrobat.exe 79 36->42         started        signatures11 process12 process13 44 AcroCEF.exe 107 42->44         started        process14 46 AcroCEF.exe 44->46         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
FFbd.dll11%ReversingLabs
FFbd.dll9%VirustotalBrowse

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\rkn[1].log100%AviraHEUR/AGEN.1318484
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\rkn[1].log100%Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\rkn[1].log63%ReversingLabsWin32.Exploit.DonutMarte
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\apt66ext[1].log18%ReversingLabsWin32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\apt66ext.exe18%ReversingLabsWin32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PIL\_imaging.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PIL\_imagingcms.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PIL\_imagingft.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PIL\_imagingtk.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PIL\_webp.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\QtCore.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\QtGui.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\QtWidgets.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\iconengines\qsvgicon.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qgif.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qicns.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qico.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qjpeg.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qsvg.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qtga.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qtiff.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qwbmp.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qwebp.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\mediaservice\dsengine.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\mediaservice\qtmedia_audioengine.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\mediaservice\wmfengine.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\platforms\qminimal.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\platforms\qoffscreen.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\platforms\qwebgl.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\platforms\qwindows.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\platformthemes\qxdgdesktopportal.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\printsupport\windowsprintersupport.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\styles\qwindowsvistastyle.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\sip.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_asyncio.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_bz2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_cffi_backend.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_ctypes.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_decimal.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_elementtree.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_hashlib.pyd0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://schemas.xmlsoap.org/wsdl/0%URL Reputationsafe
http://crl.thawte.com/ThawteTimestampingCA.crl00%URL Reputationsafe
http://torch.ch/)0%Avira URL Cloudsafe
http://www.scipy.org/not/real/data.txt0%Avira URL Cloudsafe
http://www.megginson.com/SAX/.0%Avira URL Cloudsafe
https://onnx.ai/)0%Avira URL Cloudsafe
http://caffe.berkeleyvision.org/)0%Avira URL Cloudsafe
https://web.archive.org/web/20090514091424/http://brighton-webs.co.uk:80/distributions/rayleigh.asp0%Avira URL Cloudsafe
https://github.com/opencv/opencv/issues/19634cv::mjpeg::MjpegEncoder::MjpegEncodercv::mjpeg::MotionJ0%Avira URL Cloudsafe
http://torch.ch/)0%VirustotalBrowse
http://121.127.33.39/rkn.log100%Avira URL Cloudmalware
http://www.scipy.org/not/real/data.txt0%VirustotalBrowse
https://onnx.ai/)0%VirustotalBrowse
https://web.archive.org/web/20170802060935/http://oss.sgi.com/projects/ogl-sample/registry/EXT/textu0%Avira URL Cloudsafe
http://121.127.33.39/apt66ext.log0%Avira URL Cloudsafe
https://web.archive.org/web/20090514091424/http://brighton-webs.co.uk:80/distributions/rayleigh.asp0%VirustotalBrowse
http://www.megginson.com/SAX/.2%VirustotalBrowse
https://github.com/opencv/opencv/issues/19634cv::mjpeg::MjpegEncoder::MjpegEncodercv::mjpeg::MotionJ0%VirustotalBrowse
https://numpy.org/neps/nep-0032-remove-financial-functions.html0%Avira URL Cloudsafe
https://web.archive.org/web/20170802060935/http://oss.sgi.com/projects/ogl-sample/registry/EXT/textu0%VirustotalBrowse
http://docs.python.org/library/unittest.html0%Avira URL Cloudsafe
http://121.127.33.39/rkn.log11%VirustotalBrowse
https://github.com/opencv/opencv/issues/62930%Avira URL Cloudsafe
https://github.com/opencv/opencv/issues/167390%Avira URL Cloudsafe
https://github.com/opencv/opencv/issues/167360%Avira URL Cloudsafe
https://numpy.org/neps/nep-0032-remove-financial-functions.html0%VirustotalBrowse
https://www.math.hmc.edu/~benjamin/papers/CombTrig.pdf0%Avira URL Cloudsafe
http://docs.python.org/library/unittest.html0%VirustotalBrowse
https://github.com/torch/nn/blob/master/doc/module.md0%Avira URL Cloudsafe
https://github.com/opencv/opencv/issues/167390%VirustotalBrowse
http://caffe.berkeleyvision.org/)0%VirustotalBrowse
http://121.127.33.39/apt66ext.log1%VirustotalBrowse
https://github.com/opencv/opencv/issues/62930%VirustotalBrowse
https://github.com/opencv/opencv/issues/167360%VirustotalBrowse
https://refspecs.linuxfoundation.org/elf/gabi40%Avira URL Cloudsafe
https://www.littlecms.com0%Avira URL Cloudsafe
http://121.127.33.39/apt66ext.logy0%Avira URL Cloudsafe
http://curl.haxx.se/rfc/cookie_spec.html0%Avira URL Cloudsafe
https://www.math.hmc.edu/~benjamin/papers/CombTrig.pdf0%VirustotalBrowse
https://refspecs.linuxfoundation.org/elf/gabi40%VirustotalBrowse
http://speleotrove.com/decimal/decarith.html0%Avira URL Cloudsafe
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode0%Avira URL Cloudsafe
http://www.gdal.org/ogr_formats.html).0%Avira URL Cloudsafe
https://github.com/torch/nn/blob/master/doc/module.md0%VirustotalBrowse
http://curl.haxx.se/rfc/cookie_spec.html0%VirustotalBrowse
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr70%Avira URL Cloudsafe
https://github.com/numpy/numpy/issues/85770%Avira URL Cloudsafe
http://arxiv.org/abs/1805.10941.0%Avira URL Cloudsafe
https://www.littlecms.com0%VirustotalBrowse
http://www.gdal.org/ogr_formats.html).0%VirustotalBrowse
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode0%VirustotalBrowse
https://stackoverflow.com/questions/7648200/pip-install-pil-e-tickets-1-no-jpeg-png-support0%Avira URL Cloudsafe
http://json.org0%Avira URL Cloudsafe
https://www.tensorflow.org/)0%Avira URL Cloudsafe
http://speleotrove.com/decimal/decarith.html0%VirustotalBrowse
http://xml.python.org/entities/fragment-builder/internalz0%Avira URL Cloudsafe
http://arxiv.org/abs/1805.10941.0%VirustotalBrowse
https://exiv2.org/tags.html)0%Avira URL Cloudsafe
https://github.com/numpy/numpy/issues/85770%VirustotalBrowse
http://json.org0%VirustotalBrowse
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr70%VirustotalBrowse
http://mathworld.wolfram.com/NegativeBinomialDistribution.html0%Avira URL Cloudsafe
https://stackoverflow.com/questions/7648200/pip-install-pil-e-tickets-1-no-jpeg-png-support0%VirustotalBrowse
https://github.com/opencv/opencv_contrib/blob/master/modules/text/samples/OCRHMM_transitions_table.x0%Avira URL Cloudsafe
https://www.itl.nist.gov/div898/software/dataplot/refman2/auxillar/powpdf.pdf0%Avira URL Cloudsafe
http://xml.python.org/entities/fragment-builder/internalz0%VirustotalBrowse
https://exiv2.org/tags.html)1%VirustotalBrowse
https://www.pygame.org/contribute.html0%Avira URL Cloudsafe
https://www.tensorflow.org/)0%VirustotalBrowse
http://www.cl.cam.ac.uk/~mgk25/iso-time.html0%Avira URL Cloudsafe
http://mathworld.wolfram.com/NegativeBinomialDistribution.html0%VirustotalBrowse
http://www.oasis-open.org/committees/documents.php0%Avira URL Cloudsafe
https://www.itl.nist.gov/div898/software/dataplot/refman2/auxillar/powpdf.pdf0%VirustotalBrowse
http://www.pcg-random.org/posts/developing-a-seed_seq-alternative.html0%Avira URL Cloudsafe
https://www.pygame.org/contribute.html0%VirustotalBrowse
https://github.com/pypa/packagingz0%Avira URL Cloudsafe
https://github.com/opencv/opencv_contrib/issues/22350%Avira URL Cloudsafe
http://www.oasis-open.org/committees/documents.php0%VirustotalBrowse
https://github.com/numpy/numpy/issues/47630%Avira URL Cloudsafe
http://mathworld.wolfram.com/CauchyDistribution.html0%Avira URL Cloudsafe
https://github.com/pypa/packagingz0%VirustotalBrowse
http://www.pcg-random.org/posts/developing-a-seed_seq-alternative.html0%VirustotalBrowse
http://www.inf.ufrgs.br/~eslgastal/DomainTransform/).COLOR_SPACE_Lab_D75_2MORPH_CROSSCAP_PROP_DC13940%Avira URL Cloudsafe
http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.476.5736&rep=rep1&type=pdf0%Avira URL Cloudsafe
http://www.cl.cam.ac.uk/~mgk25/iso-time.html0%VirustotalBrowse
http://graphics.berkeley.edu/papers/Tao-SAN-2012-05/0%Avira URL Cloudsafe
http://www.zlib.net/D0%Avira URL Cloudsafe
https://github.com/opencv/opencv_contrib/blob/master/modules/text/samples/OCRHMM_transitions_table.x0%VirustotalBrowse
https://onnx.ai/0%Avira URL Cloudsafe
https://software.intel.com/openvino-toolkit)0%Avira URL Cloudsafe
http://caffe.berkeleyvision.org0%Avira URL Cloudsafe
https://askubuntu.com/questions/697397/python3-is-not-supporting-gtk-module0%Avira URL Cloudsafe
https://github.com/jaraco/jaraco.functools/issues/50%Avira URL Cloudsafe
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm0%Avira URL Cloudsafe
https://pypi.org/project/numpy-financial.0%Avira URL Cloudsafe
https://mahler:8092/site-updates.py0%Avira URL Cloudsafe
https://www.numpy.org/neps/nep-0001-npy-format.html0%Avira URL Cloudsafe
http://121.127.33.39/0%Avira URL Cloudsafe
https://www.learnopencv.com/convex-hull-using-opencv-in-python-and-c/cornersQualityOOOO0%Avira URL Cloudsafe
https://github.com/opencv/opencv/issues/21326cv::initOpenEXRD:0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://onnx.ai/)apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://caffe.berkeleyvision.org/)apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://www.scipy.org/not/real/data.txtstaged_out.exe, 00000016.00000003.2251555312.00000295FC975000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC975000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://www.megginson.com/SAX/.staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpfalse
  • 2%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://torch.ch/)apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://github.com/opencv/opencv/issues/19634cv::mjpeg::MjpegEncoder::MjpegEncodercv::mjpeg::MotionJapt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://web.archive.org/web/20090514091424/http://brighton-webs.co.uk:80/distributions/rayleigh.aspapt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251193956.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, _generator.pyd.20.drfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://121.127.33.39/rkn.logrundll32.exe, 00000005.00000002.1908626749.000000000291A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1908626749.000000000295B000.00000004.00000020.00020000.00000000.sdmp, FFbd.dllfalse
  • 11%, Virustotal, Browse
  • Avira URL Cloud: malware
unknown
https://web.archive.org/web/20170802060935/http://oss.sgi.com/projects/ogl-sample/registry/EXT/textustaged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://121.127.33.39/apt66ext.logrkn.exe, rkn.exe, 0000000A.00000002.1906582152.00000000017A4000.00000004.00000020.00020000.00000000.sdmpfalse
  • 1%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://numpy.org/neps/nep-0032-remove-financial-functions.htmlstaged_out.exe, 00000016.00000002.2272538615.00000295FCE02000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2271651715.00000295F2B88000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251555312.00000295FC8DB000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251499316.00000295F2B88000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCDF1000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC8DF000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://docs.python.org/library/unittest.htmlstaged_out.exe, 00000016.00000002.2272538615.00000295FCE02000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCDF1000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://github.com/opencv/opencv/issues/6293apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://github.com/opencv/opencv/issues/16739apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://github.com/opencv/opencv/issues/16736apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://www.math.hmc.edu/~benjamin/papers/CombTrig.pdfstaged_out.exe, 00000016.00000002.2272572945.00000295FCE86000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCE86000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://github.com/torch/nn/blob/master/doc/module.mdapt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://refspecs.linuxfoundation.org/elf/gabi4staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://www.littlecms.comstaged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://121.127.33.39/apt66ext.logyrkn.exe, 00000007.00000002.1859848122.0000000000AD4000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://curl.haxx.se/rfc/cookie_spec.htmlstaged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://speleotrove.com/decimal/decarith.htmlstaged_out.exe, 00000016.00000002.2272538615.00000295FCE02000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCDF1000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncodestaged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://www.gdal.org/ogr_formats.html).apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr7staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://github.com/numpy/numpy/issues/8577staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000002.2271847177.00000295F4570000.00000004.00001000.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://arxiv.org/abs/1805.10941.apt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, _generator.pyd.20.drfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://json.orgstaged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://stackoverflow.com/questions/7648200/pip-install-pil-e-tickets-1-no-jpeg-png-supportstaged_out.exe, 00000016.00000002.2273799570.00000295FD480000.00000004.00001000.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://www.tensorflow.org/)apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://xml.python.org/entities/fragment-builder/internalzstaged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://exiv2.org/tags.html)staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpfalse
  • 1%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://mathworld.wolfram.com/NegativeBinomialDistribution.htmlapt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251193956.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, _generator.pyd.20.drfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://github.com/opencv/opencv_contrib/blob/master/modules/text/samples/OCRHMM_transitions_table.xapt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://www.itl.nist.gov/div898/software/dataplot/refman2/auxillar/powpdf.pdfapt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251193956.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, _generator.pyd.20.drfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://www.pygame.org/contribute.htmlstaged_out.exe, 00000016.00000002.2271754317.00000295F2C30000.00000004.00001000.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://www.cl.cam.ac.uk/~mgk25/iso-time.htmlstaged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000002.2271903544.00000295F47D0000.00000004.00001000.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://www.oasis-open.org/committees/documents.phpstaged_out.exe, 00000016.00000002.2272538615.00000295FCE02000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCDF1000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
http://www.pcg-random.org/posts/developing-a-seed_seq-alternative.htmlapt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://github.com/pypa/packagingzstaged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpfalse
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
unknown
https://github.com/opencv/opencv_contrib/issues/2235apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://github.com/numpy/numpy/issues/4763staged_out.exe, 00000016.00000002.2273669702.00000295FD2E0000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://mathworld.wolfram.com/CauchyDistribution.htmlapt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251193956.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, _generator.pyd.20.drfalse
  • Avira URL Cloud: safe
unknown
http://www.inf.ufrgs.br/~eslgastal/DomainTransform/).COLOR_SPACE_Lab_D75_2MORPH_CROSSCAP_PROP_DC1394apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.476.5736&rep=rep1&type=pdfapt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://graphics.berkeley.edu/papers/Tao-SAN-2012-05/apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.zlib.net/Dstaged_out.exe, 00000016.00000002.2270219476.0000000062EA2000.00000008.00000001.01000000.0000001D.sdmp, zlib1.dll.20.drfalse
  • Avira URL Cloud: safe
unknown
http://schemas.xmlsoap.org/wsdl/staged_out.exe, 00000016.00000002.2273973720.00000295FD720000.00000004.00001000.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2273941997.00000295FD6D0000.00000004.00001000.00020000.00000000.sdmpfalse
  • URL Reputation: safe
unknown
https://onnx.ai/apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://software.intel.com/openvino-toolkit)apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://caffe.berkeleyvision.orgapt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://askubuntu.com/questions/697397/python3-is-not-supporting-gtk-modulestaged_out.exe, 00000016.00000002.2272538615.00000295FCE02000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCDF1000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://github.com/jaraco/jaraco.functools/issues/5staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htmstaged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000002.2271946338.00000295F4830000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://pypi.org/project/numpy-financial.staged_out.exe, 00000016.00000002.2272538615.00000295FCE02000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2271651715.00000295F2B88000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251555312.00000295FC8DB000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251499316.00000295F2B88000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCDF1000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC8DF000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.numpy.org/neps/nep-0001-npy-format.htmlstaged_out.exe, 00000016.00000003.2251555312.00000295FC975000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC975000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://mahler:8092/site-updates.pystaged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://121.127.33.39/rundll32.exe, 00000003.00000002.2396183226.00000000030BF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000003.00000002.2396183226.00000000030AD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.1861211680.0000000002AEB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1908626749.000000000291A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1908626749.000000000295B000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://github.com/opencv/opencv/issues/21326cv::initOpenEXRD:apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.learnopencv.com/convex-hull-using-opencv-in-python-and-c/cornersQualityOOOOapt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://github.com/asweigart/pygetwindowstaged_out.exe, 00000016.00000002.2274006172.00000295FD770000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://pyperclip.readthedocs.io/en/latest/index.html#not-implemented-errorstaged_out.exe, 00000016.00000002.2274929166.00000295FDC10000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://121.127.33.39/rkn.logllrundll32.exe, 00000003.00000002.2396183226.000000000306A000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://mouseinfo.readthedocs.iostaged_out.exe, 00000016.00000002.2274929166.00000295FDC10000.00000004.00001000.00020000.00000000.sdmp, staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.cazabon.comstaged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.cs.tut.fi/~foi/GCF-BM3D/BM3D_TIP_2007.pdfapt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.google.com/index.htmlstaged_out.exe, 00000016.00000002.2271651715.00000295F2B88000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251555312.00000295FC975000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC975000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251499316.00000295F2B88000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://github.com/openvinotoolkit/open_model_zoo/blob/master/models/public/yolo-v2-tiny-tf/yolo-v2-apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://tip.tcl.tk/48)staged_out.exe, 00000016.00000003.2251888617.00000295FD177000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2273421053.00000295FD177000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://github.com/python/cpython/blob/3.7/Objects/listsort.txtstaged_out.exe, 00000016.00000003.2251555312.00000295FC8DB000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC8DF000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://pracrand.sourceforge.net/RNG_engines.txtapt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCE86000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCE86000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://xml.org/sax/features/namespacesz.http://xml.org/sax/features/namespace-prefixeszstaged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://121.127.33.39/unity.pdfapt66ext.exehttp://121.127.33.39/apt66ext.logapt66.exemsupdate.exeCrkn.exe, 00000006.00000002.2395343407.0000000002FC3000.00000002.10000000.00040000.00000000.sdmp, rkn.exe, 00000006.00000002.2395272404.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, rkn.exe, 00000007.00000002.1859609747.00000000005F0000.00000004.00001000.00020000.00000000.sdmp, rkn.exe, 00000007.00000002.1859676876.00000000009D3000.00000002.10000000.00040000.00000000.sdmp, rkn.exe, 0000000A.00000002.1906412300.0000000001690000.00000004.00001000.00020000.00000000.sdmp, rkn.exe, 0000000A.00000002.1906499521.00000000016A3000.00000002.10000000.00040000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0_decimal.pyd.20.drfalse
  • URL Reputation: safe
unknown
https://stat.ethz.ch/~stahel/lognormal/bioscience.pdfapt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251193956.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, _generator.pyd.20.drfalse
  • Avira URL Cloud: safe
unknown
http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.131.6394apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://github.com/opencv/opencv/issues/21326apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.iana.org/time-zones/repository/tz-link.htmlstaged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000002.2271903544.00000295F47D0000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://docs.python.org/library/itertools.html#recipesstaged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.ipol.im/pub/algo/bcm_non_local_means_denoisingapt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbcastaged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://www.openblas.net/staged_out.exe, 00000016.00000003.2251555312.00000295FC975000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC975000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://tinyurl.com/y3dm3h86staged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000002.2271847177.00000295F4570000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://digitalassets.lib.berkeley.edu/sdtr/ucb/text/34.pdfstaged_out.exe, 00000016.00000003.2251555312.00000295FC975000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC975000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.ipol.im/pub/art/2011/ys-dct/apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://arxiv.org/abs/1704.04503apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://code.google.com/archive/p/casadebender/wikis/Win32IconImagePlugin.wikistaged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.ipol.im/pub/algo/bcm_non_local_means_denoising/apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.nightmare.com/squirl/python-ext/misc/syslog.pystaged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.pcg-random.org/apt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://github.com/opencv/opencv/issues/20833.apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.math.sfu.ca/~cbm/aands/page_379.htmstaged_out.exe, 00000016.00000003.2251555312.00000295FC975000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC975000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.iana.org/assignments/character-setsstaged_out.exe, 00000016.00000000.2242638599.00007FF6DBAD7000.00000002.00000001.01000000.00000009.sdmp, staged_out.exe, 00000016.00000002.2273941997.00000295FD6D0000.00000004.00001000.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://people.eecs.berkeley.edu/~wkahan/ieee754status/IEEE754.PDFstaged_out.exe, 00000016.00000003.2251555312.00000295FC8DB000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272015625.00000295FC8DF000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://www.gdal.org/formats_list.html)apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
https://github.com/opencv/opencv/issues/20833DNN/OpenCL:apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown
http://mathworld.wolfram.com/GammaDistribution.htmlapt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF04000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251193956.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, _generator.pyd.20.drfalse
  • Avira URL Cloud: safe
unknown
https://www.itl.nist.gov/div898/handbook/eda/section3/eda3663.htmapt66ext.exe, 00000014.00000003.2229701481.000001700514C000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000002.2272572945.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2250204397.00000295FCF06000.00000004.00000020.00020000.00000000.sdmp, staged_out.exe, 00000016.00000003.2251193956.00000295FCEE2000.00000004.00000020.00020000.00000000.sdmp, _generator.pyd.20.drfalse
  • Avira URL Cloud: safe
unknown
http://www.gdal.org)apt66ext.exe, 00000014.00000003.2229701481.0000017003200000.00000004.00000020.00020000.00000000.sdmpfalse
  • Avira URL Cloud: safe
unknown

World Map of Contacted IPs

  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Public IPs

IPDomainCountryFlagASNASN NameMalicious
121.127.33.39
unknownAfghanistan
55732RANATECHNET-AFRANATechnologiesKabulAFtrue

General Information

Joe Sandbox version:40.0.0 Tourmaline
Analysis ID:1467959
Start date and time:2024-07-05 06:58:03 +02:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 10m 16s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:default.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:Run with higher sleep bypass
Number of analysed new started processes analysed:24
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Sample name:FFbd.dll
Detection:MAL
Classification:mal100.evad.winDLL@43/179@0/1
EGA Information:Failed
HCA Information:
  • Successful, ratio: 99%
  • Number of executed functions: 37
  • Number of non-executed functions: 321
Cookbook Comments:
  • Found application associated with file extension: .dll
  • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

  • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 23.211.8.250, 2.19.126.149, 2.19.126.143, 50.16.47.176, 54.224.241.105, 34.237.241.83, 18.213.11.84, 172.64.41.3, 162.159.61.3, 192.168.2.4, 2.16.241.15, 2.16.241.13, 95.101.148.135, 199.232.210.172, 23.200.0.33
  • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, identrust.edgesuite.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, e4578.dscb.akamaiedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, a1952.dscq.akamai.net, ssl.adobe.com.edgekey.net, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, geo2.adobe.com, apps.identrust.com, wu-b-net.trafficmanager.net
  • Not all processes where analyzed, report is missing behavior information
  • Report size exceeded maximum capacity and may have missing behavior information.
  • Report size getting too big, too many NtOpenKeyEx calls found.
  • Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
121.127.33.39rkn.log.exeGet hashmaliciousUnknownBrowse
  • 121.127.33.39/apt66ext.log

Domains

⊘No context

ASNs

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
RANATECHNET-AFRANATechnologiesKabulAFmsupdate.exeGet hashmaliciousUnknownBrowse
  • 121.127.33.39
rkn.log.exeGet hashmaliciousUnknownBrowse
  • 121.127.33.39
https://www.pxfuel.com/Get hashmaliciousUnknownBrowse
  • 121.127.42.98
https://www.msn.com/en-us/weather/forecast/in-Des-Moines,IA?loc=eyJsIjoiRGVzIE1vaW5lcyIsInIiOiJJQSIsImMiOiJVbml0ZWQgU3RhdGVzIiwiaSI6IlVTIiwidCI6MSwiZyI6ImVuLXVzIiwieCI6Ii05My42MjAzMzg0Mzk5NDE0IiwieSI6IjQxLjU4ODc5MDg5MzU1NDY5In0%3D&weadegreetype=FGet hashmaliciousUnknownBrowse
  • 121.127.42.98
https://lanecain-homes.com/Get hashmaliciousUnknownBrowse
  • 121.127.42.98
http://belastingdienst-betalingportaal.infoGet hashmaliciousUnknownBrowse
  • 121.127.45.81

JA3 Fingerprints

⊘No context

Dropped Files

MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
C:\Users\user\AppData\Local\Temp\apt66ext.exerkn.log.exeGet hashmaliciousUnknownBrowse
    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\apt66ext[1].logrkn.log.exeGet hashmaliciousUnknownBrowse
      C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PIL\_imaging.pydmsupdate.exeGet hashmaliciousUnknownBrowse
        rkn.log.exeGet hashmaliciousUnknownBrowse
          apt66ext.log.exeGet hashmaliciousUnknownBrowse
            SecuriteInfo.com.Win64.DropperX-gen.9519.23032.exeGet hashmaliciousUnknownBrowse
              SecuriteInfo.com.Win64.DropperX-gen.9519.23032.exeGet hashmaliciousBazaLoaderBrowse

                Created / dropped Files

                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:ASCII text
                Category:dropped
                Size (bytes):292
                Entropy (8bit):5.155390965213848
                Encrypted:false
                SSDEEP:6:BOQI5fEL+q2Pwkn2nKuAl9OmbnIFUt84OQI5fk1Zmw+4OQI5f7GklLVkwOwkn2nC:EQqZvYfHAahFUt81Qqk1/+1Qq7rz5JfC
                MD5:004E654AC6E6160219656BFF4E41AD52
                SHA1:516036679E30EA118A295E3410AD00F4F340A27F
                SHA-256:6180114C4D9103A0235DF9F7F4D3420693368C25E9116C5940C3919181C055AE
                SHA-512:67F86B4CF80B0B5286E88007BA5C98B2228E2947705A31E8F35E4A521AB98B12A6D46045E83148F0BC558A00C40E2E88FB0892E165B1489AF4CDB40CC0206B96
                Malicious:false
                Preview:2024/07/05-00:59:02.020 1c98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/07/05-00:59:02.022 1c98 Recovering log #3.2024/07/05-00:59:02.023 1c98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:ASCII text
                Category:dropped
                Size (bytes):292
                Entropy (8bit):5.155390965213848
                Encrypted:false
                SSDEEP:6:BOQI5fEL+q2Pwkn2nKuAl9OmbnIFUt84OQI5fk1Zmw+4OQI5f7GklLVkwOwkn2nC:EQqZvYfHAahFUt81Qqk1/+1Qq7rz5JfC
                MD5:004E654AC6E6160219656BFF4E41AD52
                SHA1:516036679E30EA118A295E3410AD00F4F340A27F
                SHA-256:6180114C4D9103A0235DF9F7F4D3420693368C25E9116C5940C3919181C055AE
                SHA-512:67F86B4CF80B0B5286E88007BA5C98B2228E2947705A31E8F35E4A521AB98B12A6D46045E83148F0BC558A00C40E2E88FB0892E165B1489AF4CDB40CC0206B96
                Malicious:false
                Preview:2024/07/05-00:59:02.020 1c98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/07/05-00:59:02.022 1c98 Recovering log #3.2024/07/05-00:59:02.023 1c98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:ASCII text
                Category:dropped
                Size (bytes):336
                Entropy (8bit):5.142448171831532
                Encrypted:false
                SSDEEP:6:BOQI5frzi+q2Pwkn2nKuAl9Ombzo2jMGIFUt84OQI5fpOHZmw+4OQI5fFVkwOwkV:EQqK+vYfHAa8uFUt81Qqpa/+1QqFV5JI
                MD5:37C6EFB91485A84B1ED0EC6E3B5BA781
                SHA1:CDD8A1B25C01A96961C5AE24013E196826E9844E
                SHA-256:33C789612C2D49B888D2AEAC3D9D7DBFA46923864B9D2D70EBAA0902CED98673
                SHA-512:D98B8DEB5EEE19E94196EF9B3BB326DB7BF3207AFA57BE24FD8D6FD34668352560C7513B5575829728F304B1888194CB2F15C6AE1C7EAA2F1E8034429FF4476E
                Malicious:false
                Preview:2024/07/05-00:59:02.101 1d9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/07/05-00:59:02.103 1d9c Recovering log #3.2024/07/05-00:59:02.104 1d9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:ASCII text
                Category:dropped
                Size (bytes):336
                Entropy (8bit):5.142448171831532
                Encrypted:false
                SSDEEP:6:BOQI5frzi+q2Pwkn2nKuAl9Ombzo2jMGIFUt84OQI5fpOHZmw+4OQI5fFVkwOwkV:EQqK+vYfHAa8uFUt81Qqpa/+1QqFV5JI
                MD5:37C6EFB91485A84B1ED0EC6E3B5BA781
                SHA1:CDD8A1B25C01A96961C5AE24013E196826E9844E
                SHA-256:33C789612C2D49B888D2AEAC3D9D7DBFA46923864B9D2D70EBAA0902CED98673
                SHA-512:D98B8DEB5EEE19E94196EF9B3BB326DB7BF3207AFA57BE24FD8D6FD34668352560C7513B5575829728F304B1888194CB2F15C6AE1C7EAA2F1E8034429FF4476E
                Malicious:false
                Preview:2024/07/05-00:59:02.101 1d9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/07/05-00:59:02.103 1d9c Recovering log #3.2024/07/05-00:59:02.104 1d9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):475
                Entropy (8bit):4.971927614950059
                Encrypted:false
                SSDEEP:12:YH/um3RA8squHWsBdOg2H0fcaq3QYiubInP7E4T3y:Y2sRdsFbdMH0u3QYhbG7nby
                MD5:1AE672EA76A43EB2A5A34AD3DDF619E0
                SHA1:237C26DF6089E54F129E1BF2B3A63173B0F1476C
                SHA-256:5772E2194FEE3852963D7F9D473B438433BF93BC318DBD17B22E8E736B732EDD
                SHA-512:0F0B3B73B08826267D1B3E2965B9621643AF0AB035B8C15A515ABD7D14C13CE3CE1EDE32522AB856D1676C4F4982782B225600961F35D3AD1DBE3E57A2454DE2
                Malicious:false
                Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13364715547926055","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":174888},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\aa3dba9b-6806-4db1-a646-aadb714730fc.tmp

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:JSON data
                Category:modified
                Size (bytes):475
                Entropy (8bit):4.971927614950059
                Encrypted:false
                SSDEEP:12:YH/um3RA8squHWsBdOg2H0fcaq3QYiubInP7E4T3y:Y2sRdsFbdMH0u3QYhbG7nby
                MD5:1AE672EA76A43EB2A5A34AD3DDF619E0
                SHA1:237C26DF6089E54F129E1BF2B3A63173B0F1476C
                SHA-256:5772E2194FEE3852963D7F9D473B438433BF93BC318DBD17B22E8E736B732EDD
                SHA-512:0F0B3B73B08826267D1B3E2965B9621643AF0AB035B8C15A515ABD7D14C13CE3CE1EDE32522AB856D1676C4F4982782B225600961F35D3AD1DBE3E57A2454DE2
                Malicious:false
                Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13364715547926055","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":174888},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:data
                Category:dropped
                Size (bytes):4320
                Entropy (8bit):5.254953196643728
                Encrypted:false
                SSDEEP:96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7nUm2oht:etJCV4FiN/jTN/2r8Mta02fEhgO73god
                MD5:82CFA8F0A789B1632A1D889879A8BBA0
                SHA1:C78B14FF0980E649D6815C77FDBDACEEE4D3E7B8
                SHA-256:91A5CCDAF4F03083A9EEED8E1439C4762214A6849375A32A8546807B5177DF59
                SHA-512:1A00B923049D0A235BBC38DAB8634633724B686DD726D4EADBB740AB8184C24EC0F0E9B72A67B7BB2E58320D20259C2AA3B65B9F675B60A16919E3EC29608930
                Malicious:false
                Preview:*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:ASCII text
                Category:dropped
                Size (bytes):324
                Entropy (8bit):5.176949015097469
                Encrypted:false
                SSDEEP:6:BOQI5fp+q2Pwkn2nKuAl9OmbzNMxIFUt84OQI5fsZmw+4OQI5fgqGFNVkwOwkn2v:EQqp+vYfHAa8jFUt81Qqs/+1QqgqGFNV
                MD5:C84655BF243B159D8620B8739584912E
                SHA1:A780C9F7CC6E61579A7E7DDE3766BA71F210C217
                SHA-256:69AF425C668D2133D2B811666CD1C6CE596E3AE72AB1A209BC126A1703681DAB
                SHA-512:177170B8CF21684FDDEAEC7339C93695D1F8E22408BA0D7480A5960DF386C617C245F5BDF7C8CE13E3816750095B6FD6D6AF3A3C35D8312D39725B6EBB48CCC9
                Malicious:false
                Preview:2024/07/05-00:59:02.276 1d9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/07/05-00:59:02.279 1d9c Recovering log #3.2024/07/05-00:59:02.280 1d9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:ASCII text
                Category:dropped
                Size (bytes):324
                Entropy (8bit):5.176949015097469
                Encrypted:false
                SSDEEP:6:BOQI5fp+q2Pwkn2nKuAl9OmbzNMxIFUt84OQI5fsZmw+4OQI5fgqGFNVkwOwkn2v:EQqp+vYfHAa8jFUt81Qqs/+1QqgqGFNV
                MD5:C84655BF243B159D8620B8739584912E
                SHA1:A780C9F7CC6E61579A7E7DDE3766BA71F210C217
                SHA-256:69AF425C668D2133D2B811666CD1C6CE596E3AE72AB1A209BC126A1703681DAB
                SHA-512:177170B8CF21684FDDEAEC7339C93695D1F8E22408BA0D7480A5960DF386C617C245F5BDF7C8CE13E3816750095B6FD6D6AF3A3C35D8312D39725B6EBB48CCC9
                Malicious:false
                Preview:2024/07/05-00:59:02.276 1d9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/07/05-00:59:02.279 1d9c Recovering log #3.2024/07/05-00:59:02.280 1d9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

                C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
                Category:dropped
                Size (bytes):86016
                Entropy (8bit):4.44495848013032
                Encrypted:false
                SSDEEP:384:SeGci5tBiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:CSs3OazzU89UTTgUL
                MD5:AC2F86185CFE1C2E57662F4D7979EBF3
                SHA1:D2FEB81EA6C3E6224F88696B5143EFA144436C68
                SHA-256:AFB3A3B8B552F07A7B5DBCB46CA00EF4F3207CACA205EDA1FD0F4CAA6B9BE011
                SHA-512:E988CABEE462E5E966887921E035F5D53606FA391B02383ED5B7F570419CAF762048D5DDBC503401C9785783C9AFC8470C21191EA88382478247B4EDA04137E7
                Malicious:false
                Preview:SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:SQLite Rollback Journal
                Category:dropped
                Size (bytes):8720
                Entropy (8bit):2.2133574840993733
                Encrypted:false
                SSDEEP:24:7+tHpSnuwK52vqLrzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wm2:7MgnC5WqvmFTIF3XmHjBoGGR+jMz+LhG
                MD5:C1E2CB27F144EE475FDBC8CC24F59DF0
                SHA1:A9D67064F0387D41F9B89951341E45C671FCDAF3
                SHA-256:C5F9B98E0A796CE52F6B664F61C19EFF0D73803A1A8C6B51FE61D0B45015B6C3
                SHA-512:25EA3646C91FDB277393162077032B79874E2F4AD168ABC6D0D659E7AF9406E428084E6E7795B37D4C783196C3AA942A01578590C820AE82AE7C2DD6104B7C25
                Malicious:false
                Preview:.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
                Category:dropped
                Size (bytes):71954
                Entropy (8bit):7.996617769952133
                Encrypted:true
                SSDEEP:1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
                MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
                SHA1:1723BE06719828DDA65AD804298D0431F6AFF976
                SHA-256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
                SHA-512:BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
                Malicious:false
                Preview:MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..*Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=*....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.|.c.&>?..^t. ..;..X.d.E.0G....[Q.*,*......#.Dp..L.o|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

                C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:data
                Category:dropped
                Size (bytes):893
                Entropy (8bit):7.366016576663508
                Encrypted:false
                SSDEEP:24:hBntmDvKUQQDvKUr7C5fpqp8gPvXHmXvponXux:3ntmD5QQD5XC5RqHHXmXvp++x
                MD5:D4AE187B4574036C2D76B6DF8A8C1A30
                SHA1:B06F409FA14BAB33CBAF4A37811B8740B624D9E5
                SHA-256:A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
                SHA-512:1F44A360E8BB8ADA22BC5BFE001F1BABB4E72005A46BC2A94C33C4BD149FF256CCE6F35D65CA4F7FC2A5B9E15494155449830D2809C8CF218D0B9196EC646B0C
                Malicious:false
                Preview:0..y..*.H.........j0..f...1.0...*.H.........N0..J0..2.......D....'..09...@k0...*.H........0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30...000930211219Z..210930140115Z0?1$0"..U....Digital Signature Trust Co.1.0...U....DST Root CA X30.."0...*.H.............0..........P..W..be......,k0.[...}.@......3vI*.?!I..N..>H.e...!.e.*.2....w..{........s.z..2..~..0....*8.y.1.P..e.Qc...a.Ka..Rk...K.(.H......>.... .[.*....p....%.tr.{j.4.0...h.{T....Z...=d.....Ap..r.&.8U9C....\@........%.......:..n.>..\..<.i....*.)W..=....]......B0@0...U.......0....0...U...........0...U.........{,q...K.u...`...0...*.H...............,...\...(f7:...?K.... ]..YD.>.>..K.t.....t..~.....K. D....}..j.....N..:.pI...........:^H...X._..Z.....Y..n......f3.Y[...sG.+..7H..VK....r2...D.SrmC.&H.Rg.X..gvqx...V..9$1....Z0G..P.......dc`........}...=2.e..|.Wv..(9..e...w.j..w.......)...55.1.

                C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:data
                Category:dropped
                Size (bytes):328
                Entropy (8bit):3.2352707042963518
                Encrypted:false
                SSDEEP:6:kKO9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:pDImsLNkPlE99SNxAhUe/3
                MD5:30453EC573B9EC5EED632343B526996C
                SHA1:A38BDB4FAD8090078EC802040FBEB3A6A3255337
                SHA-256:296C93DD7B0EFA0871122C5C2F17B0763F0F49B142F028BD2EC63315050D2B9F
                SHA-512:EF5B5E9DB4DA8C5928C424D39F8150871C9EF0447B153E6CF5B94D03E0E241C22FEB397C4026F3C4BA21C29E76ADF42743CCD2B272D1C13D0B66DBA062FDFCD3
                Malicious:false
                Preview:p...... ........;o......(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

                C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:data
                Category:dropped
                Size (bytes):252
                Entropy (8bit):3.026467887142631
                Encrypted:false
                SSDEEP:3:kkFkl2rklfllXlE/E/KRkzllPlzRkwWBARLNDU+ZMlKlBkvclcMlVHblB8V7lnka:kKsxliBAIdQZV7I7kc3
                MD5:86DB6258FFEC2D1F7377F2FB96168FDE
                SHA1:28478BA7CCB2E9DAEBC7EB77F796604334457307
                SHA-256:15CE1DA835F1C3B2DE98ABAA68A5AB67D324CB3C2DB2D8352A4258ADCB5F2A6B
                SHA-512:F3B6E24449E23897481888F26339EE05FF0EC73EEE503DADA5E07468676E8248FC8806E859DF549A9E52A15E85539DA4F2251D3644A94E0F773D8C26775D3C96
                Malicious:false
                Preview:p...... ....`...j=m.....(....................................................... ........!.M........(...........}...h.t.t.p.:././.a.p.p.s...i.d.e.n.t.r.u.s.t...c.o.m./.r.o.o.t.s./.d.s.t.r.o.o.t.c.a.x.3...p.7.c...".3.7.d.-.6.0.7.9.b.8.c.0.9.2.9.c.0."...

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7176

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:PostScript document text
                Category:dropped
                Size (bytes):185099
                Entropy (8bit):5.182478651346149
                Encrypted:false
                SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
                MD5:94185C5850C26B3C6FC24ABC385CDA58
                SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
                SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
                SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
                Malicious:false
                Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):295
                Entropy (8bit):5.372984335383831
                Encrypted:false
                SSDEEP:6:YEQXJ2HXFcRtvH9VoZcg1vRcR0YO4xoAvJM3g98kUwPeUkwRe9:YvXKXFcDEZc0vLGMbLUkee9
                MD5:3142784850E79384145C02A306DFE710
                SHA1:18AAD1637E7AF2196A1D2BF23507EE39083F47B5
                SHA-256:CD73B360A018AF8EAEE0CE0929A2C38A4033CE00C09AABB4C14861C69449506E
                SHA-512:F3BBCCDA26C45447269BF2B106FA2A9B4AE0BBA7BE37DD9AF9F14621116180266552FC4AE4A90DF992ABAB5FBAD66D8BA462F99DBF8F533781EACA9B15390CB1
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"29fd6d38-4e3e-4e91-b1e9-27f0a29bda2d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720334528838,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):294
                Entropy (8bit):5.3204122915699745
                Encrypted:false
                SSDEEP:6:YEQXJ2HXFcRtvH9VoZcg1vRcR0YO4xoAvJfBoTfXpnrPeUkwRe9:YvXKXFcDEZc0vLGWTfXcUkee9
                MD5:10249C7585BEDAA423AE3404D1EAE588
                SHA1:72ED88142D45927CDB4D417B9F538C0749B87382
                SHA-256:63C764A9E45AAB48C1EC6D257AC27A78E72ED16D7A0DEEE498FD21716D99DAAC
                SHA-512:C168EFA219FE1059F5B9174FCA29E2D3FCFBE96F0E433E78F4959C5F90CC4DDFE041B9CBF3702BCD7E669D5E902FC8EA4A083E5F7B1EA3871AE5DB50F006888C
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"29fd6d38-4e3e-4e91-b1e9-27f0a29bda2d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720334528838,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):294
                Entropy (8bit):5.300430008386334
                Encrypted:false
                SSDEEP:6:YEQXJ2HXFcRtvH9VoZcg1vRcR0YO4xoAvJfBD2G6UpnrPeUkwRe9:YvXKXFcDEZc0vLGR22cUkee9
                MD5:E6A66E770A5C7E67BF480BABEF4567BC
                SHA1:C3C004DFB37FEC84093C4F7871BCE705A943BBDC
                SHA-256:F510322148542289FCA0EAD6F6C284AAC60890CB16A20F45E5D157773AF79DAA
                SHA-512:9DB97275F351306EA4B4229EB3AAE597C50A39DCEED58AE6F9B1106F5075BD55FF332B36CBD223BF2AA2FE3B484A7C6E1EACA867641BB855E188AC1B0981FA94
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"29fd6d38-4e3e-4e91-b1e9-27f0a29bda2d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720334528838,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):285
                Entropy (8bit):5.3603324187392225
                Encrypted:false
                SSDEEP:6:YEQXJ2HXFcRtvH9VoZcg1vRcR0YO4xoAvJfPmwrPeUkwRe9:YvXKXFcDEZc0vLGH56Ukee9
                MD5:8E3B629DB037942F2022D952F5D0E959
                SHA1:D9A864A7B4931E4418455A0411CCC24465F3E2E7
                SHA-256:C84A80BCCC6FB654FD9020B1B7D3B6E91184542C67CB79283181ABD3915A5D42
                SHA-512:27C97DCD7DD862A3C8B8BC7FC36104F8047E505ECDE0F4BF7CA46D381E386417875ED1EA53B827CC54531D9B12B092FC04303910BED07DF9EA16B15CAD103856
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"29fd6d38-4e3e-4e91-b1e9-27f0a29bda2d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720334528838,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):292
                Entropy (8bit):5.314801710940621
                Encrypted:false
                SSDEEP:6:YEQXJ2HXFcRtvH9VoZcg1vRcR0YO4xoAvJfJWCtMdPeUkwRe9:YvXKXFcDEZc0vLGBS8Ukee9
                MD5:9EEB9DAC1AEBE6C6459592CAF71580F3
                SHA1:5347F4C1E271F20A6A26FA2AC72EE03D906AED1D
                SHA-256:CBB118BBCAC304EE90481ABE1C1BB56532846ADB563DE8AA125C65E775E58795
                SHA-512:EBB5984D5CCA90E38EF9F3B27B6DC26A99799F5793933F0EF360C38A75EB22F5387AED21944444C5B5BF38DB0ABA124F18D1A587FA6C784121B1C3176F136FD1
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"29fd6d38-4e3e-4e91-b1e9-27f0a29bda2d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720334528838,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):289
                Entropy (8bit):5.303334171197813
                Encrypted:false
                SSDEEP:6:YEQXJ2HXFcRtvH9VoZcg1vRcR0YO4xoAvJf8dPeUkwRe9:YvXKXFcDEZc0vLGU8Ukee9
                MD5:0AFA4215DF3D0A2952DC4D9AE7E3EA6D
                SHA1:FFAD7F6450D43513184B422B66DF7A1F76FFEC48
                SHA-256:0900530B65B01BE5019A4698C256A987FF957AC17AC3C54BB29AF3B3FACC6048
                SHA-512:5679C5BBC8E75B99EDA03CBF64DC6F6E62462DF36BF16D0F324608B17688B1C41F6DE10B9EC73513C697195D44B615B299D5058DCD380CC289B9551270A1EB64
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"29fd6d38-4e3e-4e91-b1e9-27f0a29bda2d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720334528838,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):292
                Entropy (8bit):5.306665765961851
                Encrypted:false
                SSDEEP:6:YEQXJ2HXFcRtvH9VoZcg1vRcR0YO4xoAvJfQ1rPeUkwRe9:YvXKXFcDEZc0vLGY16Ukee9
                MD5:45B3E2BC0FDF572F49CEEDA4BC4129E5
                SHA1:03F4489D1F9976C8C8458D7B3479D5DB17F08B67
                SHA-256:087E335C95B8C2CDC27A23B1ACD16E5EF67CA9FC921B55313AB2F20CA1385326
                SHA-512:4471908044F43BD4555B9489429F64EDF26F51D2E338032AB90F1084B9CA4BA5E9799F32C89C43E624F7711711AAC1A98F231C5C4065306BE0F3AA7FA67778CD
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"29fd6d38-4e3e-4e91-b1e9-27f0a29bda2d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720334528838,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):289
                Entropy (8bit):5.310029909722827
                Encrypted:false
                SSDEEP:6:YEQXJ2HXFcRtvH9VoZcg1vRcR0YO4xoAvJfFldPeUkwRe9:YvXKXFcDEZc0vLGz8Ukee9
                MD5:D57CB024B8EFA550B519D6C4A52ACB6F
                SHA1:3FC782BCCE8D2B9CFC47C593106A207F669D8976
                SHA-256:BA019D8E20C49851E2D2CD80CA2B10E5A89C779396436C72883CAAE9A8896538
                SHA-512:97D2BC50F13FCF6B2840D229A55A3D3E88AB675FF7C7C1D0A1D939E883F085B348310FCF687FFD0B5D06BA098D3728E149870753BCEAECFE9A6985D50FF6113C
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"29fd6d38-4e3e-4e91-b1e9-27f0a29bda2d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720334528838,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):1372
                Entropy (8bit):5.737327632455175
                Encrypted:false
                SSDEEP:24:Yv6XJzvTKLgENRcbrZbq00iCCBrwJo++ns8ct4mFJNLm:Yv67EgigrNt0wSJn+ns8cvFJtm
                MD5:8D5E05B9F87BE2EF7A03C5AFDB4536F0
                SHA1:1836366437DC1072E9C48005CF9AB85C1E3E6BA4
                SHA-256:8AA90CA73E1DCB55804F32DE83FFB82A2141E02E1E464AC062374B57B44BF3B8
                SHA-512:3CD6F54803EAD8CDE433DBDAFA795635386501CE295A27DE144598641E5BFC7A8832F53D763C2CE22513C646F998524964A764891B01BB626520C27DA51D1919
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"29fd6d38-4e3e-4e91-b1e9-27f0a29bda2d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720334528838,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):289
                Entropy (8bit):5.308028660857948
                Encrypted:false
                SSDEEP:6:YEQXJ2HXFcRtvH9VoZcg1vRcR0YO4xoAvJfYdPeUkwRe9:YvXKXFcDEZc0vLGg8Ukee9
                MD5:B869F77B49E03062C26123D98B702F1B
                SHA1:A81AFBBB0586CD0DC019758E038E13FA7D2CEFBD
                SHA-256:0697BB0DD78E8124E893A465627737A3D69E436A09D1469943E833040C909533
                SHA-512:7747502563ACA237EF66A15380D13135EB937AFF6C76B26D51414315BEC1AB27BB0D0400286780B869FCDB26C35939C3B810FFC51E1843ABC86D3FA41160A94E
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"29fd6d38-4e3e-4e91-b1e9-27f0a29bda2d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720334528838,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):1395
                Entropy (8bit):5.776479827339686
                Encrypted:false
                SSDEEP:24:Yv6XJzvurLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNDm:Yv6mHgDv3W2aYQfgB5OUupHrQ9FJ5m
                MD5:2070A6E859F9DBDD7F124DEC8F11DCC4
                SHA1:611B16F2CD30B1234EC2E27DA9E4EA4162BF0E56
                SHA-256:28A964BA026B9F373D1A0F0B0C8714649DBE451ED5B17B931E49782802F17066
                SHA-512:BB0E2FD8A8490026F34B62946305AF4F46D3B1B2E337D994BC5AD9B063E796A6FBE0821254ED89DC5E9D311B8022C780E5A59312ECCC91BA3EAE41D0FAFA630A
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"29fd6d38-4e3e-4e91-b1e9-27f0a29bda2d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720334528838,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):291
                Entropy (8bit):5.291520578732101
                Encrypted:false
                SSDEEP:6:YEQXJ2HXFcRtvH9VoZcg1vRcR0YO4xoAvJfbPtdPeUkwRe9:YvXKXFcDEZc0vLGDV8Ukee9
                MD5:CFA3B69F3B0E45DC1A3CDBAEE81CFE40
                SHA1:959CB2D21E943330E6F6604B809375A5839698DE
                SHA-256:5BD79CD867737C8F0D9B5978ED674883209D3DA449AACFB2196B00C73EAB16DF
                SHA-512:A04630FE49E823E13D5ED351290F1767A0D788372DC1208AC0A70BAFE12CFC0C3B111A853194FAC6554D929D2FA8528D4D08CCA3DF67D7D494FCFBAA764F3716
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"29fd6d38-4e3e-4e91-b1e9-27f0a29bda2d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720334528838,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):287
                Entropy (8bit):5.296283160024189
                Encrypted:false
                SSDEEP:6:YEQXJ2HXFcRtvH9VoZcg1vRcR0YO4xoAvJf21rPeUkwRe9:YvXKXFcDEZc0vLG+16Ukee9
                MD5:E734F4054D76002A36E57FEBCE22E5F1
                SHA1:F41F7C5BAF70879E2930DEDCBF0A76390EC65FFC
                SHA-256:57A9F0B08580EE4B7F40A63336DC8BF122D306434C1CEB45B1C9C3BCE354A77A
                SHA-512:49DD04C709B3294642E9C48A67866E8E332525F8F5C92D7C81D6D1365405737C751BD776E427C60EB1AEAEF2D34E297E488E8651889CEED9D5F1F1691E4B3080
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"29fd6d38-4e3e-4e91-b1e9-27f0a29bda2d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720334528838,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):289
                Entropy (8bit):5.315404126701263
                Encrypted:false
                SSDEEP:6:YEQXJ2HXFcRtvH9VoZcg1vRcR0YO4xoAvJfbpatdPeUkwRe9:YvXKXFcDEZc0vLGVat8Ukee9
                MD5:673250320CB32D60453D33B23F9A0449
                SHA1:5797D97585412AB12404C9CDBB687975D4E3755C
                SHA-256:76EE03B298A1046B4F2D106033881F5C3A6FB07F142E4D57650372505008F156
                SHA-512:7A15DCAA9DBD9E94B36EA130500BB48A9EB21429AD52F709B80ED5C4C19D7D9A770E9DDAFF7D97C578BC2170B6B109588AD1E6B801A82613D8C658AAB64F1A81
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"29fd6d38-4e3e-4e91-b1e9-27f0a29bda2d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720334528838,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):286
                Entropy (8bit):5.270931013038354
                Encrypted:false
                SSDEEP:6:YEQXJ2HXFcRtvH9VoZcg1vRcR0YO4xoAvJfshHHrPeUkwRe9:YvXKXFcDEZc0vLGUUUkee9
                MD5:0EA5CD5379B0710FFA2105EE1B18A437
                SHA1:91733FE74FC0001DF5D934E596492794A868D7C8
                SHA-256:7D83E6616FF4E97B9B92EF0E12B603A7472C00C7D741F11ED4E388612EA53A86
                SHA-512:3F42142C02037009C8F104A8890267E8868F6F621895F45E5DAA485EC94B30D723636A434B41843021DE696CEF536D1E0C1CA40615301D14CBB7E31BB1B2C75F
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"29fd6d38-4e3e-4e91-b1e9-27f0a29bda2d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720334528838,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):782
                Entropy (8bit):5.371311468649461
                Encrypted:false
                SSDEEP:12:YvXKXFcDEZc0vLGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWHm:Yv6XJzvr168CgEXX5kcIfANhom
                MD5:8230CA14E5F4D4B36B7F650C21593666
                SHA1:272E140F555A565D32BCCF9116FBA976FFF1038B
                SHA-256:2FC114140DD1064A6568D86126E1B27C497D5CEC0F1205C93E4EBB505EABC870
                SHA-512:2DF82DD0E3E71538D9C1E78484CF7735BA3F0CE06538C4FED6492A9BF13D1FC6ED2B85F287E690404F9A01AB29047EED24C46A5CBAB1351D1B8D8F3E1CB22977
                Malicious:false
                Preview:{"analyticsData":{"responseGUID":"29fd6d38-4e3e-4e91-b1e9-27f0a29bda2d","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1720334528838,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1720155548867}}}}

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:data
                Category:dropped
                Size (bytes):4
                Entropy (8bit):0.8112781244591328
                Encrypted:false
                SSDEEP:3:e:e
                MD5:DC84B0D741E5BEAE8070013ADDCC8C28
                SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
                SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
                SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
                Malicious:false
                Preview:....

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:JSON data
                Category:dropped
                Size (bytes):2814
                Entropy (8bit):5.131610290632152
                Encrypted:false
                SSDEEP:24:Y87MC0WsPEPXClXqgp2nXnaaayXlSJzwXBiNecjD2cj0SMStF/b/2yeN62LSM8Ub:YleZS4gp/fDZFTuEvIkl9sDAc
                MD5:C559B23D3CB56D1C48FE5A4D732AB2EB
                SHA1:A27E249D395F3F217F7DB4CB210B64A04D2618A1
                SHA-256:D416352C03EF11AFBD7DCD9E6F4E6E1E2FA1587406D75F3ACE754A421EAA05DB
                SHA-512:7096577D556B09177052893FE3C111A5FF494179F51CCDF78571E67EECD87A22D064F0BC435635E19DE0E293BEC54221A450D8D06582CB1E57F4DABE6558FBCD
                Malicious:false
                Preview:{"all":[{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"461d2726e6940e22447ba47a7bf767df","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1720155548000},{"id":"Edit_InApp_Aug2020","info":{"dg":"b9ed2018e8e01be71e1c36fb46ec9040","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1720155548000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"d2db5be6b4a86ca0f650f931651c52b8","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1720155548000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"1c0d08232d22e8db6b06d864353ab068","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1720155548000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"90e3b612a7c5db9952b294502409e647","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1720155548000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"0adc67805cf0817ce457c70d2210f43d","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1720155548000},

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
                Category:dropped
                Size (bytes):12288
                Entropy (8bit):1.1886684847601907
                Encrypted:false
                SSDEEP:48:TGufl2GL7msEHUUUUUUUUiSvR9H9vxFGiDIAEkGVvpo:lNVmswUUUUUUUUi+FGSItE
                MD5:C19AEFD6C06686B9653702B31D78FA1F
                SHA1:8C0F6AD6AD4CAAB785D13732CBB17EDA961724E8
                SHA-256:D5F66C6A6D952B378C2118090238EEBB3FE43618B979D79AD488AC63DBF3EA25
                SHA-512:78EAB020D3FB052BECE8D526E636997B84397240ABB367EBE710BB3ACC953C94F113AC0888D388C535C75DC73044D3A34F191C368FC7E13EBA9443D6CE76C435
                Malicious:false
                Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:SQLite Rollback Journal
                Category:dropped
                Size (bytes):8720
                Entropy (8bit):1.6086172159693235
                Encrypted:false
                SSDEEP:48:7MlqKUUUUUUUUUUwvR9H9vxFGiDIAEkGVvXqFl2GL7msk:7wxUUUUUUUUUUIFGSItFKVmsk
                MD5:94F144ED24DE59053D1471A9BE27F0D0
                SHA1:71FB7D9DE4B27284631737C2EDDBC883801E1CEB
                SHA-256:69058A30D879665613D5672EFEE9B6537465488EE2889F61D58507402C457622
                SHA-512:4BBDC4C17A9A0A7F8FEFE14C3A09481043F862BC390EADA7487CCB19F56E09760DF14AA0E0BE020EA4048F3F70A0CF14C65F481150FB3AB182289173DA9D9973
                Malicious:false
                Preview:.... .c.......ZI......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\rkn[1].log

                Download File
                Process:C:\Windows\SysWOW64\rundll32.exe
                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                Category:dropped
                Size (bytes):47104
                Entropy (8bit):6.948416585892318
                Encrypted:false
                SSDEEP:768:iq6bYI7ev0DeJpFgjzjW8SGJVnxsJ/cS7iKGztVuanh8w2OfJ7ejaP6yEqzeGO0I:iXbWv04jgXjW8PHccS7i9u6yeNejY6ys
                MD5:4B683807246FC18189D63DD9A4E9429F
                SHA1:1DED192558723EBE1DE20B099343DA06D6A215C5
                SHA-256:BA77B5949CA2198459C7F2F260C1B57AF93F4B3466F8278BFCAB114C9E0B2D79
                SHA-512:7B177DE3ADB54FE049E5A4D927957008F4829A46FC6C8206657F5BC6435F079A6E47FD3FFCCFD03D6F40F125855659B3380E9C33C1EDA0E7E5D14180CA761377
                Malicious:true
                Yara Hits:
                • Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\rkn[1].log, Author: unknown
                Antivirus:
                • Antivirus: Avira, Detection: 100%
                • Antivirus: Joe Sandbox ML, Detection: 100%
                • Antivirus: ReversingLabs, Detection: 63%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h..S,.x.,.x.,.x.%...&.x.~.}.?.x.~.|. .x.~.{.-.x.~.y.(.x.g.y.).x.,.y...x...q.-.x.....-.x...z.-.x.Rich,.x.................PE..L...m]nf..................................... ....@.......................................@..................................%..................................p...,!..p............................!..@............ ...............................text...)........................... ..`.rdata..t.... ......................@..@.data.......0....... ..............@....rsrc...............................@..@.reloc..p...........................@..B................................................................................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\unity[1].pdf

                Download File
                Process:C:\Users\user\AppData\Local\Temp\rkn.exe
                File Type:PDF document, version 1.7, 4 pages
                Category:dropped
                Size (bytes):86196
                Entropy (8bit):7.87858938350625
                Encrypted:false
                SSDEEP:1536:hBhksShBntb0liRZmRKIQh13cqT+Mve6US2c6fGJ76c3oW9CMJ6yd:lk1N9bRZmRDQuUPe6US2c6No9CM3
                MD5:CC4676EF08E8AECBE22B9232F27B2141
                SHA1:03BB3A2CB2C8A5CF7B93CF7C666C470144CFD724
                SHA-256:48331EA4E205E07525F47149D19C8F78DBA24EE63147A74F7D0A443008E4587D
                SHA-512:A27DAEF2DB426114F9B45F9EAD7C0CF5E6C84389570E51C749C9CE9BAD8AB6D2C866C54A291FA5A6D83AB7B476A00E9AD4729C92ED53B5371AF7E2382CCBEC96
                Malicious:false
                Preview:%PDF-1.7.%.....2 0 obj.<</Length 3 0 R/Filter/FlateDecode>>.stream.x..XK..G...(.-..R.....n.....B...6.8f..I.}$..3.x.Nou=.O.>.Fv .><<..~...W1.;......*..m....@.......?.?...zx.}.....$.0.....^>.......cb.t...a...8.... ...H+.}/.....2J'..s....<..p...FN ....c..4....O..|x..:?.........o1...*.b........b..h........G5>..I.....M.9..H.....34.<..#..qV.=.V.|..y.....q&8|.<.ox..q<..Az.7.....g}...F...a.H.....b:..C..t.......;.Y....D..o...........F..q.'..#.h....A...$rH2..(.V......1.ML4....0......-.>+.S`....e.zC~.ls.1..>A..F@...3..,D.+...b.xo...Ekh.e.oca.XxL..~.8.=.*[...(3fQ........^[..M.\.T%;}!..$.,..{.......@.<E2G...g{.y.g..J^y[DEq./|..)....ce..... .............q.m...L..*{..X.A3VA^.....`m...=..I"#s..e.%5. .8k..XOJh...]"Tr.d.-s.s..3.6>.....s.B..a.8-.6....~....21.j...."A.....Vz;.j....a.&*..L.......x...dd..T......9..e.\.....oZ..DaS./..lN2j*E......p......2....s.`3........A_k.U.fN.....Y9..~...b.4...:..N..K..R.t.2.S ..Q..M....E.J!.YN.[.o.tN.f=....r...w..ud...Iq..j;

                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\apt66ext[1].log

                Download File
                Process:C:\Users\user\AppData\Local\Temp\rkn.exe
                File Type:PE32+ executable (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):55675088
                Entropy (8bit):7.998533737468859
                Encrypted:true
                SSDEEP:1572864:bVxMP+5vwyPlqv4QvVWKZeIw3UzwKxy27PXHB:bVCCwy9uVPw3U0KxyAPXh
                MD5:494A19DC7E5EAA0E516ECE245D2661DE
                SHA1:37E1A6A7B9C2F85D563BFA44AABCABC26FD00FB5
                SHA-256:7FF47DCE0AD262F4C0818170213A2A5C97B098258F5B2E85B3DF5A48EED05183
                SHA-512:180FDB170B68399C563C1DE6C290A9B365F32C484FF53E16D4EDBF967CD4FA9D8D50B45AB87AFD6F1E9B670240D640DA683A7E3E657ED22BD648D385624EC06A
                Malicious:true
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 18%
                Joe Sandbox View:
                • Filename: rkn.log.exe, Detection: malicious, Browse
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<..x..x..x..3...~..3......3...r..m.x.y..m...P..m...h..m...q..3......x.....NY..y..NY..y..Richx..................PE..d.....mf.........."....%......................@.............................@............`.....................................................P.... ..P....................0.........................................@............................................text............................... ..`.rdata..............................@..@.data... ...........................@....pdata..............................@..@_RDATA..\...........................@..@.rsrc...P.... ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\unity[1].pdf

                Download File
                Process:C:\Users\user\AppData\Local\Temp\rkn.exe
                File Type:PDF document, version 1.7, 4 pages
                Category:dropped
                Size (bytes):86196
                Entropy (8bit):7.87858938350625
                Encrypted:false
                SSDEEP:1536:hBhksShBntb0liRZmRKIQh13cqT+Mve6US2c6fGJ76c3oW9CMJ6yd:lk1N9bRZmRDQuUPe6US2c6No9CM3
                MD5:CC4676EF08E8AECBE22B9232F27B2141
                SHA1:03BB3A2CB2C8A5CF7B93CF7C666C470144CFD724
                SHA-256:48331EA4E205E07525F47149D19C8F78DBA24EE63147A74F7D0A443008E4587D
                SHA-512:A27DAEF2DB426114F9B45F9EAD7C0CF5E6C84389570E51C749C9CE9BAD8AB6D2C866C54A291FA5A6D83AB7B476A00E9AD4729C92ED53B5371AF7E2382CCBEC96
                Malicious:false
                Preview:%PDF-1.7.%.....2 0 obj.<</Length 3 0 R/Filter/FlateDecode>>.stream.x..XK..G...(.-..R.....n.....B...6.8f..I.}$..3.x.Nou=.O.>.Fv .><<..~...W1.;......*..m....@.......?.?...zx.}.....$.0.....^>.......cb.t...a...8.... ...H+.}/.....2J'..s....<..p...FN ....c..4....O..|x..:?.........o1...*.b........b..h........G5>..I.....M.9..H.....34.<..#..qV.=.V.|..y.....q&8|.<.ox..q<..Az.7.....g}...F...a.H.....b:..C..t.......;.Y....D..o...........F..q.'..#.h....A...$rH2..(.V......1.ML4....0......-.>+.S`....e.zC~.ls.1..>A..F@...3..,D.+...b.xo...Ekh.e.oca.XxL..~.8.=.*[...(3fQ........^[..M.\.T%;}!..$.,..{.......@.<E2G...g{.y.g..J^y[DEq./|..)....ce..... .............q.m...L..*{..X.A3VA^.....`m...=..I"#s..e.%5. .8k..XOJh...]"Tr.d.-s.s..3.6>.....s.B..a.8-.6....~....21.j...."A.....Vz;.j....a.&*..L.......x...dd..T......9..e.\.....oZ..DaS./..lN2j*E......p......2....s.`3........A_k.U.fN.....Y9..~...b.4...:..N..K..R.t.2.S ..Q..M....E.J!.YN.[.o.tN.f=....r...w..ud...Iq..j;

                C:\Users\user\AppData\Local\Temp\MSIe7409.LOG

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                Category:dropped
                Size (bytes):246
                Entropy (8bit):3.5136057226030957
                Encrypted:false
                SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8wAKYlYH:Qw946cPbiOxDlbYnuRKWKYlYH
                MD5:A01D79909AA85BD06D6F16A82C92EE31
                SHA1:CEBFD2F77E98F920DD005630933D1B9C71904986
                SHA-256:DCF7B8F86A2EE9ECA9020B761D235908439A1B78DBB34C51CA71F73ADE23B757
                SHA-512:FE73F55FD44998ED909CF497A6EC6FF3BF4721E7F974F2394F32BFE7B0CE7AF0A5E57866293E4188DE26186459B6943E656A68C22CE2C9EAFB919EE386C1CD85
                Malicious:false
                Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .0.5./.0.7./.2.0.2.4. . .0.0.:.5.9.:.1.0. .=.=.=.....

                C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91r2pgc7_hlmxc_5jc.tmp

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
                Category:dropped
                Size (bytes):127214
                Entropy (8bit):7.992938944970855
                Encrypted:true
                SSDEEP:3072:uswQeDPMQviqN8xfRmKMPcSnWlG1SS7Zqc6DOR44IxtUsi5:uswtPMMrSx+0SWlG1SSO6cYsi
                MD5:997CE5ED3633E8FF84C2F7D1F0E48E53
                SHA1:D22617BDF6D8DCE13E5FCBE9BDD57A812EE1E237
                SHA-256:E06C221FB5B43F5A25220D326EB501573C2E0CC9FBB31007BF79054B6F613907
                SHA-512:CE187CD9CE4CAC28B91CD0B090A70B15E28BC59BE0CC2A1E58F4257ACBAD5C05B40D7E1ECC8F16B626BC51AFE6817E524A4326F09C3FBA85637285EA1F3291D8
                Malicious:false
                Preview:PK........,C.X...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........>.X..lz............message.xml.]Ys..~...r..S.c...-.K....v.Y.KEK...E.H*.......Z(...V.N.... ..p.s....(...$...o..=:.D..A.....w.....#....8..4;nGq.<.}?.>.#?.........,.Bq..G..v08....G.=.i.....~..Q.......4.....h...`............Z... ..~(.X.g.>..;8=...7.x.G.....v.{..^.y}s...#u+.. ...s.$.2.._t...Gyuz....x...&gO..8..$.hp#.W.@..V...x.OW.c.........."S.x...>.Y....L..1..I<..vL.{$......#.i...7X\l....S..^..?.)..9tX..V.=.3qL.a...b.Bv.....X|..O. y.5u.19...d..}{..q.d..p}......)..l..r.fk..<..v..(..o......-.f_....h..e ......Z....K.;Ka..cB<....:..x.(...v{(..!@.Z...Bg.n.<..PD.".+..0.A..5.Y...x....9.]..........d.2.h......<.j........~.+.g...8r.....].lS.9..RX@.;..........9.....8.A.......?tq....&....0..t..]...aW.....<.....Ka.=XO..C........~.F3.+.b..Y.\.,..Cq6.n..8..b`..b..{.8.......2o.S.J3U.bx;S..L..Y..L.v..LU.g....%..0U...*..\...P>...Q..e..p0#yKN.H.Br..Nh r..D..?..Vuh..q)o.D.]#h.M.A

                C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91ydadj9_hlmxb_5jc.tmp

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
                Category:dropped
                Size (bytes):127214
                Entropy (8bit):7.992938944970855
                Encrypted:true
                SSDEEP:3072:uswQeDPMQviqN8xfRmKMPcSnWlG1SS7Zqc6DOR44IxtUsi5:uswtPMMrSx+0SWlG1SSO6cYsi
                MD5:997CE5ED3633E8FF84C2F7D1F0E48E53
                SHA1:D22617BDF6D8DCE13E5FCBE9BDD57A812EE1E237
                SHA-256:E06C221FB5B43F5A25220D326EB501573C2E0CC9FBB31007BF79054B6F613907
                SHA-512:CE187CD9CE4CAC28B91CD0B090A70B15E28BC59BE0CC2A1E58F4257ACBAD5C05B40D7E1ECC8F16B626BC51AFE6817E524A4326F09C3FBA85637285EA1F3291D8
                Malicious:false
                Preview:PK........,C.X...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........>.X..lz............message.xml.]Ys..~...r..S.c...-.K....v.Y.KEK...E.H*.......Z(...V.N.... ..p.s....(...$...o..=:.D..A.....w.....#....8..4;nGq.<.}?.>.#?.........,.Bq..G..v08....G.=.i.....~..Q.......4.....h...`............Z... ..~(.X.g.>..;8=...7.x.G.....v.{..^.y}s...#u+.. ...s.$.2.._t...Gyuz....x...&gO..8..$.hp#.W.@..V...x.OW.c.........."S.x...>.Y....L..1..I<..vL.{$......#.i...7X\l....S..^..?.)..9tX..V.=.3qL.a...b.Bv.....X|..O. y.5u.19...d..}{..q.d..p}......)..l..r.fk..<..v..(..o......-.f_....h..e ......Z....K.;Ka..cB<....:..x.(...v{(..!@.Z...Bg.n.<..PD.".+..0.A..5.Y...x....9.]..........d.2.h......<.j........~.+.g...8r.....].lS.9..RX@.;..........9.....8.A.......?tq....&....0..t..]...aW.....<.....Ka.=XO..C........~.F3.+.b..Y.\.,..Cq6.n..8..b`..b..{.8.......2o.S.J3U.bx;S..L..Y..L.v..LU.g....%..0U...*..\...P>...Q..e..p0#yKN.H.Br..Nh r..D..?..Vuh..q)o.D.]#h.M.A

                C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-05 00-59-04-648.log

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:ASCII text, with very long lines (393)
                Category:dropped
                Size (bytes):16525
                Entropy (8bit):5.345946398610936
                Encrypted:false
                SSDEEP:384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
                MD5:8947C10F5AB6CFFFAE64BCA79B5A0BE3
                SHA1:70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
                SHA-256:4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
                SHA-512:B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
                Malicious:false
                Preview:SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

                C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:ASCII text, with very long lines (393), with CRLF line terminators
                Category:dropped
                Size (bytes):15114
                Entropy (8bit):5.336383539528008
                Encrypted:false
                SSDEEP:384:TR70zBCpXKL96xivge/+KxgFf+ykUAkMN69LhN7Mia0DIpxm/i3I3avx9TGQIWBj:di9
                MD5:C2872223C772EFC6C3DF431B7BB45431
                SHA1:F950060A3FEA55AD8AD639C2A439606974AB07F9
                SHA-256:02A4460A6F5B272A7BF69248CF6839E6C48809925E6021B190B95712A49A2544
                SHA-512:AA7272537E3CEC60896997503EE62BEC15293EAA834804484EE08B78651ED3D714612A851A843C80B2489FB249F85BAA31974B263B489822A23470DDE6C3A2F0
                Malicious:false
                Preview:SessionID=97775495-63e9-41ba-b930-25c618ce16a1.1720155544658 Timestamp=2024-07-05T00:59:04:658-0400 ThreadID=8060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=97775495-63e9-41ba-b930-25c618ce16a1.1720155544658 Timestamp=2024-07-05T00:59:04:659-0400 ThreadID=8060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=97775495-63e9-41ba-b930-25c618ce16a1.1720155544658 Timestamp=2024-07-05T00:59:04:659-0400 ThreadID=8060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=97775495-63e9-41ba-b930-25c618ce16a1.1720155544658 Timestamp=2024-07-05T00:59:04:659-0400 ThreadID=8060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=97775495-63e9-41ba-b930-25c618ce16a1.1720155544658 Timestamp=2024-07-05T00:59:04:659-0400 ThreadID=8060 Component=ngl-lib_NglAppLib Description="SetConf

                C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):29752
                Entropy (8bit):5.392329700454346
                Encrypted:false
                SSDEEP:768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2ra:G
                MD5:548720C0D542D53FE02D958DBA11E126
                SHA1:1A1660DB36E40A4D353D8E2520FFD49587F6F554
                SHA-256:CC3E58AA64FCF4991B2AED7F7FA13406F0E13CCF2A4AD1A488E9021C19B773AA
                SHA-512:F62B65713AC6D1E10AE05EDC2D538840BBBF0E5F671B7D9BE641D01EA8E30B3FBA5E88D240CE27BBC9DE4913681CEA3C4C54F452CA9820225C7D44BA1B2BB184
                Malicious:false
                Preview:03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

                C:\Users\user\AppData\Local\Temp\acrocef_low\53cd576a-7f36-44e0-8096-a39912bdd39a.tmp

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
                Category:dropped
                Size (bytes):758601
                Entropy (8bit):7.98639316555857
                Encrypted:false
                SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
                MD5:3A49135134665364308390AC398006F1
                SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
                SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
                SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
                Malicious:false
                Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

                C:\Users\user\AppData\Local\Temp\acrocef_low\6276a040-469d-4903-9fda-7fd2420776a1.tmp

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
                Category:dropped
                Size (bytes):1407294
                Entropy (8bit):7.97605879016224
                Encrypted:false
                SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
                MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
                SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
                SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
                SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
                Malicious:false
                Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                C:\Users\user\AppData\Local\Temp\acrocef_low\6736f1c9-8f84-49e7-8e20-f2f25db5ac7c.tmp

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
                Category:dropped
                Size (bytes):1419751
                Entropy (8bit):7.976496077007677
                Encrypted:false
                SSDEEP:24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
                MD5:18E3D04537AF72FDBEB3760B2D10C80E
                SHA1:B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
                SHA-256:BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
                SHA-512:2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
                Malicious:false
                Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

                C:\Users\user\AppData\Local\Temp\acrocef_low\ad77adca-2e00-4e52-8146-619d23e5748b.tmp

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
                Category:dropped
                Size (bytes):386528
                Entropy (8bit):7.9736851559892425
                Encrypted:false
                SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
                MD5:5C48B0AD2FEF800949466AE872E1F1E2
                SHA1:337D617AE142815EDDACB48484628C1F16692A2F
                SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
                SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
                Malicious:false
                Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

                C:\Users\user\AppData\Local\Temp\apt66ext.exe

                Download File
                Process:C:\Users\user\AppData\Local\Temp\rkn.exe
                File Type:PE32+ executable (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):55675088
                Entropy (8bit):7.998533737468859
                Encrypted:true
                SSDEEP:1572864:bVxMP+5vwyPlqv4QvVWKZeIw3UzwKxy27PXHB:bVCCwy9uVPw3U0KxyAPXh
                MD5:494A19DC7E5EAA0E516ECE245D2661DE
                SHA1:37E1A6A7B9C2F85D563BFA44AABCABC26FD00FB5
                SHA-256:7FF47DCE0AD262F4C0818170213A2A5C97B098258F5B2E85B3DF5A48EED05183
                SHA-512:180FDB170B68399C563C1DE6C290A9B365F32C484FF53E16D4EDBF967CD4FA9D8D50B45AB87AFD6F1E9B670240D640DA683A7E3E657ED22BD648D385624EC06A
                Malicious:true
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 18%
                Joe Sandbox View:
                • Filename: rkn.log.exe, Detection: malicious, Browse
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<..x..x..x..3...~..3......3...r..m.x.y..m...P..m...h..m...q..3......x.....NY..y..NY..y..Richx..................PE..d.....mf.........."....%......................@.............................@............`.....................................................P.... ..P....................0.........................................@............................................text............................... ..`.rdata..............................@..@.data... ...........................@....pdata..............................@..@_RDATA..\...........................@..@.rsrc...P.... ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PIL\_imaging.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):2428928
                Entropy (8bit):6.459337580131227
                Encrypted:false
                SSDEEP:49152:koa4DDDK7v1T+bKpf6/ulLrLrLrLKg+JYWjHBF7:1K7v1TWX2q
                MD5:AACDB8C5BC88D687244E39CFC7A0B855
                SHA1:F47344BAEE73A89300A278C6797B29A49D5B924C
                SHA-256:6D21AC76315885570BDCBF7B54CDD212E430F4CA2708F6F641EB5F6FEEAFC6E2
                SHA-512:FE5ED4F93776D1608BFEA4C96D155C043E1B1A920B210672B3511FF070F48538B3C6EBA6D1F1F5A3C296B748346DACAD22649C676C958BF7E867B7D96C99E85F
                Malicious:true
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Joe Sandbox View:
                • Filename: msupdate.exe, Detection: malicious, Browse
                • Filename: rkn.log.exe, Detection: malicious, Browse
                • Filename: apt66ext.log.exe, Detection: malicious, Browse
                • Filename: SecuriteInfo.com.Win64.DropperX-gen.9519.23032.exe, Detection: malicious, Browse
                • Filename: SecuriteInfo.com.Win64.DropperX-gen.9519.23032.exe, Detection: malicious, Browse
                Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......<..1x.}bx.}bx.}bq..bh.}b..|cz.}b...b|.}b..xcu.}b..ycp.}b..~c|.}b.|cz.}b3.|c..}bx.|bp.}bx.}bc.}b..yc..}b..uc2.}b..}cy.}b...by.}b...cy.}bRichx.}b........................PE..d.....ec.........." ...!.............9........................................%...........`..........................................Z#.`...0[#......P%......P$..............`%.D.....!...............................!.@...............(............................text...x........................... ..`.rdata..............................@..@.data.........#......b#.............@....pdata.......P$.......#.............@..@.rsrc........P%.......$.............@..@.reloc..D....`%.......$.............@..B........................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PIL\_imagingcms.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):257536
                Entropy (8bit):6.280201200423917
                Encrypted:false
                SSDEEP:6144:kFuq195UQ/b/8yRI7O4T9HFLg9uP1+74/LgHmPr9qvZqhLanLTLzLfqeqwL1Je0s:kFuqL5UfT9HFLg9uP1+74/LgHmPr9qvK
                MD5:74277F3293C7B0D3E882EA2DE1D1CF1E
                SHA1:4C8E0611A315A9BB4B7829989EC0115B65E679E9
                SHA-256:00BCFE359DB03A33DF453FF0DE146BFF038419AC65D5CB5055FFF5ED19A56259
                SHA-512:6DCC56EF0C3C4ED6286FCE212112764C9D0B38980783A2F348A3FCE0CC7CD0B7E75D388508484CD585493C645D3CC150B22D5FB9E41A4BD4CFDEA0E8441AE909
                Malicious:true
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D....b...b...b....R..b.......b......b......b......b...<...b..K....b...b..lb......b.......b....>..b......b..Rich.b..........................PE..d.....ec.........." ...!..... ...............................................0............`.........................................0...d.................................... .......E...............................D..@...............`............................text...(........................... ..`.rdata.............................@..@.data....F.......@...v..............@....pdata...........0..................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PIL\_imagingft.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):1652736
                Entropy (8bit):6.766846496259483
                Encrypted:false
                SSDEEP:24576:RGxm3UN0DyIeCzhYTUrU55IUYcEe7/t8fV7MZgyzcO0PEXbZ5Ap4Xfo45:ox4SfC2TUO5HCI/et+gytfo4
                MD5:C399B12E90D2560998FBE4BAAA1C2520
                SHA1:075B5788F9B24385041B46BFBFCDB8B813063D8B
                SHA-256:EDB2750798F931782A39F68177594BE7B61D5DE8D2D72CC2DA56EE481235A91B
                SHA-512:2D395BE849E2CE8AC25EEE756CA6CAA9C1D1AD7C4D5157AD0D31D9442C765A3D7ACDCAE36BB37AD72724967D078908B316D491E6F8FF6B960B8F7D982903928C
                Malicious:true
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........pn...........i.....&j......i.....&j.....&j.....&j.....&j......O........(...(j.....(j.....(j.....(j.....(j.....(j.....Rich............PE..d.....ec.........." ...!.....@............................................................`..........................................1..d....2.......`.......................p..h...p...............................0...@............... ............................text............................... ..`.rdata...0.......2..................@..@.data....+...P...$...2..............@....pdata...............V..............@..@.rsrc........`.......(..............@..@.reloc..h....p.......*..............@..B........................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PIL\_imagingtk.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):15872
                Entropy (8bit):5.016426536954842
                Encrypted:false
                SSDEEP:192:dLWyIXW4r4fhDBg3hB2tCIpg7or9edH58IPpElVysUA4ckgT1G:dL7IXr45DBg3hB2V9eswpsVyZA2gTQ
                MD5:B61513E865CE6A68D13BE4CD2460B5AD
                SHA1:CBA64C5713D6D9D6267B4BFBF9BB2882CFAF174E
                SHA-256:32E29A8FF928D60D4E469796485A4F086E56CD7D6FA82793CBE5F4B2BF76742C
                SHA-512:94BD51836FE14DE22BCA9BCBC214C39B690DE1C077925FC4A93660912D2390EF57CB989A82C6BC2C9F82381D77905686960358CA3DFBE532DC6FE3E7022630AB
                Malicious:true
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........i..:..:..:...:..:F..;..:F..;..:F..;..:F..;..:l.;..:..;..:..:.:H..;..:H..;..:H.l:..:H..;..:Rich..:........................PE..d.....ec.........." ...!.....$............................................................`..........................................9..d...T:.......p.......`..................<...p3..............................02..@............0..x............................text............................... ..`.rdata..z....0....... ..............@..@.data...8....P.......2..............@....pdata.......`.......6..............@..@.rsrc........p.......:..............@..@.reloc..<............<..............@..B................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PIL\_webp.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):531456
                Entropy (8bit):6.580984741686164
                Encrypted:false
                SSDEEP:12288:wyN9n89fa3Z6utaazqLrLrLrLaCCKVtNaIKJQIJzK:wV9ypLqLrLrLrLaCCKEIyQIJzK
                MD5:AA29985595759F7C02529650F6C35F1B
                SHA1:A859D0549379050C7CEC8B285A3BA802E8E71566
                SHA-256:47F85EE8BC271D79AC383C285EF026C7040B94AF8E67A5832138EEF8FC595CBD
                SHA-512:55AD17D7280B626A8B026470DB8A86C2DE05B137D9A923A37E6FE87169F682347E715D2EFFDE820ED58A6352CDFC396B64DA9B704085763FDAD30F6C7B7FABFD
                Malicious:true
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0Qw.Q?$.Q?$.Q?$.).$.Q?$C*>%.Q?$.)>%.Q?$C*:%.Q?$C*;%.Q?$C*<%.Q?$i.>%.Q?$.Q>$.Q?$M*;%.Q?$M*7%.Q?$M*?%.Q?$M*.$.Q?$M*=%.Q?$Rich.Q?$........PE..d.....ec.........." ...!.................................................................`.........................................P...X............p....... ...M...................R...............................Q..@............................................text............................... ..`.rdata..~...........................@..@.data....7..........................@....pdata...M... ...N..................@..@.rsrc........p......................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\QtCore.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):2467840
                Entropy (8bit):6.240133820704683
                Encrypted:false
                SSDEEP:49152:aWYt+wPbTcSKSCcHFpXEqzhDarD9HDXTk5am3QSQK4ZAzYI+1ZdAEDGmtV/U3bwN:jSKSCcHFpXEqzhDarD9HDXTk5am3QSQO
                MD5:1DA7B606380B624274E7E3C5F25209BC
                SHA1:695949EAB1548E05FB10DA421626EF95B03D5B89
                SHA-256:203BB6236F23F57AD8CDAB5BBF4537A4ABBC0B0879CF2893A8DC930E679DD846
                SHA-512:43E4CDE7B3CF2F57991C169B1B9AD90334187A41B7784F37660D146252B1C6BD2E98CF86210F938967653773F29619CF0CE038A99184E3D44F734223D05C0B93
                Malicious:true
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........^..0..0..0.....0...1...0...1...0...5..0...4..0...3..0.M.1...0.E.1...0..1.!.0...5..0...0..0...2..0.Rich.0.........................PE..d...3..c.........." .....B..........HF........................................&...........`.............................................L...L.................#..............`%.....`.......................b..(....`..8............`...o...........................text....A.......B.................. ..`.rdata...o...`...p...F..............@..@.data...(...........................@....pdata........#......<#.............@..@.reloc......`%.......%.............@..B........................................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\QtGui.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):2482688
                Entropy (8bit):6.233473435581707
                Encrypted:false
                SSDEEP:49152:eq1Bdy8kK+zqwXSkaGV0COyxNkFAEfYoyWbP:dLdiznbTjO
                MD5:3A9A1CD6F3A0EFE67B5994B82D7C4E21
                SHA1:E4009EB322A235C7B739777B4385906A238E7B37
                SHA-256:2CA28D29EC4F2F50B4CCC70C7D6399B314151BC38852833D2D30097773BB1C00
                SHA-512:13BCA36D9BFBE7AD6B43818E5AFC4FF940ADCCC8273DB00052B1466339258C4A0D47B2E126278F43CB24A0E608A08CF39A92379375CE011E156DE1546A286C15
                Malicious:true
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........wE.S.+OS.+OS.+OZn.OW.+O.c*NQ.+O.~*NQ.+O.c.NG.+O.c/N[.+O.c(NP.+O.m*NQ.+O.f*NV.+OS.*O..+O.c.NX.+O.c+NR.+O.c)NR.+ORichS.+O........................PE..d...R..c.........." .........J...............................................@&...........`.............................................L...L.................#...............%.....`...................................8................z...........................text............................... ..`.rdata..V...........................@..@.data...(z...p...^...N..............@....pdata........#.......#.............@..@.reloc........%.......%.............@..B........................................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\QtWidgets.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):5092864
                Entropy (8bit):6.251608446485404
                Encrypted:false
                SSDEEP:49152:I6qnQByIoLSo7MMVjv7pekxL3UNmN61ZA+gca6xSdJzqNQ9SbBanj1Mxf5uJa:WxI/kMaz7YsgNDG90+VimCOa
                MD5:9E4B668C64D9E7A6C59BEBE4B0D6D7C0
                SHA1:75C70834E631014296F893F5584B18EA20AC1EC3
                SHA-256:E4A06FE65B02C568DB984771FB9A46EA95A8E4353EA85C942F954CBA02DEC635
                SHA-512:8D18D5F640EFE4631E4E43A1EF4BB458613C598C88574DC3C3BCFA8C0B8C7CBBF4950CF6F6BB31B49914DC45523A2376AC9178939164D93BDDD670BAD5386D66
                Malicious:true
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........0...^..^..^.....^..._..^..._..^...[..^...Z..^...]..^..._..^..._..^.._..^.X.[..^.X.^..^.X.\..^.Rich..^.................PE..d...m..c.........." ......,...!.......,.......................................N...........`..........................................t;.T...Du;..............0H..t............L..O...7..............................7.8.............,.`............................text...(.,.......,................. ..`.rdata..F.....,.......,.............@..@.data....9....@.......@.............@....pdata...t...0H..t....G.............@..@.reloc...O....L..P...fL.............@..B................................................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\iconengines\qsvgicon.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):41968
                Entropy (8bit):6.0993566622860635
                Encrypted:false
                SSDEEP:768:VPs5g31JfDgej5JZmA0ZsEEC6lmn+4FdDGimUf2hr:VkC31ee7ZmA+sEEC6lmn+4FOUfc
                MD5:313F89994F3FEA8F67A48EE13359F4BA
                SHA1:8C7D4509A0CAA1164CC9415F44735B885A2F3270
                SHA-256:42DDE60BEFCF1D9F96B8366A9988626B97D7D0D829EBEA32F756D6ECD9EA99A8
                SHA-512:06E5026F5DB929F242104A503F0D501A9C1DC92973DD0E91D2DAF5B277D190082DE8D37ACE7EDF643C70AA98BB3D670DEFE04CE89B483DA4F34E629F8ED5FECF
                Malicious:false
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n.:*..i*..i*..i#.Ei...i...h(..i>..h(..i...h8..i...h-..i...h(..i...h-..i*..i...i...h(..i...h+..i..)i+..i...h+..iRich*..i........................PE..d......_.........." .....@...F.......F..............................................C.....`..........................................g..x...hh..........H...........................xX..T....................Z..(....X..0............P...............................text....>.......@.................. ..`.rdata...3...P...4...D..............@..@.data................x..............@....pdata...............z..............@..@.qtmetadj...........................@..P.rsrc...H...........................@..@.reloc..............................@..B........................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qgif.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):39408
                Entropy (8bit):6.0316011626259405
                Encrypted:false
                SSDEEP:768:ygk2hM0GskFtvPCjEIxh8eDzFyPddeeGvnhotdDGPUf2he:yN2a05kfPOEMaeDzFkddeFnhotOUfh
                MD5:52FD90E34FE8DED8E197B532BD622EF7
                SHA1:834E280E00BAE48A9E509A7DC909BEA3169BDCE2
                SHA-256:36174DD4C5F37C5F065C7A26E0AC65C4C3A41FDC0416882AF856A23A5D03BB9D
                SHA-512:EF3FB3770808B3690C11A18316B0C1C56C80198C1B1910E8AA198DF8281BA4E13DC9A6179BB93A379AD849304F6BB934F23E6BBD3D258B274CC31856DE0FC12B
                Malicious:false
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........R...3..3..3..KA.3..o\..3..X..3..o\..3..o\..3..o\..3.."C..3..3...3.."C..3.."C..3.."C-.3.."C..3..Rich.3..........PE..d...H._.........." .....@...B.......E...............................................^....`..........................................f..t....f..........@............~..............HW..T....................X..(....W..0............P...............................text...k?.......@.................. ..`.rdata..&)...P...*...D..............@..@.data...(............n..............@....pdata...............p..............@..@.qtmetads............v..............@..P.rsrc...@............x..............@..@.reloc...............|..............@..B........................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qicns.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):45040
                Entropy (8bit):6.016125225197622
                Encrypted:false
                SSDEEP:768:vEip0IlhxTDxut3dnm8IyAmQQ3ydJouEAkNypTAO0tfC3apmsdDG9Uf2hU:vxvXxgVIyA23ydJlEATpTAO0tfCKpms/
                MD5:AD84AF4D585643FF94BFA6DE672B3284
                SHA1:5D2DF51028FBEB7F6B52C02ADD702BC3FA781E08
                SHA-256:F4A229A082D16F80016F366156A2B951550F1E9DF6D4177323BBEDD92A429909
                SHA-512:B68D83A4A1928EB3390DEB9340CB27B8A3EB221C2E0BE86211EF318B4DD34B37531CA347C73CCE79A640C5B06FBD325E10F8C37E0CEE2581F22ABFBFF5CC0D55
                Malicious:false
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................a....Q........Q......Q......Q......................................Rich...........PE..d......_.........." .....B...N.......G...............................................&....`.............................................t...$...........@...........................xp..T....................r..(....p..0............`...............................text....@.......B.................. ..`.rdata...9...`...:...F..............@..@.data...............................@....pdata..............................@..@.qtmetadx...........................@..P.rsrc...@...........................@..@.reloc..............................@..B........................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qico.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):38384
                Entropy (8bit):5.957072398645384
                Encrypted:false
                SSDEEP:768:zBXBEfQiAzC9Oh5AS7a3Z5OGrTDeV9mp7nnsWdDGgYUf2hi/:8JAzuOhy3zOGrTDeV9mp7nnsWjYUfz
                MD5:A9ABD4329CA364D4F430EDDCB471BE59
                SHA1:C00A629419509929507A05AEBB706562C837E337
                SHA-256:1982A635DB9652304131C9C6FF9A693E70241600D2EF22B354962AA37997DE0B
                SHA-512:004EA8AE07C1A18B0B461A069409E4061D90401C8555DD23DBF164A08E96732F7126305134BFAF8B65B0406315F218E05B5F0F00BEDB840FB993D648CE996756
                Malicious:false
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u.G...G...G...N...C......E...S...E......R......O......D.......B...G...........D.......F.......F.......F...RichG...................PE..d...H._.........." .....4...H.......9....................................................`..........................................h..t...th..........@............z..............(X..T....................Y..(....X..0............P..8............................text....2.......4.................. ..`.rdata..B/...P...0...8..............@..@.data...h............h..............@....pdata...............l..............@..@.qtmetad.............r..............@..P.rsrc...@............t..............@..@.reloc...............x..............@..B................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qjpeg.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):421360
                Entropy (8bit):5.7491063936821405
                Encrypted:false
                SSDEEP:6144:USgOWz1eW38u9tyh6fpGUasBKTrsXWwMmH1l3JM5hn0uEfB4:USPQTnastBRB4
                MD5:16ABCCEB70BA20E73858E8F1912C05CD
                SHA1:4B3A32B166AB5BBBEE229790FDAE9CBC84F936BA
                SHA-256:FB4E980CB5FAFA8A4CD4239329AED93F7C32ED939C94B61FB2DF657F3C6AD158
                SHA-512:3E5C83967BF31C9B7F1720059DD51AA4338E518B076B0461541C781B076135E9CB9CBCEB13A8EC9217104517FBCC356BDD3FFACA7956D1C939E43988151F6273
                Malicious:false
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Iv"...L...L...L..o....L..xM...L..|M...L.......L..xI...L..xH...L..xO...L..gM...L...M...L..gH.?.L..gI...L..gL...L..g....L..gN...L.Rich..L.........PE..d...o._.........." .....b...........i...............................................g....`.............................................t...............@....`.......R..............h...T.......................(.......0...............@............................text....`.......b.................. ..`.rdata..J............f..............@..@.data...8....P.......(..............@....pdata.......`... ...*..............@..@.qtmetad.............J..............@..P.rsrc...@............L..............@..@.reloc...............P..............@..B........................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qsvg.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):32240
                Entropy (8bit):5.978149408776758
                Encrypted:false
                SSDEEP:768:uOVKDlJJVlTuLiMtsKVG7TSdDG9Uf2h4e:hVgJVlTuL/tsKVG7TSQUfre
                MD5:C0DE135782FA0235A0EA8E97898EAF2A
                SHA1:FCF5FD99239BF4E0B17B128B0EBEC144C7A17DE2
                SHA-256:B3498F0A10AC4CB42CF7213DB4944A34594FF36C78C50A0F249C9085D1B1FF39
                SHA-512:7BD5F90CCAB3CF50C55EAF14F7EF21E05D3C893FA7AC9846C6CA98D6E6D177263AC5EB8A85A34501BCFCA0DA7F0B6C39769726F4090FCA2231EE64869B81CF0B
                Malicious:false
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........x>...P...P...P..a...P.&vQ...P..rQ...P.&vU...P.&vT...P.&vS...P.kiQ...P...Q.n.P.kiU...P.kiP...P.ki....P.kiR...P.Rich..P.........PE..d......_.........." .....$...B......D)....................................................`.........................................PU..t....U..........@............b...............G..T....................I..(...PH..0............@..(............................text....".......$.................. ..`.rdata...+...@...,...(..............@..@.data...8....p.......T..............@....pdata...............V..............@..@.qtmetad.............Z..............@..P.rsrc...@............\..............@..@.reloc...............`..............@..B........................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qtga.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):31728
                Entropy (8bit):5.865766652452823
                Encrypted:false
                SSDEEP:768:1lGALluUEAQATWQ79Z2Y8Ar+dDG2vUf2hF:TZl/EH8WQ794Y8Ar+hvUfm
                MD5:A913276FA25D2E6FD999940454C23093
                SHA1:785B7BC7110218EC0E659C0E5ACE9520AA451615
                SHA-256:5B641DEC81AEC1CF7AC0CCE9FC067BB642FBD32DA138A36E3BDAC3BB5B36C37A
                SHA-512:CEBE48E6E6C5CDF8FC339560751813B8DE11D2471A3DAB7D648DF5B313D85735889D4E704E8EEC0AD1084AB43BE0EBDFBACD038AEAC46D7A951EFB3A7CE838EB
                Malicious:false
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F ._'N._'N._'N.V_.Y'N..HO.]'N.KLO.]'N..HK.M'N..HJ.W'N..HM.\'N..WO.Z'N._'O.4'N..WK.\'N..WN.^'N..W..^'N..WL.^'N.Rich_'N.........................PE..d......_.........." ....."...@.......'..............................................7.....`..........................................W..t...dX..........@.......`....`..............(I..T....................J..(....I..0............@..h............................text...[!.......".................. ..`.rdata...)...@...*...&..............@..@.data........p.......P..............@....pdata..`............T..............@..@.qtmetadu............X..............@..P.rsrc...@............Z..............@..@.reloc...............^..............@..B........................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qtiff.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):390128
                Entropy (8bit):5.724665470266677
                Encrypted:false
                SSDEEP:6144:V0jqHiFBaRe0GPAKwP15e7xrEEEEEEN024Rx/3tkYiHUASQbs/l7OanYoOgyV:0qqwP15bx/q7/yyV
                MD5:9C0ACF12D3D25384868DCD81C787F382
                SHA1:C6E877ABA3FB3D2F21D86BE300E753E23BB0B74E
                SHA-256:825174429CED6B3DAB18115DBC6C9DA07BF5248C86EC1BD5C0DCAECA93B4C22D
                SHA-512:45594FA3C5D7C4F26325927BB8D51B0B88E162E3F5E7B7F39A5D72437606383E9FDC8F83A77F814E45AFF254914514AE52C1D840A6C7B98767F362ED3F4FC5BD
                Malicious:false
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................E....q............q......q......q......<.............<......<......<......<.)....<......Rich....................PE..d......_.........." .....(..........D-.......................................0............`.............................................t...4...........@........%........... ..(....d..T................... f..(....d..0............@..0............................text....&.......(.................. ..`.rdata...v...@...x...,..............@..@.data...(...........................@....pdata...%.......&..................@..@.qtmetad............................@..P.rsrc...@...........................@..@.reloc..(.... ......................@..B........................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qwbmp.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):30192
                Entropy (8bit):5.938644231596902
                Encrypted:false
                SSDEEP:768:EfEM3S46JE2X/xBZ76pC5J6GdDGZUf2h4:63S3JE2PHZ76pC5J6GEUfn
                MD5:68919381E3C64E956D05863339F5C68C
                SHA1:CE0A2AD1F1A46B61CB298CEC5AA0B25FF2C12992
                SHA-256:0F05969FB926A62A338782B32446EA3E28E4BFBFFC0DBD25ED303FAB3404ABAC
                SHA-512:6222A3818157F6BCD793291A6C0380EF8C6B93ECEA2E0C9A767D9D9163461B541AFAF8C6B21C5A020F01C95C6EE9B2B74B358BA18DA120F520E87E24B20836AA
                Malicious:false
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]...<.I.<.I.<.I.D%I.<.I.S.H.<.I.W.H.<.I.S.H.<.I.S.H.<.I.S.H.<.IYL.H.<.I.<.I.<.IYL.H.<.IYL.H.<.IYLII.<.IYL.H.<.IRich.<.I........PE..d......_.........." ..... ...8.......'....................................................`......................................... D..t....D..........@....p..T....Z...............6..T...................p8..(...@7..0............0..p............................text............ .................. ..`.rdata..d&...0...(...$..............@..@.data........`.......L..............@....pdata..T....p.......N..............@..@.qtmetad~............R..............@..P.rsrc...@............T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\imageformats\qwebp.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):510448
                Entropy (8bit):6.605517748735854
                Encrypted:false
                SSDEEP:12288:bPTjgdqdsvh+LrLrLrL5/y4DVHAsqx3hXS+oPZQqRaYG:jT5sMLrLrLrL5q4dAsaOFo
                MD5:308E4565C3C5646F9ABD77885B07358E
                SHA1:71CB8047A9EF0CDB3EE27428726CACD063BB95B7
                SHA-256:6E37ACD0D357871F92B7FDE7206C904C734CAA02F94544DF646957DF8C4987AF
                SHA-512:FFAEECFAE097D5E9D1186522BD8D29C95CE48B87583624EB6D0D52BD19E36DB2860A557E19F0A05847458605A9A540C2A9899D53D36A6B7FD5BF0AD86AF88124
                Malicious:false
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................a....s........s......s......s....>.........>......>.....>....>......>....Rich...................PE..d......_.........." .....B..........tH.......................................0......`q....`..........................................W..t....W..........@.......0H........... ......h...T.......................(.......0............`...............................text...[@.......B.................. ..`.rdata..J....`.......F..............@..@.data....'...........X..............@....pdata..0H.......J...\..............@..@.qtmetadv...........................@..P.rsrc...@...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\mediaservice\dsengine.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):301040
                Entropy (8bit):6.15513142093455
                Encrypted:false
                SSDEEP:6144:+t6LjqQ5qwlL5536MDPlk1B9/f9EQlK13EsOyo+FRrzu:+sLWQwwT53dJA+FRrzu
                MD5:9EC42E2D5C802162CFF74A037917AE94
                SHA1:73E7A721AE946A1AE7443E047589620C71FF99AB
                SHA-256:3539AA922FCC946C8AF2BDBABF10B0260B9CC14AD62EA331D29766B170D1D3D4
                SHA-512:407BB599B654FCD8BF4FD0E724CC4FED6318A655838B7B8A027938CADDEF9604D4CCEE665DDE799C0C74B21D910462D38EF7E8E82237B420221B32DBC02B7128
                Malicious:false
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......0^B.t?,.t?,.t?,.}G..~?,.P).g?,.P(.|?,.P/.w?,.P-.p?,..O-.~?,.`T(.r?,.`T).u?,.`T-.c?,.t?-..=,..O).6?,..O,.u?,..O..u?,..O..u?,.Richt?,.........................PE..d...l.._.........." ................l................................................1....`.............................................x...(...........H....`..D1...|..................T..................../..(...p...0............................................text............................... ..`.rdata...o.......p..................@..@.data... 2... ...*..................@....pdata..D1...`...2...:..............@..@.qtmetad.............l..............@..P.rsrc...H............n..............@..@.reloc...............r..............@..B........................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\mediaservice\qtmedia_audioengine.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):68080
                Entropy (8bit):5.915530709928927
                Encrypted:false
                SSDEEP:1536:CX+k4JfQEzxmtbtXd8UxpzFV03X8GhCMIZm4XUfo:CyJBxm3XKUHzGhCMIZf/
                MD5:71A4564FA2B8755E43FB6D5D6AFE9763
                SHA1:4A58F92BD8153860B0D89B7AC068CF7E5AA1040A
                SHA-256:1E8DC7E376664B17A5356E53CFB5BB7CFF148E05A5B96923EF59E2C29ADA28FD
                SHA-512:4D15E0D04D184A7B59E0DF97BB96EFE14AA76E57148727166351A1C010B141CE22ACC92F17F8C45791E0CD8374FB45ED3F95311524A7F11E2F336D934452425F
                Malicious:false
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........GA.&/..&/..&/..^...&/.QI...&/..M...&/.QI*..&/.QI+..&/.QI,..&/..V...&/..&...'/..V*..&/..V/..&/..V..&/..V-..&/.Rich.&/.........................PE..d......_.........." .....b..........th.......................................@............`.......................................................... ..X....................0..$.......T.......................(...p...0............................................text....a.......b.................. ..`.rdata..Fh.......j...f..............@..@.data...x...........................@....pdata..............................@..@.qtmetad............................@..P.rsrc...X.... ......................@..@.reloc..$....0......................@..B........................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\mediaservice\wmfengine.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):208368
                Entropy (8bit):6.0609445635731305
                Encrypted:false
                SSDEEP:3072:W4vMUHhXLy+Duac3hiMGY3XQtjNjFiUipnrNg9KoHosdi:2eySuaQxejN4UipnrNg9XHoei
                MD5:BB6F3C46B003B34FD189C58B2C39962B
                SHA1:3CFFF78FBA6497BC1FD2C2AD4BE494E97254E898
                SHA-256:7E76A6B05EA7919A17C90591AA406E4F4835BB6478B5E43FC683C18F251EA96F
                SHA-512:DCE7BB4DD739251168F697C58B9F96DD883ADABC1D9A89B601C0D58C12D587F61F1D0A4215F66D3E6E6108778E4082F230043FB2D417CD4908754E58A0E1140A
                Malicious:false
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......h.fQ,...,...,...%...*......(......$....../......9...8...-.......&...8...-...8...-...8...+...8...;...,...................-.......-.......-...Rich,...........PE..d...X.._.........." .........d...............................................`............`.........................................0p..x....p.......@..H........ ...........P..x...X...T.......................(.......0............................................text...;........................... ..`.rdata..............................@..@.data....%....... ..................@....pdata... ......."..................@..@.qtmetad.....0......................@..P.rsrc...H....@......................@..@.reloc..x....P......................@..B........................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\platforms\qminimal.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):844784
                Entropy (8bit):6.625808732261156
                Encrypted:false
                SSDEEP:12288:y6MhioHKQ1ra8HT+bkMY8zKI4kwU7dFOTTYfEWmTxbwTlWc:BMhioHKQp+bkjAjwGdFSZtbwBd
                MD5:2F6D88F8EC3047DEAF174002228219AB
                SHA1:EB7242BB0FE74EA78A17D39C76310A7CDD1603A8
                SHA-256:05D1E7364DD2A672DF3CA44DD6FD85BED3D3DC239DCFE29BFB464F10B4DAA628
                SHA-512:0A895BA11C81AF14B5BD1A04A450D6DCCA531063307C9EF076E9C47BD15F4438837C5D425CAEE2150F3259691F971D6EE61154748D06D29E4E77DA3110053B54
                Malicious:true
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#\..B2..B2..B2..:...B2..-3..B2.F....B2..-7..B2..-6..B2..-1..B2..)6..B2.^23..B2..)3..B2..B3.@2.^26..B2.^27..B2.^22..B2.^2...B2.^20..B2.Rich.B2.........PE..d...N._.........." ......................................................... ............`......................................... ...x.......@.......H....`..H.......................T.......................(.......0...............(............................text...;........................... ..`.rdata...C.......D..................@..@.data...H....@......."..............@....pdata..H....`.......0..............@..@.qtmetad............................@..P.rsrc...H...........................@..@.reloc..............................@..B................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\platforms\qoffscreen.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):754672
                Entropy (8bit):6.6323155845799695
                Encrypted:false
                SSDEEP:12288:/HpBmyVIRZ3Tck83vEgex5aebusGMIlhLfEWmpCJkl:/HpB63TckUcLaHMITAZmW
                MD5:6407499918557594916C6AB1FFEF1E99
                SHA1:5A57C6B3FFD51FC5688D5A28436AD2C2E70D3976
                SHA-256:54097626FAAE718A4BC8E436C85B4DED8F8FB7051B2B9563A29AEE4ED5C32B7B
                SHA-512:8E8ABB563A508E7E75241B9720A0E7AE9C1A59DD23788C74E4ED32A028721F56546792D6CCA326F3D6AA0A62FDEDC63BF41B8B74187215CD3B26439F40233F4D
                Malicious:true
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m..T..KT..KT..K]t7K@..K.c.JV..K@g.JV..K.cKU..K.c.JA..K.c.J\..K.c.JP..K.|.JQ..KT..K...K.|.Js..K.|.JS..K.|.JU..K.|[KU..K.|.JU..KRichT..K........PE..d...R._.........." ................L.....................................................`.............................................x...8...........H....... s...h..........p.......T................... ...(.......0...............@............................text............................... ..`.rdata..............................@..@.data...............................@....pdata.. s.......t..................@..@.qtmetad.............T..............@..P.rsrc...H............V..............@..@.reloc..p............Z..............@..B........................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\platforms\qwebgl.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):482288
                Entropy (8bit):6.152380961313931
                Encrypted:false
                SSDEEP:6144:WO/vyK+DtyaHlIMDhg5WEOvAwKB2VaaHeqRw/yVfYu4UnCA6DEjeYchcD+1Zy2:bKtHOWg5OvAwK0NYu4AShcD+1U2
                MD5:1EDCB08C16D30516483A4CBB7D81E062
                SHA1:4760915F1B90194760100304B8469A3B2E97E2BC
                SHA-256:9C3B2FA2383EEED92BB5810BDCF893AE30FA654A30B453AB2E49A95E1CCF1631
                SHA-512:0A923495210B2DC6EB1ACEDAF76D57B07D72D56108FD718BD0368D2C2E78AE7AC848B90D90C8393320A3D800A38E87796965AFD84DA8C1DF6C6B244D533F0F39
                Malicious:true
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........gM..#...#...#..~....#.ei&...#.ei'...#.ei ...#..m'...#.ei"...#.(v"...#..m"...#..."...#.(v&...#.(v#...#.(v...#.(v!...#.Rich..#.................PE..d......_.........." .....R...........;....................................................`..........................................m..t...Dn..T.......@....@...=...@..............0...T.......................(.......0............p..(............................text...{Q.......R.................. ..`.rdata..:....p.......V..............@..@.data...H....0......................@....pdata...=...@...>..................@..@.qtmetadz............2..............@..P.rsrc...@............4..............@..@.reloc...............8..............@..B........................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\platforms\qwindows.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):1477104
                Entropy (8bit):6.575113537540671
                Encrypted:false
                SSDEEP:24576:4mCSPJrAbXEEuV9Hw2SoYFo3HdxjEgqJkLdLu5qpmZuhg/A2b:nPlIEEuV9Hw2SFFWHdWZsdmqja/A2b
                MD5:4931FCD0E86C4D4F83128DC74E01EAAD
                SHA1:AC1D0242D36896D4DDA53B95812F11692E87D8DF
                SHA-256:3333BA244C97264E3BD19DB5953EFA80A6E47AACED9D337AC3287EC718162B85
                SHA-512:0396BCCDA43856950AFE4E7B16E0F95D4D48B87473DC90CF029E6DDFD0777E1192C307CFE424EAE6FB61C1B479F0BA1EF1E4269A69C843311A37252CF817D84D
                Malicious:false
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......i...-...-...-...$.%.9.....q.,......8......%......)......+...9......9..,......)..........9..8...-..........d......,.....I.,......,...Rich-...........PE..d....._.........." .....,...h......4+..............................................n.....`.............................................x...(...........H............n..........X....r..T...................Pt..(... s..0............@...5...........................text..._+.......,.................. ..`.rdata.......@.......0..............@..@.data....m...@...D...(..............@....pdata...............l..............@..@.qtmetad.............J..............@..P.rsrc...H............L..............@..@.reloc..X............P..............@..B........................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\platformthemes\qxdgdesktopportal.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):68592
                Entropy (8bit):6.125954940500008
                Encrypted:false
                SSDEEP:1536:Nt4B1RLj3S6TtH2sweUH+Hz6/4+D6VFsfvUfO:AB1RHFdoeUs6/4O6VFSZ
                MD5:F66F6E9EDA956F72E3BB113407035E61
                SHA1:97328524DA8E82F5F92878F1C0421B38ECEC1E6C
                SHA-256:E23FBC1BEC6CEEDFA9FD305606A460D9CAC5D43A66D19C0DE36E27632FDDD952
                SHA-512:7FF76E83C8D82016AB6BD349F10405F30DEEBE97E8347C6762EB71A40009F9A2978A0D8D0C054CF7A3D2D377563F6A21B97DDEFD50A9AC932D43CC124D7C4918
                Malicious:true
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+...o...o...o...f...k......m...{..m......~......h......m......h...o..........k......n.....~.n......n...Richo...........................PE..d...V._.........." .....z...t......T........................................@.......b....`......................................... ................ ..X....................0..4.......T.......................(...p...0...............x............................text....y.......z.................. ..`.rdata...Z.......\...~..............@..@.data...............................@....pdata..............................@..@.qtmetad............................@..P.rsrc...X.... ......................@..@.reloc..4....0......................@..B........................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\printsupport\windowsprintersupport.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):55280
                Entropy (8bit):6.083938612859037
                Encrypted:false
                SSDEEP:768:PY5ff1eZ5yUgg+mpYPyU6bZAnhdbfLLAARljIFuzdDG9Uf2hFc:PY5X1ez9DYaUQZAnhJz8ARljmuzAUf1
                MD5:07D7D4B65F5EB33051320DF66BD943A9
                SHA1:9A89ECF02137394BDDDE6F3D4E455AFE1BC1FA53
                SHA-256:C7A1BBF4EA6A74888E71F7199373C9920017199B41F624267EAD151EB8CF99B6
                SHA-512:E58DC1BC6243907EB7BBECFF1CF697C1384C9F3FCBFA8B28EB4920E71B701901A4F20F889E19CDEFB953A194D7E1D1F9EAA197E1B740075BB06AE05D3ACE15AF
                Malicious:true
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................P....x......x......x......x......5..................5......5......5.<....5......Rich............................PE..d...K._.........." .....Z...`.......`.............................................../....`.........................................0...................`.......4...................h~..T.......................(....~..0............p..`............................text...1Y.......Z.................. ..`.rdata...F...p...H...^..............@..@.data...............................@....pdata..4...........................@..@.qtmetad............................@..P.rsrc...`...........................@..@.reloc..............................@..B........................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\qt-plugins\styles\qwindowsvistastyle.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):144368
                Entropy (8bit):6.294675868932723
                Encrypted:false
                SSDEEP:3072:rrjwZ43rCOtrBk7wcR0l7wBlaL6BtIEt51T0Nhkqg8FoQY:7hZu9R0l7wFBtIEt51T0Nuqg8JY
                MD5:53A85F51054B7D58D8AD7C36975ACB96
                SHA1:893A757CA01472A96FB913D436AA9F8CFB2A297F
                SHA-256:D9B21182952682FE7BA63AF1DF24E23ACE592C35B3F31ECEEF9F0EABEB5881B9
                SHA-512:35957964213B41F1F21B860B03458404FBF11DAF03D102FBEA8C2B2F249050CEFBB348EDC3F22D8ECC3CB8ABFDC44215C2DC9DA029B4F93A7F40197BD0C16960
                Malicious:false
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R._...1]..1]..1]..]..1]..0\..1]..5\..1]..2\..1]..4\..1]..0\..1]..0\..1]..0]..1]..4\..1]..1\..1]...]..1]..3\..1]Rich..1]........................PE..d...`._.........." .....\...........`.......................................`......wJ....`................................................. ........@..X.... ...............P.........T...................`...(...0...0............p...............................text....Z.......\.................. ..`.rdata......p.......`..............@..@.data...............................@....pdata....... ......................@..@.qtmetadm....0......................@..P.rsrc...X....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\PyQt5\sip.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):121344
                Entropy (8bit):6.013239668983001
                Encrypted:false
                SSDEEP:3072:ffo4ygrnRYa5v7Wbj8F4HwSvQxoodR89X1f:44yQOa5jWnW4wSoPR2f
                MD5:3C3ECB577008D8C505C48D1136139886
                SHA1:15A08DAA51035EB4C7E2931A22FA2475118F95D6
                SHA-256:4E42894C6335229782AE2FD1C5FE59F571FA4C7CD2C0EE7543C7A320333E46F2
                SHA-512:EF220EBCF27E6F607AD4F22A6BAEC1FE88345D3B3274826F76C5A5715A26F6A96032E69E30A0464BF91B9409B3588769F8CD907D34EF5179AC25409A82BA60F8
                Malicious:true
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................................../.........y.....y.....y.`...y.....Rich..........................PE..d....+8d.........." .....N...........R....................................... ............`.........................................0...T...........................................P...............................p...8............`...............................text....M.......N.................. ..`.rdata...R...`...T...R..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_asyncio.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):73744
                Entropy (8bit):5.899692891859365
                Encrypted:false
                SSDEEP:1536:P/NHFMdDgugn5BHr/1Rq6mMxnBGpI8snaqy27:X/485x1Rq6mgncpI8snaw7
                MD5:3A9762EE38BFAC66D381270C80D8B787
                SHA1:44036D492A5BB4A8EDFC5DDF3EE84772C74A77ED
                SHA-256:9531365763F8BBFF9FA7E18EABEFE866F99EA4B8E127B265A8952E16217C61E1
                SHA-512:4AFE20524D3043FC526C585C2E5589F4505FDBF4B2011577A595AA836423484BAB18A9F5F4DB82D204A3506DBC55923CFBEF1B0F4DAD54FE2DC2A771CD1F632E
                Malicious:true
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......u...1l..1l..1l..8.B.3l...2..3l...2..3l...2..;l...2..;l..2..2l..j...3l..1l..Hl..2..0l..2..0l..2..0l..2..0l..Rich1l..................PE..d...r.:_.........." .....r...........Y.......................................P............`......................................... ...P...p...d....0.......................@..`...`...T............................................................................text...gp.......r.................. ..`.rdata..t:.......<...v..............@..@.data....7.......2..................@....pdata..............................@..@.gfids....... ......................@..@.rsrc........0......................@..@.reloc..`....@......................@..B................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_bz2.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):94736
                Entropy (8bit):6.337586298062742
                Encrypted:false
                SSDEEP:1536:DGb6DBCvurMRnQhVx8/Nlv+SSm9YmFN87Xgq4ToV+dypRI84VAyE:abfXyg7pp9TC7Xgq4ToV+kRI84VY
                MD5:CF77513525FC652BAD6C7F85E192E94B
                SHA1:23EC3BB9CDC356500EC192CAC16906864D5E9A81
                SHA-256:8BCE02E8D44003C5301608B1722F7E26AADA2A03D731FA92A48C124DB40E2E41
                SHA-512:DBC1BA8794CE2D027145C78B7E1FC842FFBABB090ABF9C29044657BDECD44396014B4F7C2B896DE18AAD6CFA113A4841A9CA567E501A6247832B205FE39584A9
                Malicious:true
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e.l..k?..k?..k?.|.?..k?.Zj>..k?B..?..k?.Zh>..k?.Zn>..k?.Zo>..k?vZj>..k?.lj>..k?..j?..k?vZc>..k?vZk>..k?vZ.?..k?vZi>..k?Rich..k?........PE..d...z.:_.........." .........j......$...............................................<6....`........................................../..H...80...............`.......X..................T............................................................................text............................... ..`.rdata...;.......<..................@..@.data........@.......0..............@....pdata.......`.......>..............@..@.gfids.......p.......H..............@..@.rsrc................J..............@..@.reloc...............V..............@..B................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_cffi_backend.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):181760
                Entropy (8bit):6.199103831906969
                Encrypted:false
                SSDEEP:3072:fuDhqvb8EFiB2SAxCapLigdLnqH1nWShafSmnS791/9d9CdhjkhneKGg:fuDcz8EFfSAxzigdWnW1fSWWmhjkhneU
                MD5:DACCB97B9214BB1366ED40AD583679A2
                SHA1:89554E638B62BE5F388C9BDD35D9DAF53A240E0C
                SHA-256:B714423D9CAD42E67937531F2634001A870F8BE2BF413EACFC9F73EF391A7915
                SHA-512:99FD5C80372D878F722E4BCB1B8C8C737600961D3A9DFFC3E8277E024AAAC8648C64825820E20DA1AB9AD9180501218C6D796AF1905D8845D41C6DBB4C6EBAB0
                Malicious:true
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C..CC..CC..CJ.OCO..C...BA..C%.!CG..C...BH..C...BK..C...BG..C...BG..C..B@..CC..C...C...BG..CJ.ICB..C...BB..C..#CB..C...BB..CRichC..C................PE..d.....b.........." .........>......p........................................@............`.........................................PQ..h....Q....... ..........`............0.......7...............................7..8............................................text............................... ..`.rdata..............................@..@.data...H....p...T...T..............@....pdata..`...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_ctypes.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):132624
                Entropy (8bit):5.962671714439977
                Encrypted:false
                SSDEEP:1536:bRyGuR/8oD9tR2yHBIjxBaVGTODsAR04D0RfUGpd0/b8aMgiadI8VPEye:bcDd8oM+kBVQ/8f5pdObL7dI8VPG
                MD5:5E869EEBB6169CE66225EB6725D5BE4A
                SHA1:747887DA0D7AB152E1D54608C430E78192D5A788
                SHA-256:430F1886CAF059F05CDE6EB2E8D96FEB25982749A151231E471E4B8D7F54F173
                SHA-512:FEB6888BB61E271B1670317435EE8653DEDD559263788FBF9A7766BC952DEFD7A43E7C3D9F539673C262ABEDD97B0C4DD707F0F5339B1C1570DB4E25DA804A16
                Malicious:true
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........$\.kw\.kw\.kwU..wZ.kwg.jv^.kwg.hv_.kwg.nvV.kwg.ovV.kw..jv^.kw..ov].kw..jv[.kw\.jw..kw..hv].kw..cvT.kw..kv].kw..w].kw..iv].kwRich\.kw........................PE..d...r.:_.........." .........................................................@....../G....`.......................................................... .......................0.......e..T............................f...............0...............................text............................... ..`.rdata..pq...0...r..................@..@.data....9.......4..................@....pdata..............................@..@.gfids..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_decimal.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):267280
                Entropy (8bit):6.490803702039132
                Encrypted:false
                SSDEEP:6144:16wN+Xkv3Pt2R4ihr6iboTfWebtedJ/gqWya38LWuAxR:U4ExW4oTdoC3R
                MD5:75A0542682D8F534F4A1BA48EB32218F
                SHA1:A9B878F45B575A0502003EBCFE3D6EB9AC7DD126
                SHA-256:5767525D2CDD2A89DE97A11784EC0769C30935302C135F087B09894F8865BE8B
                SHA-512:4682B8E4A81F7EFFC89D580DCA10CCFCCEBE562C2745626833CD5818DE9753C3A1E064A47C7DDC4676B6E1C7071C484156FABE98E423E625BB5D2C2B843C33DE
                Malicious:true
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Q#!.0Mr.0Mr.0Mr.H.r.0Mr.nLs.0Mr.nNs.0Mr.nHs.0Mr.nIs.0Mr.nLs.0Mr.XLs.0Mr.0Lr?0Mr.nNs.0Mr.n@s.0Mr.nMs.0Mr.n.r.0Mr.nOs.0MrRich.0Mr........PE..d...q.:_.........." .........R...............................................@......&5....`.........................................P8..P....8....... ..........|/...........0...... ...T............................................................................text...8........................... ..`.rdata..2...........................@..@.data...h....P...|...:..............@....pdata..|/.......0..................@..@.gfids..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_elementtree.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):207888
                Entropy (8bit):6.299632329784148
                Encrypted:false
                SSDEEP:3072:eA5zdNfn+gUP4DoqYjDn0sYwtk9/h337lm2Fad8u2JyoMMMMMMF4S1jzhI8AfC:eAxL/+gUPJjD0sYw6nBmRQye1jz3
                MD5:7D0C4AB57FDC1BD30C0E8E42CCC2AA35
                SHA1:81BFF07B6B5DD843E2227A3E8054500CFEC65983
                SHA-256:EE8C4A8FE8EAA918A4FEE353D46F4191BD161582098B400C33220847D84797DB
                SHA-512:56AE9F10DE02E7C777673814128D0252B47D001D2EDC74BFF9D85D7B0B6538B6F4D3D163E301DFB31429EC1EEEFEE550A72D6E424F20E10EB63C28DB0E69FBBE
                Malicious:true
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b..B&oo.&oo.&oo./...*oo..1n.$oo..1l.$oo..1j.,oo..1k.,oo..1n.$oo.}.n.%oo.&on..oo..1g."oo..1o.'oo..1..'oo..1m.'oo.Rich&oo.........................PE..d...v.:_.........." .....0...........-.......................................P............`.............................................X...........0...........%...........@..4....}..T...........................P~...............@...............................text...s........0.................. ..`.rdata.......@.......4..............@..@.data...............................@....pdata...%.......&..................@..@.gfids....... ......................@..@.rsrc........0......................@..@.reloc..4....@......................@..B........................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_hashlib.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):38928
                Entropy (8bit):5.959951673192366
                Encrypted:false
                SSDEEP:768:AyvaHXGH0o9MBl7nqHQ03dpI8sIZhWDG4yfkO:UKnyBlmHQadpI8sIZcyMO
                MD5:B32CB9615A9BADA55E8F20DCEA2FBF48
                SHA1:A9C6E2D44B07B31C898A6D83B7093BF90915062D
                SHA-256:CA4F433A68C3921526F31F46D8A45709B946BBD40F04A4CFC6C245CB9EE0EAB5
                SHA-512:5C583292DE2BA33A3FC1129DFB4E2429FF2A30EEAF9C0BCFF6CCA487921F0CA02C3002B24353832504C3EEC96A7B2C507F455B18717BCD11B239BBBBD79FADBE
                Malicious:true
                Antivirus:
                • Antivirus: ReversingLabs, Detection: 0%
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%_..a>..a>..a>..hF^.c>..Z`..c>..Z`..c>..Z`..k>..Z`..k>...`..c>..:V..c>...W..b>..a>..8>...`..`>...`..`>...`2.`>...`..`>..Richa>..................PE..d...y.:_.........." .....6...J.......4....................................................`..........................................e..P...`e..x....................~..............0[..T............................[...............P...............................text....5.......6.................. ..`.rdata..p ...P..."...:..............@..@.data...0............\..............@....pdata...............h..............@..@.gfids...............n..............@..@.rsrc................p..............@..@.reloc...............|..............@..B........................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_lzma.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):176144
                Entropy (8bit):6.6945247495968045
                Encrypted:false
                SSDEEP:3072:KCvUDHEIzx6yBexOV3fNDjGTtDlQxueKd03DV8tv9XIGIPExZJV9mNoA2v1kqnfE:tvUtdBexOlNDk+xTKg8tlJKyXYOAC1Lc
                MD5:5FBB728A3B3ABBDD830033586183A206
                SHA1:066FDE2FA80485C4F22E0552A4D433584D672A54
                SHA-256:F9BC6036D9E4D57D08848418367743FB608434C04434AB07DA9DABE4725F9A9B
                SHA-512:31E7C9FE9D8680378F8E3EA4473461BA830DF2D80A3E24E5D02A106128D048430E5D5558C0B99EC51C3D1892C76E4BAA14D63D1EC1FC6B1728858AA2A255B2FB
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........).o.z.o.z.o.z..7z.o.z.1.{.o.z.1.{.o.z.1.{.o.z.1.{.o.zi1.{.o.z...{.o.z.o.z.o.zi1.{.o.zi1.{.o.zi1[z.o.zi1.{.o.zRich.o.z........................PE..d.....:_.........." ................H.....................................................`.........................................PW..L....W..x...............t...............@....3..T............................4...............................................text...#........................... ..`.rdata..............................@..@.data........p.......T..............@....pdata..t............n..............@..@.gfids..............................@..@.rsrc...............................@..@.reloc..@...........................@..B........................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_multiprocessing.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):29712
                Entropy (8bit):5.960619050057232
                Encrypted:false
                SSDEEP:384:iPzxbi1duybZ93GDXIV0Y5FoTewHJ4nhB/5I8kBLheX1nYPLxDG4y8SNu7:imeIxo6wuH/5I8kthelWDG4ya7
                MD5:3CF091905D3CC49070B0C39848F0D48B
                SHA1:888716F84768545A3B21B36CA0BE2D52D22F9F8A
                SHA-256:7A0A1D04A326E21636A08F5F9772625F8B07BA1CE3FB2C78052BEC3CF795704A
                SHA-512:A9BDD51EBE1DE8CA36EF89B1A6BA9AA213A414C9F6C23819DF3A8F702ACDC6B53F0B096A813B3E93BC4E380791B404276CF2D89A0DE26AAC9A412BCFE49FF4F5
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................%............................}...............}.....}.....}.I....}.....Rich...................PE..d...t.:_.........." ....."...:....... ...................................................`..........................................O..`...`O..x....... ....p..`....Z..............`G..T............................G...............@...............................text.... .......".................. ..`.rdata..J....@.......&..............@..@.data...`....`.......@..............@....pdata..`....p.......F..............@..@.gfids...............J..............@..@.rsrc... ............L..............@..@.reloc...............X..............@..B................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_overlapped.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):46096
                Entropy (8bit):5.925988445470974
                Encrypted:false
                SSDEEP:768:U4ljYOwns/tk8iin8alqEahsMJrrnoYIJVI8JtAWDG4yCO:TjtKPsMJrUVI8JtNyp
                MD5:F22850F077950F7566B4C6C15A184BF3
                SHA1:E200F6BA1378CAEED367C9A365B13232919F1DFA
                SHA-256:EFE043D0FC7C922968F44469FD70FDBB49569D8CA8AF82AAEA796F5B687F5660
                SHA-512:9799823371169D85D8A1DC95378C4ABD74A09C88A0A32F65F25B77D8E31A9321C9877E13B0A5F0E7E9C30976DA6ADAB0D084A8F07EC6070701146E9C29FBF00B
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................z........................5.........................5......5......5......5......Rich............................PE..d...v.:_.........." .....<...`......8/....................................................`.........................................pn..X....n.......................................W..T...........................pW...............P..p............................text..._:.......<.................. ..`.rdata...+...P...,...@..............@..@.data...H............l..............@....pdata...............~..............@..@.gfids..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_queue.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):28176
                Entropy (8bit):5.982244926544283
                Encrypted:false
                SSDEEP:384:lDZ54qTq9Qe//7vWXhTR/cEI6rgdI8qU8nYPLxDG4y8HmsuEyo:p4qwQ0WRtS6rgdI8qU8WDG4y6XuEyo
                MD5:C0A70188685E44E73576E3CD63FC1F68
                SHA1:36F88CA5C1DDA929B932D656368515E851AEB175
                SHA-256:E499824D58570C3130BA8EF1AC2D503E71F916C634B2708CC22E95C223F83D0A
                SHA-512:B9168BF1B98DA4A9DFD7B1B040E1214FD69E8DFC2019774890291703AB48075C791CC27AF5D735220BD25C47643F098820563DC537748471765AFF164B00A4AA
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......kUe./4../4../4..&L..-4...j..-4...j..-4...j..%4...j..&4..j..,4..t\..-4../4...4..j...4..j...4..j...4..j...4..Rich/4..........................PE..d...t.:_.........." .........8......8.....................................................`..........................................:..L....;..d............`.......T..........l... 4..T............................4...............0...............................text...s........................... ..`.rdata.. ....0......."..............@..@.data........P.......6..............@....pdata.......`.......@..............@..@.gfids.......p.......D..............@..@.rsrc................F..............@..@.reloc..l............R..............@..B........................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_socket.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):76816
                Entropy (8bit):6.0942584309558985
                Encrypted:false
                SSDEEP:1536:vG/A9Fu5OEPenRXk5d2jw/hEdFcvY+RgOmkcH7dI8VwYyo:e/Anu5OEPenRXRjw/h0FcvYcgOmkcbdV
                MD5:8EA18D0EEAE9044C278D2EA7A1DBAE36
                SHA1:DE210842DA8CB1CB14318789575D65117D14E728
                SHA-256:9822C258A9D25062E51EAFC45D62ED19722E0450A212668F6737EB3BFE3A41C2
                SHA-512:D275CE71D422CFAACEF1220DC1F35AFBA14B38A205623E3652766DB11621B2A1D80C5D0FB0A7DF19402EBE48603E76B8F8852F6CBFF95A181D33E797476029F0
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%A..K...K...K......K..J...K..H...K..N...K..O...K.G.J...K...J...K...J.A.K.G.C...K.G.K...K.G.....K.G.I...K.Rich..K.........PE..d...~.:_.........." .....x...........v.......................................`....... ....`.........................................0...P............@....... ...............P.........T...........................@................................................text...cw.......x.................. ..`.rdata..bA.......B...|..............@..@.data....=.......8..................@....pdata....... ......................@..@.gfids.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_ssl.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):120848
                Entropy (8bit):6.015568704435241
                Encrypted:false
                SSDEEP:3072:B9+/8UxGzqHYjeS0Woia4TMpi6EPQNvURI847uHV:b+UUxGiY8Wo1UVV
                MD5:5A393BB4F3AE499541356E57A766EB6A
                SHA1:908F68F4EA1A754FD31EDB662332CF0DF238CF9A
                SHA-256:B6593B3AF0E993FD5043A7EAB327409F4BF8CDCD8336ACA97DBE6325AEFDB047
                SHA-512:958584FD4EFAA5DD301CBCECBFC8927F9D2CAEC9E2826B2AF9257C5EEFB4B0B81DBBADBD3C1D867F56705C854284666F98D428DC2377CCC49F8E1F9BBBED158F
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a...............x2......^.......^.......^.......^......k^......Zi.......h..............k^......k^......k^^.....k^......Rich....................PE..d.....:_.........." .....................................................................`..........................................;..d...T<..................................h....%..T............................&..................8............................text...s........................... ..`.rdata..r...........................@..@.data....N...p...J...P..............@....pdata..............................@..@.gfids..............................@..@.rsrc...............................@..@.reloc..h...........................@..B........................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\_tkinter.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):69648
                Entropy (8bit):6.022045168499411
                Encrypted:false
                SSDEEP:1536:wZSaB9UmU+YBYGnmmwe06hcvfyRiDpI8sS1yh:wZSDoe0FvfyRiDpI8sSo
                MD5:09F66528018FFEF916899845D6632307
                SHA1:CF9DDAD46180EF05A306DCB05FDB6F24912A69CE
                SHA-256:34D89FE378FC10351D127FB85427449F31595ECCF9F5D17760B36709DD1449B9
                SHA-512:ED406792D8A533DB71BD71859EDBB2C69A828937757AFEC1A83FD1EACB1E5E6EC9AFE3AA5E796FA1F518578F6D64FF19D64F64C9601760B7600A383EFE82B3DE
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.r{}..(}..(}..(t..({..(F..)...(F..)...(F..)v..(F..)w..(..)...(&..)...(...)x..(}..(...(..)...(..)|..(..(|..(..)|..(Rich}..(........................PE..d.....:_.........." .....~...|......HP.......................................P.......P....`.........................................P...P............0..........,............@......P...T............................................................................text...S}.......~.................. ..`.rdata...C.......D..................@..@.data...h...........................@....pdata..,...........................@..@.gfids....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\concrt140.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                Category:dropped
                Size (bytes):317208
                Entropy (8bit):6.325295618585691
                Encrypted:false
                SSDEEP:6144:2VwR2xhiXuz1BxUBE0I3umFKuLHqvqNXV4rnWzgCEcl:Vs9zGEj3saz7l
                MD5:F3C9F61B9E1B25C9DE8D817D3D1C02D7
                SHA1:DAB244AC19C66BB5A7BAE0AEE6E3EA280C30F364
                SHA-256:1F072A6DC98CD882C542208E7A8FE4FBE5239781588F17C005A2607FDFE62D5D
                SHA-512:8A6CF1E91A15B5A1DB52880258F3A39F6CC3BED72E79598F7A10661DD9ED28D369499F585225EB016A2F0B7EDDADE096BA80083DB301B68DEB173FADDE3B9619
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......xFo.<'..<'..<'.....>'..5_..6'...H..;'..<'...'...H..4'...H..8'...H..h'...H..='...H..='...H..='..Rich<'..........................PE..d.....t^.........." ................`...............................................;g....`A.............................................M...................p...6.......A......l....3..8........................... 4..0............................................text...,........................... ..`.rdata..*2.......4..................@..@.data....?...0...8..................@....pdata...6...p...8...N..............@..@.rsrc...............................@..@.reloc..l...........................@..B................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\cv2\cv2.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                Category:dropped
                Size (bytes):87928320
                Entropy (8bit):6.741890175139891
                Encrypted:false
                SSDEEP:393216:ZH7PCXZQzJy4TWVv2/Eidszo7ARI5WEzq8E0vSH3nKBuT8CpX8GxWaHLiAUmYuk4:SQzJDWVv6dYReGxH3KB2XzhE2/sHs
                MD5:8A6BD62E33C8359CDCA4F9B06C4F4E47
                SHA1:27E229566B5759327AB08854B8EE6969770AA76B
                SHA-256:92DAF05BC35D5AE15F6110EE45204973A83B9DF22AB5B449A5158BA33403D9AF
                SHA-512:32AAAA9ED0DD63068C7B064A943D96A00CDE3F4D76F5D56DCC609C04A0C81C851F5587A801553AA952CBC810EAA7589CA0FA70F9E1D0D4B39A8EEC9BB382B918
                Malicious:true
                Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.........N..t N.t N.t N.)$O.t N.)#O.t N.)%O't N.)'O.t N...N.t N4*#O.t N4*%O.t N4*$O.t N.)&O.t N..N.w N.t N.S N.)!O.t N,*$OEt N3*!O.t N.t!N.u N,*%O.p N,* O.t N,*.N.t N,*"O.t NRich.t N........PE..d...@..c.........." ................8GM.......................................`...........`..........................................-..........@.....].......<..D........... ].`.....x.T.....................x.(... .x.................(............................text............................... ..`IPPCODE............................. ..`.rdata...c[......d[.................@..@.data....`0.. ...v..................@....pdata...D....<..F...|..............@..@.tls..........Z.......8.............@...IPPDATA..N....Z..P....8.............@....gfids..l....@[.......9.............@..@_RDATA.......`[......*9.............@..@.rsrc.........].......:.............@..@.reloc..`.... ].......:.

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\libcrypto-1_1.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):3399200
                Entropy (8bit):6.094152840203032
                Encrypted:false
                SSDEEP:98304:R3+YyRoAK2rXHsoz5O8M1CPwDv3uFh+r:t9yWAK2zsozZM1CPwDv3uFh+r
                MD5:CC4CBF715966CDCAD95A1E6C95592B3D
                SHA1:D5873FEA9C084BCC753D1C93B2D0716257BEA7C3
                SHA-256:594303E2CE6A4A02439054C84592791BF4AB0B7C12E9BBDB4B040E27251521F1
                SHA-512:3B5AF9FBBC915D172648C2B0B513B5D2151F940CCF54C23148CD303E6660395F180981B148202BEF76F5209ACC53B8953B1CB067546F90389A6AA300C1FBE477
                Malicious:false
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............K..K..K..;K..K...J..K...J..K...J..K...J..K...J..K..Kb.Kd..J..Kd..J..Kd..J..Kd.WK..Kd..J..KRich..K........................PE..d......^.........." .....R$..........r.......................................`4......~4...`.........................................`...hg...3.@.....3.|.....1.......3. .....3..O...m,.8............................m,...............3..............................text...GQ$......R$................. ..`.rdata.......p$......V$.............@..@.data....z...P1..,...41.............@....pdata..P.....1......`1.............@..@.idata...#....3..$....3.............@..@.00cfg........3......@3.............@..@.rsrc...|.....3......B3.............@..@.reloc..fx....3..z...J3.............@..B................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\libeay32.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                Category:dropped
                Size (bytes):1988608
                Entropy (8bit):6.7573278120063724
                Encrypted:false
                SSDEEP:49152:iIGHW0Tlp28IQfPxwmUie+7IdlmQIU6iShqjQPPjWW8:ijHKqfw0v+qqjQDWW8
                MD5:5F7617F3EC354FBAE5092AB5F0BB8F2A
                SHA1:4DF4E9D48C5DB0C1D170ABD19F3A2FC7ACA4615A
                SHA-256:44DCA66A470DCCA1BF9E6C1F22B4FE2175C4D9E796884CDD61D8536F013416EA
                SHA-512:2F499C164DE92338874D6E1FD4FF790AD1083D71E3069E985B9E29800CDD4AF4340C56928C1AAD38F4ED69120F6A4BA747B8562BD6F01A09E7A58302D9545480
                Malicious:false
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............l...l...l....i..l.......l.......l.......l.......l.......l...l..bl...l...l..m....n..m....l..m....l..m....l..Rich.l..........PE..d...<..].........." .....p...........w....................................................`.........................................0X..........h....P..H....0...............`...B..py..T............................y.................. ............................text...so.......p.................. ..`.rdata..R............t..............@..@.data........ ......................@....pdata.......0......................@..@.rsrc...H....P......................@..@.reloc...B...`...D..................@..B................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\libfreetype-6.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                Category:dropped
                Size (bytes):586240
                Entropy (8bit):6.4460699567644255
                Encrypted:false
                SSDEEP:12288:w7AvRbpuflWqWyhb/e+AUCnGqI3qoTF1OgfEWm:w7AWVhbm+AWqc5uZ
                MD5:42AB9DD5740879C8A0913047149D3A60
                SHA1:D117EF70D0100615B5D50FB555345545E823235B
                SHA-256:8E263FD9257E8E83BAFDA0C943184A498C07424C4D558321FDB48C9A197E58A4
                SHA-512:5C0656521815CB504A1E840FD0163B0EB10D6B7237DBB76C6BDBF66388111667FB1D4FE78C2BBE8D00D377CF150200142CE7E33CB5434960F69A77899322B417
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....j.....................j.............................p......d7........ .............................................. ..T....P.......p...:...........`.............................. @..(...................p".. ............................text...xh.......j..................`.P`.data...P............n..............@.P..rdata..p............p..............@.`@.pdata...:...p...<...F..............@.0@.xdata..(9.......:..................@.0@.bss..................................`..edata..............................@.0@.idata..T.... ......................@.0..CRT....X....0......................@.@..tls....h....@......................@.`..rsrc........P......................@.0..reloc.......`......................@.0B................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\libjpeg-9.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                Category:dropped
                Size (bytes):244224
                Entropy (8bit):6.389441331010228
                Encrypted:false
                SSDEEP:6144:I7wNZIYb0maLgCaqrWqg7EdP8J1dJHoFaeghCbBL:I7we7gCaqrWqg7EdP8jpY
                MD5:C540308D4A8E6289C40753FDD3E1C960
                SHA1:1B84170212CA51970F794C967465CA7E84000D0E
                SHA-256:3A224AF540C96574800F5E9ACF64B2CDFB9060E727919EC14FBD187A9B5BFE69
                SHA-512:1DADC6B92DE9AF998F83FAF216D2AB6483B2DEA7CDEA3387AC846E924ADBF624F36F8093DAF5CEE6010FEA7F3556A5E2FCAC494DBC87B5A55CE564C9CD76F92B
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...........................i.............................@................ .................................................................x............0.............................. ..(...................<................................text............................... .P`.data........ ......................@.P..rdata...J...0...L..................@.`@.pdata..x............b..............@.0@.xdata...............x..............@.0@.bss....P.............................`..edata..............................@.0@.idata..............................@.0..CRT....X...........................@.@..tls....h.... ......................@.`..reloc.......0......................@.0B........................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\libopenblas.WCDJNK7YVMPZQ2ME2ZZHJJRJ3JIKNDB7.gfortran-win_amd64.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                Category:dropped
                Size (bytes):34369888
                Entropy (8bit):6.3382421612060815
                Encrypted:false
                SSDEEP:196608:fGLtguCargPguXVwK+UMidpW9fkSWweAY/CZoEeV8Vb13w6y1WftYk5kscxQfEGP:UksJf2OF
                MD5:1B45722EC0556E13EBA6DB83F383E692
                SHA1:A3BE5C6E4E92CCB250FA325A7FA4CBC35E9124F3
                SHA-256:BD94E2467FE06C5D13BACF7451E13EF18BB876A4E78493D7E9B7600835DBB0AB
                SHA-512:66DBA1F77BE1A1EC71195A7CFCA4612C4232C69AE7248FBCDE58F1A12060BF814F1CF274F6C50D51D82BB09AAD477C1741E1B1A3D50369588CEB01B708DB89B9
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......_..........& .............z..0......... g....................................;/........ .............................................P..t................#...............H...........................Z..(...................(U...............................text...x...........................`..`.data...0..........................@.`..rdata..............................@.`@.pdata...#.......$..................@.0@.xdata..h!......."..................@.0@.bss.....z...0........................`..edata.............................@.0@.idata..t....P......................@.0..CRT....`....p......................@.@..tls................................@.@..reloc...H.......J..................@.0B/4......p...........................@.PB/19.................................@..B/31...... ......."...v..............@..B/45......M.......N..................@..B/57.....

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\libpng16-16.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                Category:dropped
                Size (bytes):210944
                Entropy (8bit):6.4218776738200525
                Encrypted:false
                SSDEEP:3072:VatMOImapxER0/vnm2mjq61IJJT1fX0yuWUQstxZw2TnzFEY5IQ:VatMOImapaR03nmnYJV1cjtnwunw
                MD5:3A26CD3F92436747D2285DCEF1FAE67F
                SHA1:E3D1403BE06BEB32FC8DC7E8A58C31E18B586A70
                SHA-256:E688B4A4D18F4B6CCC99C6CA4980F51218CB825610775192D9B60B2F05EFF2D5
                SHA-512:73D651F063246723807D837811EAD30E3FACA8CB0581603F264C28FEA1B2BDB6D874A73C1288C7770E95463786D6945B065D4CA1CF553E08220AEA4E78A6F37F
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....v...4.................h.............................................. ......................................`..........H...............0...............|........................... ...(...................................................text...hu.......v..................`.P`.data................z..............@.P..rdata..`V.......X...|..............@.`@.pdata..0...........................@.0@.xdata....... ......................@.0@.bss.... ....@........................`..edata.......`......................@.0@.idata..H............&..............@.0..CRT....X............2..............@.@..tls....h............4..............@.`..reloc..|............6..............@.0B........................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\libssl-1_1.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):689184
                Entropy (8bit):5.526574117413294
                Encrypted:false
                SSDEEP:12288:1SurcFFRd4l6NCNH98PikxqceDotbA/nJspatQM5eJpAJfeMw4o8s6U2lvz:1KWZH98PiRLsAtf8AmMHogU2lvz
                MD5:BC778F33480148EFA5D62B2EC85AAA7D
                SHA1:B1EC87CBD8BC4398C6EBB26549961C8AAB53D855
                SHA-256:9D4CF1C03629F92662FC8D7E3F1094A7FC93CB41634994464B853DF8036AF843
                SHA-512:80C1DD9D0179E6CC5F33EB62D05576A350AF78B5170BFDF2ECDA16F1D8C3C2D0E991A5534A113361AE62079FB165FFF2344EFD1B43031F1A7BFDA696552EE173
                Malicious:false
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E......T...T...T...T...TS.U...TZ.U...TS.U...TS.U...TS.U...T..U...T...T.T..U-..T..U...T..uT...T..U...TRich...T........PE..d......^.........." .....(...H.......%..............................................H.....`..............................................N..85..........s........K...j.. .......L.......8............................................ ..8............................text....&.......(.................. ..`.rdata...%...@...&...,..............@..@.data...!M...p...D...R..............@....pdata..TT.......V..................@..@.idata...V... ...X..................@..@.00cfg...............D..............@..@.rsrc...s............F..............@..@.reloc..5............N..............@..B................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\msvcp140.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                Category:dropped
                Size (bytes):590112
                Entropy (8bit):6.461874649448891
                Encrypted:false
                SSDEEP:12288:xI88L4Wu4+oJ+xc39ax5Ms4ETs3rxSvYcRkdQEKZm+jWodEEVh51:xD89rxZfQEKZm+jWodEEP5
                MD5:01B946A2EDC5CC166DE018DBB754B69C
                SHA1:DBE09B7B9AB2D1A61EF63395111D2EB9B04F0A46
                SHA-256:88F55D86B50B0A7E55E71AD2D8F7552146BA26E927230DAF2E26AD3A971973C5
                SHA-512:65DC3F32FAF30E62DFDECB72775DF870AF4C3A32A0BF576ED1AAAE4B16AC6897B62B19E01DC2BF46F46FBE3F475C061F79CBE987EDA583FEE1817070779860E5
                Malicious:false
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........LS..-=..-=..-=.....-=..U...-=..-<.k-=.gB<..-=.gB9..-=.gB>..-=.gB8.=-=.gB=..-=.gB..-=.gB?..-=.Rich.-=.........PE..d.....t^.........." .....@..........."...............................................z....`A.........................................j..h....D..,...............L;...... A......(...@...8...............................0............P.......f..@....................text...,>.......@.................. ..`.rdata..r....P.......D..............@..@.data....:...`..."...N..............@....pdata..L;.......<...p..............@..@.didat..h...........................@....rsrc...............................@..@.reloc..(...........................@..B........................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\msvcp140_1.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                Category:dropped
                Size (bytes):31728
                Entropy (8bit):6.499754548353504
                Encrypted:false
                SSDEEP:384:rOY/H1SbuIqnX8ndnWc95gW3C8c+pBj0HRN7bULkcyHRN7rxTO6iuQl9xiv:yYIBqnMdxxWd4urv
                MD5:0FE6D52EB94C848FE258DC0EC9FF4C11
                SHA1:95CC74C64AB80785F3893D61A73B8A958D24DA29
                SHA-256:446C48C1224C289BD3080087FE15D6759416D64F4136ADDF30086ABD5415D83F
                SHA-512:C39A134210E314627B0F2072F4FFC9B2CE060D44D3365D11D8C1FE908B3B9403EBDD6F33E67D556BD052338D0ED3D5F16B54D628E8290FD3A155F55D36019A86
                Malicious:false
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.{.zl..zl..zl......xl..s...~l.....}l.....xl..zl..Ql......l.....il.....{l.....{l.....{l..Richzl..................PE..d.....t^.........." .........$......p.....................................................`A........................................p>..L....?..x....p.......`..X....:...A......p...P3..8............................3..0............0..@............................text............................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata..X....`.......0..............@..@.rsrc........p.......4..............@..@.reloc..p............8..............@..B........................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\core\_multiarray_tests.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):106496
                Entropy (8bit):6.192836538611655
                Encrypted:false
                SSDEEP:1536:3lSGe/2iH80GUjTyKjT0k2MqIAP2u8vP0TU3s:Vh+GUjTybkpAPp8rs
                MD5:790FE3D0CE7EFA7ADCD93AE3607B26E8
                SHA1:C76A4F99FBCE99A63FB853EBF73F8DB1E2DF2946
                SHA-256:25A240D1217DF88CDF3A8E4A24A40D6B6D3ECC18FD2E33CDD0E84609B1F944E7
                SHA-512:14B469593353590AEF3F4904363DD13D80AD785833326BAF144CA484F231F7B1DA0152ABEF6A6BA1D725AD1D7B6989A1788222B370B5D99894CDD9D5773016B3
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............|..|..|...G..|.....|.....|.*....|.....|.....|.....|.."..|..|.`|.....|.....|.....|...+..|.....|.Rich.|.................PE..d......_.........." .....6...l............................................................`..........................................p.......q..................L...............T....Y...............................Z...............P...............................text...c4.......6.................. ..`.rdata..<4...P...6...:..............@..@.data....!...........p..............@....pdata..L...........................@..@.rsrc...............................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\core\_multiarray_umath.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):2769920
                Entropy (8bit):6.537308891583725
                Encrypted:false
                SSDEEP:49152:/M/cze8S47oWNoUvqUEwdr8yzux14CtFrTyz4/V:WjAqw
                MD5:9330A90D64EE9C286DEF485B7CEA59C6
                SHA1:2B2B8EE50F6D51856CC3A6AF53DAEB3E4DBA52D4
                SHA-256:4F1D6F33FF92E20B39A77BA3B7B92A5E7AD0AC75E8855DCA792F49635FAB41DA
                SHA-512:2DF93157A4623D48C9A4B742C7912D8DDE18DE5777CC689F412DAEDE9E3C7BAB5276DDB1D8034A30CAB174AB3A25F14EC58A219F6C3BA8C58F2E5AB7839817CF
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........y..x*..x*..x*..*..x*..y+..x*..y+..x*CP.*..x*..}+..x*..|+..x*..{+..x*w.y+..x*x.y+..x*..y*..x*x.p+..x*x.x+..x*x..*..x*x.z+..x*Rich..x*........PE..d......_.........." ..........................................................,...........`..........................................".p...`."......P,.......*.H............`,.4".... ............................... ................. ............................text...#........................... ..`.rdata..F...........................@..@.data...0.....".......".............@....pdata..H.....*......d(.............@..@.rsrc........P,.......*.............@..@.reloc..4"...`,..$... *.............@..B................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\fft\_pocketfft_internal.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):112640
                Entropy (8bit):6.177330572145835
                Encrypted:false
                SSDEEP:3072:LA/0iIoEsbAqVXfPkZpQd47ryh8J+s6dY+b6IDaY+Y:8/0SbAukZpQd47GK+HFF8
                MD5:3A33F279076E9800565CA8363B06C0DA
                SHA1:3D7EE1491BDDD80B3C4C850AB3B708D12D445F37
                SHA-256:72FBE745FC7F4D92820024B4FDF62F520A7F6E924D2817CE1728EBB059BB2D08
                SHA-512:51FB4434D7B934870AB1A23461444F7F97598365EA423CE143A5A3EB35045B3C8BF7D128544F5C537BFB80084441AA7DD0486637B44629CA005D0A40ADE3176D
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......RV...7...7...7...O...7..D_...7..sQ...7..D_...7..D_...7..D_...7...i...7...7.."7...^...7...^...7...^...7...^...7..Rich.7..........PE..d......_.........." .........8......d.....................................................`.........................................`...t......................T...............,...0...............................P................................................text...S........................... ..`.rdata..<........ ..................@..@.data...............................@....pdata..T...........................@..@.rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\linalg\_umath_linalg.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):153600
                Entropy (8bit):6.419120291258942
                Encrypted:false
                SSDEEP:1536:CYlNH+NrvsGeowHRMfrdC8+43FxV0cVZpyd0Rse8SzNXw8Y4ngIBdWweH:CYlNSs9owHut+wFxV0K98nmgIBdhg
                MD5:E6CAA96C3F48EFE9CE3472F26B219562
                SHA1:20A50BE130C8E5C2A84E818CB31EA70FB94A835C
                SHA-256:77AA8BFF598695DE66A884CF9D8949A4BA6D6E2CD9FBBF690F2C81619DB50CD4
                SHA-512:90AF523F99DFC56CAB1816EC3E4A666CD9E1E1B14754375B923F4E0ACD8AEA6F14334463C66ABBA11FE44F67F4E0DE5E335E1DE6E12A738F96BC2D23202CF41E
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O..............V=......F.......H......,.i......F.......F.......F.......p.......G..........q....G.......G.......G.......GQ......G......Rich............PE..d......_.........." .........v...........................................................`.........................................@-..h....-...............`..................p...p...................................................(............................text............................... ..`.rdata...=.......>..................@..@.data........@.......&..............@....pdata.......`.......>..............@..@.rsrc................T..............@..@.reloc..p............V..............@..B........................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\linalg\lapack_lite.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):21504
                Entropy (8bit):5.530414151250272
                Encrypted:false
                SSDEEP:384:7FhVUSXgPqAEqjxkcHPA3mrrAnvx0cMYmhw:nVU2gPXjxDnonv4Ymh
                MD5:3051473794F5F8B157EF916D923D777E
                SHA1:96E2F8DFEFB9F62CB3E9169DCC42E66186112F0B
                SHA-256:ED298D41C9602CA2D7B76AE1F1F3BC04943DA737CEEFA3EFA622879790996841
                SHA-512:EF27D84E24BD5C1E49DB8507DD0948CC8B4C96817C135E360217F5008D741E48F7EBF3A011D4422DC636B866C8387C60A071E92FCD1C49936D057E88FFE7508C
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f.j...j...j...c...h...8o..h....a..h...8o..a...8o..b...8o..h....Y..h....n..i...j...W....n..k....n..k....nx.k....n..k...Richj...........PE..d......_.........." .........(......d.....................................................`..........................................G..d...TH..x....p.......`..(...............@...PB..............................pB...............@...............................text....-.......................... ..`.rdata..P....@.......2..............@..@.data...h....P.......B..............@....pdata..(....`.......L..............@..@.rsrc........p.......P..............@..@.reloc..@............R..............@..B........................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\random\_bounded_integers.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):238592
                Entropy (8bit):6.483806960130266
                Encrypted:false
                SSDEEP:3072:T0na8Au2nW0p9zutrqKU+Xlsmbbsgm7A+4oUxph/Vjzutz3A1TQysg36yt:Ia1nx9z4+w1sibb5X/VjmjwTQc6
                MD5:D99AF2345A02F03A1384B6E2CF5E470D
                SHA1:0B7F2E8416269C31C90D3050FBF11628B714A172
                SHA-256:A08B096A2FE82D807B99083F75473EFB9AEB90868F52C8C9A54DFF63ACD13DBA
                SHA-512:C878519670AFF0D102021FCCEF476905E61294EF7E557343380D35B545A753BB4CCB2C16A613BC0A709BE3377987769107513F444C46C16E62DAD6636777E717
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........A.Y. ... ... ...X%.. ...H... ...F... ...H... ...H... ...H... ...~... ... ..3 ...I... ...I... ...I... ...II.. ...I... ..Rich. ..........PE..d......_.........." .................b....................................................`..........................................c......|k..x...............................H....C...............................C...............................................text...C........................... ..`.rdata.............................@..@.data....5....... ...n..............@....pdata..............................@..@.rsrc...............................@..@.reloc..H...........................@..B........................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\random\_common.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):178688
                Entropy (8bit):6.1540655505257815
                Encrypted:false
                SSDEEP:1536:2l2nUZt60F7ZVKAFbICNLDS7r01ngRnMA1ask7VcqKsljTuOaFb8+MFZgDXpcPCM:2lOG1vK2bICvyO+1kFJaFbJXpcPC
                MD5:C85312DF912E34A8FD4BDF336454ECC1
                SHA1:AF8A9D8ACE9A0D776CBE183A9D10A919044687B5
                SHA-256:FBC9FD657DF78DCE9313D8DC1834148AE73187300347FD1B82306052562BD6C3
                SHA-512:E619EADAABCC1D5AE287CA0EE1C2F1F5C8232C779A2375CE9FB2AD7CA0A07511188F8DEA42D3A8E0F47B2D04E59DEF8D7F131A94916308E4EB894E986B016519
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...........P.........................................X.........N...W......W......W.<....W......Rich...........PE..d......_.........." .....4..........d.....................................................`.........................................@q..\....q..d...............................H....]...............................]...............P...............................text...S3.......4.................. ..`.rdata...5...P...6...8..............@..@.data....K.......:...n..............@....pdata..............................@..@.rsrc...............................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\random\_generator.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):646144
                Entropy (8bit):6.316831567097614
                Encrypted:false
                SSDEEP:6144:ra4JYWEkB0sQbOn+aQWo+pWJ46dtjwT+SiSySxeiS+WXSMd5S5SyS/9SZSaSriSg:W4uobowWJDjw56xQrDRM0BsavJ
                MD5:E866BDFB77120B036DCF2CAC7405C853
                SHA1:8EE87BB0E91C9FCB7A6C1F971D115ED4DA8EE913
                SHA-256:30B7992723BDFAC4E4E54585101F356E4A2B816C4AA1B31E8D2E5255ACC50FA2
                SHA-512:4138935A96717F3935A571303643EB1CC529BC318EC4C15B7446E006ED6648AAFE74934412F9F45AD9FE25086F073755DB73C80F5952C131F49768D3F672905E
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*c..n.{.n.{.n.{.gz..f.{.<jz.l.{..dz.l.{.<j~.b.{.<j..f.{.<jx.l.{..\z.m.{.n.z..{..k..k.{..ks.o.{..k{.o.{..k..o.{..ky.o.{.Richn.{.................PE..d......_.........." .........x.......m.......................................@............`.............................................x............ ...........%...........0......`................................................... ............................text.............................. ..`.rdata..............................@..@.data........@......................@....pdata...%.......&..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\random\_mt19937.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):77824
                Entropy (8bit):6.169423227466293
                Encrypted:false
                SSDEEP:1536:bSANk9+gY7gs5zcZ70V4vkWTWPgmdc0Dgs:bPkGf5IZ70V4vkWx0Dd
                MD5:6F3ACA71EA339374899CA9047B2B8E36
                SHA1:AEDFB30252679959CE40D3A3E8DB07A02BC827F7
                SHA-256:D5983C2F4A26C2DC671A92B5C4F7CB46C63844C502C30390670A5019A4125B6F
                SHA-512:918F3D37FE44EE76F5F4237EAE18C51178D0E964C51BA1230C17A08FF6050DD5A0B204E7C4480FF97D0183CB092A846C26C7945E8904C9CC6A2D08AF280035FE
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..]<...<...<...5.L.8...n...>...Y...>...n...0...n...4...n...>.......?...<...........?.......=..... .=.......=...Rich<...................PE..d......_.........." .........~......d.....................................................`.........................................@...`.......x....`.......P...............p..x....................................................................................text............................... ..`.rdata...3.......4..................@..@.data....;.......2..................@....pdata.......P......."..............@..@.rsrc........`.......,..............@..@.reloc..x....p......................@..B........................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\random\_pcg64.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):65024
                Entropy (8bit):5.980786853285234
                Encrypted:false
                SSDEEP:768:R3Q13VEAjbJYEPT+7VKsoTVmsZm0aPVfI2AxvGzetNX2L+w9kZSjYcJ/YIqXcvPp:gVEUF+7gv6194YYcJ/Yeb17dAHPtC
                MD5:4BB9CE84AA35B45E5EE74FC13C9B42CA
                SHA1:F41E5E41E847EFF4C17EBE9FBF202AABE52BC80E
                SHA-256:1B31FB8C8F72A349F6E6301FA7B48D389E95D178398417CD9D013A46D4A4C8A5
                SHA-512:12B4B6039C43575A47FD34EB9DCC6E3206AA89872EC762E88BA5E42EF6C482470EC41E58CA662931F08608F5F668009D3CFEF2C9253A53C3B128E9B2AE373822
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..P<y..<y..<y..5.G.>y..n...>y..Y...>y..n...0y..n...4y..n...>y...'..?y..<y...y......>y......=y....+.=y......=y..Rich<y..................PE..d......_.........." .........l......d........................................P............`.........................................`...\.......d....0....... ..p............@.........................................................X............................text............................... ..`.rdata...&.......(..................@..@.data...H4.......,..................@....pdata..p.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\random\_philox.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):72192
                Entropy (8bit):5.986508207434875
                Encrypted:false
                SSDEEP:1536:yIB2ic560kTG2nakT27hxiX0qWsr+1Gq:yK2ui0T0hxiX0Gr+1L
                MD5:12BA03FD5D6C0CA6E736BF9D6F6C4685
                SHA1:4F1B1BA887EC8B73A170D3CA5BD9D8462D8A70F7
                SHA-256:4D6A35E405FE7039C4B88C31F556B02F84326F7828238C78C7FF1892018B89C8
                SHA-512:489F8E33C0871CCB795D283180F6796E5CEB1E0CDAEF065EDA96839806D3EAE4461CB92E855882AEC6E0FE8CDFD9BD2781CF6B6140F846CE8256E2415C384D4C
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..P<z..<z..<z..5.G.>z..n...>z..Y...>z..n...0z..n...4z..n...>z...$..?z..<z...z......>z......=z....+.=z......=z..Rich<z..........PE..d......_.........." .........z......d........................................p............`.............................................\.......d....P.......@...............`..L...@...............................`...................p............................text............................... ..`.rdata..z(.......*..................@..@.data...h@.......8..................@....pdata.......@......................@..@.rsrc........P......................@..@.reloc..L....`......................@..B................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\random\_sfc64.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):53248
                Entropy (8bit):5.860938878798157
                Encrypted:false
                SSDEEP:768:8cqkigR6k3uj+vBSipT24nzbO9Dgh9gqVVfIXgE2vilKUmZUBUcIrBobaHnJKcmp:Kkik3uyZx2p/nxicbWH+
                MD5:37F2DCA9964651933E341131C5BC8276
                SHA1:E6B12A435C836CD088F2840683C941276B7E532F
                SHA-256:C82BF2E1E90F0B293328C14F1F0B9811CDED0484C311F6DEB72E8C8A122E6104
                SHA-512:DE663548F0576F8A116011E099460A2580997A48394ADD17BE77904D4AE843761986A4DE0C19AF4C77E61C15B3797540B0161D6B9EDFB852BA5941511C952E1A
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y..P=x..=x..=x..4.G.?x..o...?x..X...?x..o...1x..o...5x..o...?x...&..>x..=x...x......?x......<x....+.<x......<x..Rich=x..........................PE..d......_.........." .....|...X......d........................................ ............`.........................................`...\.......d...............P...................@...............................`................................................text...3z.......|.................. ..`.rdata...#.......$..................@..@.data... '....... ..................@....pdata..P...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\random\bit_generator.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):151552
                Entropy (8bit):6.100107488012804
                Encrypted:false
                SSDEEP:3072:fRAMv1X6aXfjCSqs+CILiNwS6Pi2+WarahcWhbZdFkSx2+WarahzZms3T:5RNqqfj+zCILiNkPi2+Warahc4FkSx2f
                MD5:2EF183E96EF80BB399627A24C063D94D
                SHA1:255A8B634CBCF45AABE81ACFF019F4C93E4FEE53
                SHA-256:6C15E698421E952FF9B4CBFFCD3797E56E1BE694BB01B652D816835B9A2A46BD
                SHA-512:841FB9CDA82DAE341B4D6FD94A69BA7D22085E22766351B70FF754C8D4D8F39BF00806D36F45D7DD43C54965F075034D9E85B4C57F8A97C6F1151ACAD93B9B06
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...........p.........................................X.........7...W......W......W......W......Rich...........................PE..d......_.........." .....p..........d.....................................................`.........................................0...h.......d....p.......`..................$....................................................................................text...so.......p.................. ..`.rdata...K.......L...t..............@..@.data...........x..................@....pdata.......`.......8..............@..@.rsrc........p.......H..............@..@.reloc..$............J..............@..B................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\numpy\random\mtrand.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):561152
                Entropy (8bit):6.202499551459795
                Encrypted:false
                SSDEEP:6144:fh36m8oc7i1j9Pr/cDo+KjJQuSxSISPw+SeWkSOKTSpSPuSx+SzS5SQS7SQSKStP:Hxr/pV6oYWLfrHV/NoPNhC1
                MD5:5C13C535D5E3F2A1459A78AACE6D9562
                SHA1:626257B38B53FB715AB2D8121A2F7C45485E2A6A
                SHA-256:0D947A90CAEC87DA431786274B6C4D9F1AE47A28E63209B61551F86EB3D25C2A
                SHA-512:AC5ECD385F7D83C23188A090EB70792669CC3A8C30C07B4B527A5CB8327EDE3E183973F69FA9A8F0B608D02674571750C2E564CBB3DF02BD616CDDE7B32A9946
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x.]<...<...<...5.t.8...n...>...Y...>...n...0...n...4...n...>.......?...<...........?.......=.......=.......=...Rich<...........PE..d......_.........." .....B...j......d.....................................................`.........................................0...........x...............................0................................... ................`...............................text...CA.......B.................. ..`.rdata..L....`.......F..............@..@.data...0...........................@....pdata...............j..............@..@.rsrc...............................@..@.reloc..0...........................@..B................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pyexpat.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):202768
                Entropy (8bit):6.312695764898477
                Encrypted:false
                SSDEEP:3072:nT3d9F9j+gUPNDoqAdeEaUwExv0yOWIkPQXLBLBtpug8FGty+auDomdI8VhHF:jHF1+gUP8deIwEXLIfLB6g8FGJauDom7
                MD5:6500AA010C8B50FFD1544F08AF03FA4F
                SHA1:A03F9F70D4ECC565F0FAE26EF690D63E3711A20A
                SHA-256:752CF6804AAC09480BF1E839A26285EC2668405010ED7FFD2021596E49B94DEC
                SHA-512:F5F0521039C816408A5DD8B7394F9DB5250E6DC14C0328898F1BED5DE1E8A26338A678896F20AAFA13C56B903B787F274D3DEC467808787D00C74350863175D1
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[c.4...g...g...g.z\g...g$\.f...g$\.f...g$\.f...g$\.f...g.\.f...gDj.f...g...gq..g.\.f...g.\.f...g.\0g...g.\.f...gRich...g........PE..d...}.:_.........." .....$...........".......................................P............`.........................................P...P............0...........#...........@..........T...........................P................@...............................text....#.......$.................. ..`.rdata.......@.......(..............@..@.data...............................@....pdata...#.......$..................@..@.gfids....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\_freetype.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):78336
                Entropy (8bit):6.204869863327296
                Encrypted:false
                SSDEEP:1536:VhqhAKcrR/8x06ycBTBaqyuNSrfX8C+0C26cY0X86wSV:LogrR/i06ycBAWETm26cY+xw
                MD5:9965789309173A830BFA9A077FF74620
                SHA1:7E0E0E57DB8F6A35451C8A07F7E01D30C0A7D4BA
                SHA-256:AF0D34EFB97F7F919660BF3F072CD05619044D52443BB7D6A15DA46A3056E123
                SHA-512:BED36C241DDB990777D26C7C66DBAE2C4FB5FDB073F6229FB355BD602E3FB72F25C7AE01405C768B6DD3D5FDDF8E11211A788757F3CCF40D1B02874ADC71D7DB
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................i.........................................v.......P...................l...P......P.......s.......P.......Rich............PE..d....?.a.........." .........~...... .....................................................`.............................................`............p.......P..L....................................................................................................text............................... ..`.rdata...V.......X..................@..@.data...p....0......................@....pdata..L....P......................@..@.gfids.......`.......*..............@..@.rsrc........p.......,..............@..@.reloc..............................@..B........................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\base.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):30208
                Entropy (8bit):5.679638168280965
                Encrypted:false
                SSDEEP:384:mVYWfe3eY7ucEbN00V4X77JL87z0bCtmmRWXQqO5SK14dhi5a7H0EovKsOlAPdQl:mVpDifJ9sSfbdHGwlbzaI3AOAo
                MD5:6957DFFAAECDD72D6104C2927AA58B48
                SHA1:6ACAD377363BE0CC8F7F01115800004A59C9EDAE
                SHA-256:649355AB92FD24B53CD93C032D82ACD8CD4DB0E34828FCEF727B7B088986096F
                SHA-512:F2A01FADDCDC2AE617CCCCD7E6070F277165929826716E6BDB6038494943D7DD9778AA12CB5ABCE41C1F70D779557AB28B3BB49D2D45D0FC99E8A0D9FCA33121
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3^.OR0.OR0.OR0.F*..KR0.t.1.MR0..:1.MR0.t.3.MR0.t.5.DR0.t.4.ER0..;1.MR0..'1.LR0.OR1.%R0...8.NR0...0.NR0.....NR0...2.NR0.RichOR0.........................PE..d....?.a.........." .....>...:......PA....................................................`......................................... g..X...xg..................................d...p^...............................^...............P..`............................text...C=.......>.................. ..`.rdata...#...P...$...B..............@..@.data................f..............@....pdata...............j..............@..@.gfids...............p..............@..@.rsrc................r..............@..@.reloc..d............t..............@..B................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\bufferproxy.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):18432
                Entropy (8bit):5.170811425002114
                Encrypted:false
                SSDEEP:384:newY0rxsa3Cl+38Y5f+0TvTf7BCcMRU8:ewjGzWrWa
                MD5:8135AC817358F25E5CFB4339FBCB1F48
                SHA1:C275AA3339F64C8B4FFB3910B786D1CB293FB51B
                SHA-256:33DB4178156A6EA158CDA0EF3292B331747BFC198556151A4B0581113DEBD5F0
                SHA-512:F125CE9E56351AC3B0BA5FD25669AFA12AE5592F6DC716899599B77E4C0F90E9F2A77D59C54C0E78D78E1D1F7B441B0479813F86DDD58FDA1727EE381D49CECC
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................\................................................"......"........0...."......Rich............................PE..d....?.a.........." .........,......p!....................................................`..........................................<..d...T=..d............`..H...............l...P7..............................p7...............0...............................text...c........................... ..`.rdata..r....0......."..............@..@.data...h....P.......8..............@....pdata..H....`.......>..............@..@.gfids.......p.......B..............@..@.rsrc................D..............@..@.reloc..l............F..............@..B........................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\color.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):35840
                Entropy (8bit):5.73802357017814
                Encrypted:false
                SSDEEP:384:czCH4hXynBaXFm8ztqAOpBD0Qr7rL2rYZr4cYhIYm5CJuw+Tais8z51YcaBhtKBu:qHXupBD02/pYhj+Tais8zgRkfjItDXN
                MD5:0B4838DB9B4E3AE820F25CC9DA70A4D2
                SHA1:253C3D775610D361747DCDE71CAC6D03D6074965
                SHA-256:B6C633094F99FD261F48F9CA9D4ADDB538EA159D0D8BF16089D304402F5BBA4C
                SHA-512:16B73F564E5744938CE9775AD8C5E63B48BDB0609CB54B39A65B030FF1B373C4FF6D05AFCB268D100501969FE4FF9773C1780EDD85F4B5BB581DA4DA4E6B73FE
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V..............C............................................$...............................!./.............Rich............PE..d....?.a.........." .....L...B.......N....................................................`..........................................z..X...hz......................................Pm..............................pm...............`...............................text....J.......L.................. ..`.rdata..F%...`...&...P..............@..@.data................v..............@....pdata...............~..............@..@.gfids..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\constants.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):49152
                Entropy (8bit):5.274247290628612
                Encrypted:false
                SSDEEP:768:jIM9yfKTjm60ahCUCZ/2gPz5/+y2y4nUgb/VyEIc7taN38rw:99yfKTjm8hbK/FPzEnIc7taNm
                MD5:A04FF6997A13DE095BA1C3CF4DD9103E
                SHA1:F7F9CA2C202162774FE86F93B09ACD2EBF2F5601
                SHA-256:0449FC696397091D4AB7119A4F40A118C022C6F0736A3BA79DD896A7111E7A7B
                SHA-512:4E0AF59DC1B0D758A7A810D37854522B0B219E425A48690451320F4D60B3AD5A71817B2874B368D252EC9FA107D9D32B78342707D0F3858A9EE79B2181008828
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*.K..K..K..3..K.....K...#..K.....K.....K.....K..."..K..K..K.. ...K.. ...K....t.K.. ...K..Rich.K..................PE..d....?.a.........." .........>......p........................................ ............`.............................................`... ...d...............................0...0...............................P...................8............................text.............................. ..`.rdata.. -..........................@..@.data...............................@....pdata..............................@..@.gfids..............................@..@.rsrc...............................@..@.reloc..0...........................@..B................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\display.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):44032
                Entropy (8bit):5.783700908556658
                Encrypted:false
                SSDEEP:768:xLapST8QYqxxALGvMCf6hPOHTQAaZh1JnqnwX1hWbg:rT8ap7WOeZhv8ajeg
                MD5:580E19C9A9D58B9EDC2722402CCE4974
                SHA1:7D153FD0EAEC9C3549EFFDE38E9F26F54EE64774
                SHA-256:1A5D2C1379855466463586B49BC61B78C2E2F7C6B3E8ABA2AF99D149BCBCFDB2
                SHA-512:C3081A8B4F54C7D54918F01AE76616DDB3110C90884DE2561630C4387012DB5BA09A928349492ACE525687568C13BCB0D0770CD86EE187315301493925D810A6
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............p...p...p.....p...q...p..q...p...s...p...u...p...t...p.(.q...p..q...p...q...p...x...p...p...p.-.....p...r...p.Rich..p.................PE..d....?.a.........." .....V...X.......Y....................................................`.............................................\............................................................................................p...............................text....U.......V.................. ..`.rdata...;...p...<...Z..............@..@.data...............................@....pdata..............................@..@.gfids..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\draw.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):48128
                Entropy (8bit):6.099628652524892
                Encrypted:false
                SSDEEP:768:u9jFnfN/dACKdHg22tWi7/ogt1kHIMiF2Z3cmP+zZzFqzrYrsG:AVWVzoWi7/ZkHIMicXX0IG
                MD5:6C3AAD01782CFB0A31A752E40F2010C8
                SHA1:FA72B534991202C7AA17FAB4B7A13CD7A0D07C65
                SHA-256:33E7E6ECE451C0762D174E843AEF5B05147EC09DFF6684EAA7801C0EE86831B6
                SHA-512:7D6FCA733D18CE6BF1BDCBAEDCFD3F34376644A63CA0B29EADECE7CD428D50F0699696A049AE0D5AA0310B9E566CA0E6EACF6BE33BEC4EB0AA32EC1A52117646
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Z..............e.........................................h.......................N.......N.......m.......N.......Rich............PE..d....?.a.........." .....~...B......@.....................................................`.........................................0...X...........................................p...................................................@............................text...S|.......~.................. ..`.rdata...&.......(..................@..@.data...............................@....pdata..............................@..@.gfids..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\event.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):40448
                Entropy (8bit):5.665174203175519
                Encrypted:false
                SSDEEP:384:bgkujLBgOY7h3dsAj2jKF7gFkEIHsJfgB0rWNJ6jrkfc75tNU1JDmSov1ZeH/ax8:FuB413iXKR4piu6H/s9Cm1u
                MD5:49837839686BBC2E230A216454A76A56
                SHA1:F4D34957BB75B12ACC778299B193FE2E8EEF789F
                SHA-256:BC14621B41528937C5AA5F5400874A3AF581578709323DB04884A622826EC849
                SHA-512:814AB72985175F48F886C1EF3D6F82BE1B8FC9F3A0C88CC9792AB1BD3D14575DF760FF96E6DE56047D5A6679A9F58155A7E4C41F9F5EE4B1BD2332FE4C6376E8
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-.^.L...L...L...4w..L.......L...$...L.......L.......L.......L..{%...L...9...L...L...L..]....L..]....L..~....L..]....L..Rich.L..........................PE..d....?.a.........." .....Z...F.......\....................................................`.........................................P...X...........................................P...............................p................p...............................text...SY.......Z.................. ..`.rdata...*...p...,...^..............@..@.data...............................@....pdata..............................@..@.gfids..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\font.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):24064
                Entropy (8bit):5.3407998299229
                Encrypted:false
                SSDEEP:384:1x2nVIdaFQqwXS7qCVjFuRtPE840dvihm2uhAfGsuRoIBIArACDcMMg:14YqwXclVjYRvWuu+dEc
                MD5:B5951DEFAA7E26060BC045F85D23FA1B
                SHA1:0F53D11836C2B97230B01668348B6A99802653A6
                SHA-256:846C657C34FD07C360542ED3D78F7782C8D32FC257888ECB5713E40678437C46
                SHA-512:D4747A831F09AE2AF02D7EEF3A2B911CC9F40AE07171B4D104F64C52FDA968CC57D4836D541C05109AA560C1FB9D6620597F8551F7FC87850EBFD3B6E1DD89A8
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........M.{.M.{.M.{.v.z.O.{...z.O.{.v.x.O.{.v.~.F.{.v...D.{..z.O.{.D...I.{...z.N.{.M.z...{...s.L.{...{.L.{....L.{...y.L.{.RichM.{.........PE..d....?.a.........." .....&...:.......*....................................................`..........................................T..X....U.......................................M...............................N...............@..(............................text....%.......&.................. ..`.rdata... ...@..."...*..............@..@.data........p.......L..............@....pdata...............R..............@..@.gfids...............X..............@..@.rsrc................Z..............@..@.reloc...............\..............@..B................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\image.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):28160
                Entropy (8bit):5.791014923696717
                Encrypted:false
                SSDEEP:384:XL4Ltxxz1ugXX2AFovzngbdn17Rpk8mqk+AkB/66RT5ScAwWA7WRwh/TJ1XKcNmb:cBFFqLm1TbRoDwWA7WRKFrmb
                MD5:6F33F326BA1F9A076C5B0A29B4356438
                SHA1:7A5F6924DE9385EE1DCC23FF1D790F1D700F9496
                SHA-256:E136586B6FA61E6F734EF130C8EAF3E1C133A438F2F32816D05037BB682961D0
                SHA-512:D03A811455AD36893600D9FADBB468808667B17AE615F4154BE707BE579ABDF7C3CBCE19C1871F069E290ABF0C48869EAFB9E565316207D2086692F46110B446
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........3'..]t..]t..]t..t..]t..\u..]t..\u..]t..^u..]t..Xu..]t..Yu..]tl.\u..]t..\u..]t..\t..]tJ.Uu..]tJ.]u..]ti..t..]tJ._u..]tRich..]t........................PE..d....?.a.........." .....>...2.......A....................................................`.........................................Pb..X....b..................H...............d....[...............................[...............P...............................text....=.......>.................. ..`.rdata..d....P.......B..............@..@.data...H....p.......`..............@....pdata..H............d..............@..@.gfids...............h..............@..@.rsrc................j..............@..@.reloc..d............l..............@..B................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\imageext.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):19456
                Entropy (8bit):5.3288808221207145
                Encrypted:false
                SSDEEP:384:hipEV3sRR7L9V6MJX9TgedamfBtCX4Zp1DmV4gevhzdcLLc7iz:hKEViRzQyzC4D5mV41dcqi
                MD5:BBCBEE70AD4C438CB6340CED73883521
                SHA1:E31A352986963AFFE0E7DFA754F0ED87B9908F53
                SHA-256:75FD74BEA42276DB6BB468851098A96EE0C76379003F0C9CC7A13C0C9DF07122
                SHA-512:7554A258F9C19C56D53D52BAD7CB07EA5C1A3CD9771301E9854C47D46F981D9D64351483A5FF3B9AA2B28F74CFC806C99218DDB074DE29DBB85BFECA6547E0C3
                Malicious:true
                Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.........._...................................!D...............................................................................|............Rich............................PE..d....?.a.........." ....."...,......P%....................................................`..........................................L..`...0M...............p..................<....F...............................G...............@...............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data........`.......@..............@....pdata.......p.......B..............@..@.gfids...............F..............@..@.rsrc................H..............@..@.reloc..<............J..............@..B........................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\joystick.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):20480
                Entropy (8bit):5.2928685167428196
                Encrypted:false
                SSDEEP:384:ND4c5eVL5VkHPRU13wki2sn+1jbZ4/mb1cMmmmM:Nb5Gt13wkiZ+1u/mf
                MD5:3366202C1EEF51F56E5C26CE31304FA2
                SHA1:413F6AD2E7BEB4823045952961A93F1837B04B2A
                SHA-256:9EC6E0A077BCAD6E67EF9CF0D465749FFD714248ECE25A48BAB065781D11E5AC
                SHA-512:F89A3CE5BA6A40D464317C9B3B72F9342C99B2331AA9EC23CF0D12990A7B847D2F4A9CD7FAA8E945ADF492D85DF39315B58B605C2026F744137B1779BC43B76D
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(..F..F..F......F...G..F..G..F...E..F...C..F...B..F.s.G..F..G..F..G.F.U.N..F.U.F..F.v...F.U.D..F.Rich.F.........PE..d....?.a.........." ..... ...2......."....................................................`.........................................pA..`....A..x............`.......................;...............................;...............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........P.......@..............@....pdata.......`.......F..............@..@.gfids.......p.......J..............@..@.rsrc................L..............@..@.reloc...............N..............@..B................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\key.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):26624
                Entropy (8bit):4.885516034084412
                Encrypted:false
                SSDEEP:384:8rOTgL3DaLkKNrpcVVYMdFuTwgukAtyDT1/vcMABYStqaM6Krt:aLMi7Cwtextohqr6I
                MD5:066A526CB1D816664C2B6A40AE437D72
                SHA1:8899390E5FB6490813C3AF2E3754A213190E3E3D
                SHA-256:E89FBEC8BD486D708A49725C5158C2A748D24BBCA673CB3C906439806777718E
                SHA-512:F2D7DC9303402B83458C47D858E27060DA5933DEA194A1421CCF39AC41DE8AFE877F2DD86AEBC2F4B175C15B7A8DB1E136B116B417341C06F99254E86CDD495F
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............f..f..f......f...g..f..g..f...e..f...c..f...b..f.t.g..f..g..f..g.f.R.n..f.R.f..f.q...f.R.d..f.Rich.f.................PE..d....?.a.........." ....."...J.......%....................................................`..........................................X..T...$Y..x...............................@....S...............................S...............@..0............................text....!.......".................. ..`.rdata...!...@..."...&..............@..@.data........p.......H..............@....pdata...............\..............@..@.gfids...............`..............@..@.rsrc................b..............@..@.reloc..@............d..............@..B........................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\mask.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):56832
                Entropy (8bit):6.188213197887492
                Encrypted:false
                SSDEEP:1536:9ALYaiRq6PZda5jU2zsR4dOKiXUVmBIhbXjDEyHkljcc:9ALYbQ6Pq2P4dOKiXUVmBWXjIyHklo
                MD5:15852767AAB165A1C8FB77ABF6C02F3F
                SHA1:A581AA0338A6D3F4D8301FB3A7C7D3EDF2FCA980
                SHA-256:059142E9690EF8319E27CDF0EF1377D7C7940C83FB6EEEB3D77F6F44919C80DB
                SHA-512:61DB1EAE69B8AF304DEC528A95E56B598FD343184EA112487BA4268722A13A2D17ADCFCA58E33FF2C9FED2A4B69FDD10AEE2D4EF7A41522091005154923B8CFD
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'..Xc...c...c...j.t.e...X...a...8...a...X...a...X...h...X...i.......a...6...`...c...2.......a.......b.......b.......b...Richc...........PE..d....?.a.........." .........N......`........................................0............`.............................................X...h................................ .. ....................................................................................text...c........................... ..`.rdata..4........0..................@..@.data...............................@....pdata..............................@..@.gfids..............................@..@.rsrc...............................@..@.reloc.. .... ......................@..B................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\math.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):67072
                Entropy (8bit):5.986686387118695
                Encrypted:false
                SSDEEP:1536:6OdMMdcUIdLd9t2tFU/8O6nKMGCnq3dbiRr1CH:hdcUMLvMtFL7KMlnq3dbiRI
                MD5:94D6D00B92A6C8BB7FC7A967B189B0F6
                SHA1:D9C2CABB073CD26A0BB59FED9DAFA84C9CD00044
                SHA-256:01CE02EDE8DBBD5BB9665FE9A01A3F25F1B560E745B13BEA6044E93F728FCB9D
                SHA-512:6B0505210489980335015EF925D82A42C87F5C71092C2399E58ECE1B12B24C89778B4864D3C8CC7CFA0359F976B8C394D8F3EEE0744EDA94567DD7B8F769171D
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3..Uw...w...w...~...s...L..u...,..u...L..r...L..|...L..}.......t...w..........v......v.....s.v......v...Richw...................PE..d... ?.a.........." .........~...............................................`............`.........................................p...X.......x....@..........h............P.......................................................................................text............................... ..`.rdata.."I.......J..................@..@.data...............................@....pdata..h...........................@..@.gfids....... ......................@..@_RDATA..0....0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\mixer.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):36352
                Entropy (8bit):5.658295348751267
                Encrypted:false
                SSDEEP:768:oGrr4779GIItgzU/HftuysPesmSUf+SCd:/HteOHfIysPes9UWd
                MD5:E8E827FA0F2A1E519E02173A3275556A
                SHA1:2BD4A884A302DD21DB06A33FAB7DD2307C1BA77A
                SHA-256:C8509D96B07FD913CA4BE44156C6516A9C5B0F962DFE7519DB7A282A24B6A877
                SHA-512:2EFCB44C718A0ADDE7C2FF5915FBE6770E298392FB6E0DEBD917E8A89993FE39F7495C84197252F927B36CEE88C9E8EBCFAE678C65A3D8C0AB7E55786A3D5150
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................1...............................,.....U>........................).].........Rich...........PE..d....?.a.........." .....B...N......pE....................................................`.........................................0...X.......................................T....x...............................x...............`...............................text...cA.......B.................. ..`.rdata.../...`...0...F..............@..@.data................v..............@....pdata..............................@..@.gfids..............................@..@.rsrc...............................@..@.reloc..T...........................@..B........................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\mixer_music.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):20480
                Entropy (8bit):5.321389308193211
                Encrypted:false
                SSDEEP:384:PqvuUSXhqrH2CaBzR8nqAaTvVtEG8cNwniCU:JZT8ncvVtEy+U
                MD5:F0FFF37B28CD80E1138B0D1DAE12826C
                SHA1:0D98044DE21C2C2F31784F031640E86F25E857EA
                SHA-256:4635C4F9E594740DEFCA85097266D59573C6B028C6C09E46FFC23098F49A431E
                SHA-512:7215562D0052C7D8A2EB3F0CAC16146A367FCBE48FB1A85043A8B1F55CB9D44BC8D7B22C6652E4CE44F385A092E48FEC14A5BF5AE8C6DA0DCFB6C90EFE8C5035
                Malicious:true
                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........G.zO&.)O&.)O&.)F^*)M&.)tx.(M&.).N.(M&.)tx.(M&.)tx.(D&.)tx.(E&.).O.(M&.)T.%)M&.).S.(L&.)O&.).&.).x.(N&.).x.(N&.).xF)N&.).x.(N&.)RichO&.)........................PE..d....?.a.........." .....$..........p&....................................................`.........................................0P..d....P...............p..T...................`J...............................J...............@...............................text...c".......$.................. ..`.rdata.......@.......(..............@..@.data...x....`.......B..............@....pdata..T....p.......F..............@..@.gfids...............J..............@..@.rsrc................L..............@..@.reloc...............N..............@..B........................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\mouse.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):19456
                Entropy (8bit):5.213980760489755
                Encrypted:false
                SSDEEP:384:m4n1F8UOM95wBZ1rFtMtxtn4TdhT3L/cMrAU:m4n1F85Myutvczhr7
                MD5:4B8C2DB25033F681BA99A5CDFE218E97
                SHA1:C201863728E1BE3199E3EB5C7EB5591FA1472240
                SHA-256:3098B2D9B751F6F5AD2A91EEC9D8C82F32F37A69C168A2E2C384B30633DA1289
                SHA-512:01D0AA4377921F613F59078DA238C9D66749134715D7D1A57B73FAA744493E9B0D5270484F17D6CCB2695F235F3C5E5271B4EF7F627D69A674B5CBAE9B6B3B02
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3^.OR0.OR0.OR0.F*..KR0.t.1.MR0..:1.MR0.t.3.MR0.t.5.DR0.t.4.ER0..;1.MR0..'1.LR0.OR1..R0...8.NR0...0.NR0.....NR0...2.NR0.RichOR0.........................PE..d....?.a.........." ..... ..........."....................................................`..........................................?..X....?...............`..................l....9...............................9...............0..`............................text............ .................. ..`.rdata.......0.......$..............@..@.data........P.......>..............@....pdata.......`.......B..............@..@.gfids.......p.......F..............@..@.rsrc................H..............@..@.reloc..l............J..............@..B................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\pixelarray.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):45056
                Entropy (8bit):6.064596577114034
                Encrypted:false
                SSDEEP:768:yVp+JVksLW5k4flLN9DgDMEm6lqM78wkPCRZ7UmTlWHQaLCKU2ra76Z+iJXH/wHR:Up+cD8MMq48UbUdKKi6Z3oH
                MD5:6E769E1EA4700A57CA598447072416CB
                SHA1:3419DE4C948A983ACEB93CAC20C5A9EC6DD2A809
                SHA-256:80D0E26C4555617CD346AD50072277D3451376FF6AB02F0980004E3DB21E41C5
                SHA-512:C5C3EA5617F75B23A96355849AE7799F8A3C8865BD27A33D14E79D2ABA0754D29524630B2C16B4599699C927F9F32C795DD151E0B0CFCEE0B1E9E1369AFC0C9F
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Z..............D.........................................h.......................N.......N.......m.(.....N.......Rich....................PE..d....?.a.........." .....t...@.......v....................................................`.........................................@...d...........................................@...............................`................................................text....r.......t.................. ..`.rdata..:%.......&...x..............@..@.data...0...........................@....pdata..............................@..@.gfids..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\pixelcopy.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):26112
                Entropy (8bit):5.761453811981597
                Encrypted:false
                SSDEEP:384:TPQtj2J1h1LU1HYJ0U4QTg/4p0Np4QEMBnFRjTfL7cMynJ:TPQtO/1LRLIXnLrVy
                MD5:49477E3298A73ECA10DFD1F48AAE8758
                SHA1:501F2D4EBEF4200A637504478787D3BB5007A08D
                SHA-256:F933C41E923D885D2AF0368960DB3B814EB15CCC3DC9560E8796D4292CDEFE25
                SHA-512:34EF9AEA9D5E571A4A96BBC47074EA2E612FFAA74BE0D1C661174854A58F740E1C9A77E6A57831A7E3DFD6BC01EA6412F21DE6F934A417E6CD8C944D705C523E
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................^........................................H......................n.......n.......M.2.....n.......Rich............................PE..d... ?.a.........." .....:..........p=....................................................`.........................................@d..`....d..x...............................@....]...............................]...............P...............................text...c9.......:.................. ..`.rdata.......P.......>..............@..@.data...h....p.......Z..............@....pdata...............\..............@..@.gfids...............`..............@..@.rsrc................b..............@..@.reloc..@............d..............@..B................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\rect.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):36864
                Entropy (8bit):5.688408458159711
                Encrypted:false
                SSDEEP:768:qlyQ1yzflz2H+xYeD5uRFc7DYendUdvmy:xDlAoTUd+
                MD5:002124478CD478C6492C3EEB4E3D598C
                SHA1:0729E154BA55A45B02393B8EE3CD1E287B721DDB
                SHA-256:D2BFC8563BB5C1D7C73E727F13D3A8B5A41B32415087EE60BDD70A9945428D2B
                SHA-512:4E56D49ED824B9B9FA02AB40017805B4F38E62E2A04998FCF79043B6600A2DE2905BEAC10CB1D8E810376BA7EF10E491894E247C4510FBD7924E484C7E050ADC
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3^=OR0nOR0nOR0nF*.nKR0nt.1oMR0n.:1oMR0nt.3oMR0nt.5oDR0nt.4oER0n.;1oMR0n.'1oLR0nOR1n.R0n..8oNR0n..0oNR0n...nNR0n..2oNR0nRichOR0n........................PE..d....?.a.........." .....J...H......0M....................................................`..........................................|..X...8}..................................t....r...............................s...............`...............................text...#I.......J.................. ..`.rdata...&...`...(...N..............@..@.data...P............v..............@....pdata..............................@..@.gfids..............................@..@.rsrc...............................@..@.reloc..t...........................@..B................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\rwobject.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):19968
                Entropy (8bit):5.290419159050352
                Encrypted:false
                SSDEEP:384:Sw8SAsxJbWakMKhoYaVYfJMqdop7GvmmkSCFcNQX:r/HkMmE7ok7yQ
                MD5:DC1BC1AABF560371D7E5BA827CF8CDBE
                SHA1:7C565B88C20F0BFD1C6410A14FEAE1676251F2BB
                SHA-256:21641F109D40187A0D4EB83AE170034F7186F8C3329DF09EBAE9CC7C1C465078
                SHA-512:098616473F13B98ABFF65D32ABDA83F601FC3E65CBF673EC4518EAA383CE199F4BC5F45E026582C83D5DE4C400CFB5EEC0ED58CD6A424634E27528D6FE0378D8
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................,............../Tx...................&................................#.@...........Rich....................PE..d....?.a.........." .....$...,.......&....................................................`..........................................N..`...`N...............p..................@....F...............................G...............@...............................text....".......$.................. ..`.rdata.......@.......(..............@..@.data........`.......B..............@....pdata.......p.......D..............@..@.gfids...............H..............@..@.rsrc................J..............@..@.reloc..@............L..............@..B................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\scrap.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):18944
                Entropy (8bit):5.244515673174077
                Encrypted:false
                SSDEEP:384:GsZ9ciXBAQoBQo3HVtdsDKeJRnQTt/gZTheucMWqM5K/:H9ciXBY3AFDNtVWvE
                MD5:31EDC06FCBAA1FEC5AC049AF8432C05D
                SHA1:275BF6E0716F91E90EC7A26098EF12437CC48342
                SHA-256:7B5934C10123FB5CB635984D38B29AD2BEF8E6FDCBF589C34AE1E7A095E8C680
                SHA-512:B6DAA4F56722FB3B33807326FB07EDD6A4E1A30C4EFA1A2D8B539F05A9BAFB8B0E2A774F38A084943AA5CE4BDED7C9B3E98BD82B7934CB5492DE73664A5CEC7A
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........SC.n.C.n.C.n.J...E.n.x.o.A.n.x.m.A.n.x.k.I.n.x.j.I.n..o.A.n...o.G.n...o.@.n.C.o...n..f.B.n..n.B.n....B.n..l.B.n.RichC.n.........PE..d....?.a.........." ..... ...,......."....................................................`.........................................P>..X....>...............`..................X....7...............................7...............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........P.......>..............@....pdata.......`.......@..............@..@.gfids.......p.......D..............@..@.rsrc................F..............@..@.reloc..X............H..............@..B................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\surface.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):220672
                Entropy (8bit):6.3783596774039815
                Encrypted:false
                SSDEEP:3072:QAqOctGdEqVJ//lkjkVk+k9mPmVmTgFcIzMDnZE7:COcuJ//lkjkVk+k9mPmVmTgFcIQDnC7
                MD5:844FF6F5FE453C45E01C922241A9EFC0
                SHA1:4F888AF9CE2BA63286434439A9F275260199F1F6
                SHA-256:4730D706D887DBB74CE835B8C8EAD47AE7CFE1A5EB8D29F50A8D63E9CFFA5CD1
                SHA-512:8D9694D6202289A6566BC83C2DF0EC6ABF855EE23313A73008002BB570D89AEE3BE3A3A0F9318690EFB3081FDB50A16BFEA984979CD76AED95B66C19A51774E1
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5..q...q...q...x.z.u...J...s...*...s...J...s...J...{...J...{.......s...$...r...q...........r.......p.......p.......p...Richq...................PE..d....?.a.........." .........j......P.....................................................`.........................................0I..\....I...............p..t....................:...............................:...............................................text...C........................... ..`.rdata...G.......H..................@..@.data........`.......B..............@....pdata..t....p.......L..............@..@.gfids...............X..............@..@.rsrc................Z..............@..@.reloc...............\..............@..B........................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\surflock.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):13824
                Entropy (8bit):4.748836333842975
                Encrypted:false
                SSDEEP:192:ds9WS9oDgVvpqPrtDmhRvPo24ekyPosKKFAgXU/ZMc6zG:K9t9oDgVBSQhRvsekyoKFAicM3
                MD5:FE35671133B52A43C9A4E3466115CD4A
                SHA1:5F28BCB373FDA9B2EC3EDBC32A0B04E1C41FAEED
                SHA-256:AFAE791424C4B124FBA2F47971FFBDA06CE234CC768EF70E9D91BD3E50792A7A
                SHA-512:23D2C69366FD17CE43D84D5C98C11DBCCCB7B923D9D364A7672FA5DE8E3C1E0591BE5E9BB7481017382218160327D6AB77EB0646887879484338E0C962E73116
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y1...P...P...P...(...P..&....P..F8...P..&....P..&....P..&....P..9...P..H%...P...P..+P......P......P......P......P..Rich.P..........................PE..d....?.a.........." .........$............................................................`..........................................7..`...08..x....p.......P..X...............,....2...............................2...............0...............................text............................... ..`.rdata.......0......................@..@.data........@.......(..............@....pdata..X....P.......,..............@..@.gfids.......`.......0..............@..@.rsrc........p.......2..............@..@.reloc..,............4..............@..B................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\time.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):18944
                Entropy (8bit):5.021063469377741
                Encrypted:false
                SSDEEP:384:am0CMudvllWt2O7s9fpuIEs/iAVEE2HTezx3cMe:amB7otSEs/3E/Hqre
                MD5:6C6B3F80BD877D5DC8E8BA5655C39602
                SHA1:7876923AE8A02D8343D12F85F8489A02343260DB
                SHA-256:AE3D2AD95169FC0B9FCBFF4F631752FE7753CD85D0B1B29BCC71090F04D56ED0
                SHA-512:5817DDDC3AE2B2695197722CC9FA4C0E70F1DFD1CA224C6A3B67527ABDAE760AA9891B50FD8E4F3950D16EB8AB1F4B4D374CD9BE020A1A40C17CB3B166160232
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3^.OR0.OR0.OR0.F*..KR0.t.1.MR0..:1.MR0.t.3.MR0.t.5.DR0.t.4.ER0..;1.MR0..'1.LR0.OR1..R0...8.NR0...0.NR0.....NR0...2.NR0.RichOR0.........................PE..d....?.a.........." ................p ....................................................`.........................................@=..X....=...............`.......................7...............................7...............0..P............................text...c........................... ..`.rdata..n....0......."..............@..@.data...X....P.......:..............@....pdata.......`.......@..............@..@.gfids.......p.......D..............@..@.rsrc................F..............@..@.reloc...............H..............@..B................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\pygame\transform.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):52224
                Entropy (8bit):6.234819540381457
                Encrypted:false
                SSDEEP:768:wLoLurPrJgIlzKqZIyqcerwMpdF6YBf1JmXyEq9D2/rfC2:sgIzpZIierwIdF11k1IETC2
                MD5:CE4431CB9C2FE33DB084795432AFF22B
                SHA1:528E900BAE5C96B37D25B87694B0B29F76FE7758
                SHA-256:54E8B3D2BBB7868202571989F982037F02BC48917AE72F6EB86A3B4BB37B831D
                SHA-512:590B8E380F9C05D8E0AD4FC70D3834DD590E6CF1F22C35BB96E8ABF8A175FFA8B8C96F87F7AE7AA90FE8905B57D3194C9EBFF2F994E3347F223E664B68FAD589
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mgCE...E...E...Lt..C...~R..G....d..G...~R..G...~R..N...~R..O....e..G....y..F...E........R..F...E...D....R..D....R..D....R..D...RichE...................PE..d....?.a.........." .........@......p........................................ ............`.........................................@...`.......................D...................`................................................................................text............................... ..`.rdata...'.......(..................@..@.data...............................@....pdata..D...........................@..@.gfids..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\python3.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):58896
                Entropy (8bit):5.843378110040134
                Encrypted:false
                SSDEEP:768:1iUuRp9VpBLm6g5YuLIE4k8kF/DFz1OuIwfBSCciqy0oeDOm+rENdI8V0eWDG4yv:n5gOqdI8V0jyv
                MD5:274853E19235D411A751A750C54B9893
                SHA1:97BD15688B549CD5DBF49597AF508C72679385AF
                SHA-256:D21EB0FD1B2883E9E0B736B43CBBEF9DFA89E31FEE4D32AF9AD52C3F0484987B
                SHA-512:580FA23CBE71AE4970A608C8D1AB88FE3F7562ED18398C73B14D5A3E008EA77DF3E38ABF97C12512786391EE403F675A219FBF5AFE5C8CEA004941B1D1D02A48
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5H..q)d.q)d.q)d..wl.p)d..wd.p)d..w..p)d..wf.p)d.Richq)d.........PE..d...m.:_.........." ................................................................g.....`.........................................` ............................................... ..T............................................................................text............................... ..`.rdata...... ......................@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\python37.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):3750416
                Entropy (8bit):6.384383088490926
                Encrypted:false
                SSDEEP:49152:KjVpkcACTIK0IKhyn9iafAdH1ZRHLqUCbNSuvYVeP84mzIAA5H0LMznZPMXT7p31:3CTIdKI7UWu4cAgHCMzqNOyVB
                MD5:C4709F84E6CF6E082B80C80B87ABE551
                SHA1:C0C55B229722F7F2010D34E26857DF640182F796
                SHA-256:CA8E39F2B1D277B0A24A43B5B8EADA5BAF2DE97488F7EF2484014DF6E270B3F3
                SHA-512:E04A5832B9F2E1E53BA096E011367D46E6710389967FA7014A0E2D4A6CE6FC8D09D0CE20CEE7E7D67D5057D37854EDDAB48BEF7DF1767F2EC3A4AB91475B7CE4
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........k.y...y...y.......y...'...y......y...'...y...'...y...'...y.......y...y...x..,'..Fy..,'...y..,'...y..,'...y..Rich.y..........................PE..d...c.:_.........." .....8.... .....D.........................................<.......9...`.........................................p....... ?/.|.....;.......9..w... 9.......;..q......T........................... ................P..0............................text....7.......8.................. ..`.rdata.......P.......<..............@..@.data....z...p/......P/.............@....pdata...w....9..x...(7.............@..@.gfids.......p;.......8.............@..@.rsrc.........;.......8.............@..@.reloc...q....;..r....8.............@..B........................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5core.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):6023664
                Entropy (8bit):6.768988071491288
                Encrypted:false
                SSDEEP:98304:hcirJylHYab/6bMJsv6tWKFdu9CLiZxqfg8gwf:+irJylHFb/QMJsv6tWKFdu9CL4xqfg8x
                MD5:817520432A42EFA345B2D97F5C24510E
                SHA1:FEA7B9C61569D7E76AF5EFFD726B7FF6147961E5
                SHA-256:8D2FF4CE9096DDCCC4F4CD62C2E41FC854CFD1B0D6E8D296645A7F5FD4AE565A
                SHA-512:8673B26EC5421FCE8E23ADF720DE5690673BB4CE6116CB44EBCC61BBBEF12C0AD286DFD675EDBED5D8D000EFD7609C81AAE4533180CF4EC9CD5316E7028F7441
                Malicious:false
                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......D.............................UJ......................................................W.....,..................r....................Rich............PE..d...;._.........." ..........-.......-......................................`\.....x.\...`...........................................L..O....T...... \.......U.. ....[......0\..%..,.H.T.....................H.(.....H.0............./.H............................text............................... ..`.rdata..F7%.../..8%.................@..@.data...x....PT..\...6T.............@....pdata... ....U.."....T.............@..@.qtmimed.....0W.......V.............@..P.rsrc........ \.......[.............@..@.reloc...%...0\..&....[.............@..B........................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5dbus.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):436720
                Entropy (8bit):6.392610185061176
                Encrypted:false
                SSDEEP:6144:ZLvnUJ17UTGOkWHUe/W9TgYMDu96ixMZQ8IlXbKgp8aIDeN:KP7cGOGegTwu96ixMZQtlrPN
                MD5:0E8FF02D971B61B5D2DD1AC4DF01AE4A
                SHA1:638F0B46730884FA036900649F69F3021557E2FE
                SHA-256:1AA70B106A10C86946E23CAA9FC752DC16E29FBE803BBA1F1AB30D1C63EE852A
                SHA-512:7BA616EDE66B16D9F8B2A56C3117DB49A74D59D0D32EAA6958DE57EAC78F14B1C7F2DBBA9EAE4D77937399CF14D44535531BAF6F9DB16F357F8712DFAAE4346A
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D..*..*..*.....*...+..*.../..*.......*...)..*...+..*.O.+..*..+...*.O./..*.O.*..*.O....*.....*.O.(..*.Rich.*.........................PE..d...]._.........." .....\...<.......\..............................................K.....`..........................................h..to...................`...Q..............4.......T.......................(...`...0............p...............................text...yZ.......\.................. ..`.rdata..0....p.......`..............@..@.data...X....@......."..............@....pdata...Q...`...R...2..............@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5gui.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):7008240
                Entropy (8bit):6.674290383197779
                Encrypted:false
                SSDEEP:49152:9VPhJZWVvpg+za3cFlc61j2VjBW77I4iNlmLPycNRncuUx24LLsXZFC6FOCfDt2/:BJZzI1ZR3U9Cxc22aDACInVc4Z
                MD5:47307A1E2E9987AB422F09771D590FF1
                SHA1:0DFC3A947E56C749A75F921F4A850A3DCBF04248
                SHA-256:5E7D2D41B8B92A880E83B8CC0CA173F5DA61218604186196787EE1600956BE1E
                SHA-512:21B1C133334C7CA7BBBE4F00A689C580FF80005749DA1AA453CCEB293F1AD99F459CA954F54E93B249D406AEA038AD3D44D667899B73014F884AFDBD9C461C14
                Malicious:false
                Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......QH^~.)0-.)0-.)0-.Q.-.)0-...-.)0-.F4,.)0-.F3,.)0-.F5,.)0-.F1,.)0-.Y1,.)0-.B5,.)0-.B1,.)0-.)1-m,0-.Y4,.)0-.Y5,|(0-.Y0,.)0-.Y.-.)0-.).-.)0-.Y2,.)0-Rich.)0-................PE..d....._.........." ......?...+.....X.?.......................................k.....R.k...`.........................................pKK.....d.e.|....`k.......g.......j......pk..6....F.T................... .F.(.....F.0.............?.p+...........................text...2.?.......?................. ..`.rdata...z&...?..|&...?.............@..@.data....o... f.......f.............@....pdata........g.......f.............@..@.rsrc........`k.......j.............@..@.reloc...6...pk..8....j.............@..B........................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5multimedia.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):746480
                Entropy (8bit):6.260644163524817
                Encrypted:false
                SSDEEP:6144:jLIJMPFfMerCs1uXdHbbbboLxywnY9jnvQz5dm9mMhI/p5PQCf3FR19EjqD0jKds:j+MPFfMervUXzYeg/mR4G
                MD5:01DF79071F9DA0B9B7BDA3DB7FDC8809
                SHA1:6944ACC06F8691A27AA0833D29F0389F0E036BF0
                SHA-256:1A59AE2A9FF768AD6BFB888FE3DD2544E238F0B28DA83CF375EBD803CE713DC4
                SHA-512:486D3F93E56AB50E0C9937E3472762946AFDBB28279818D42081F5784F3AF2DF6D55253D4CF4839601058DCEFB5E543144B91B4572BED96CA9926A0A2AFE5711
                Malicious:false
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q..Q..Q..X.&.Y..E...S.....D.....Y.....U.....U.....V..Q.......$.....P...J.P..Q.".P.....P..RichQ..........PE..d...2.._.........." ...............................................................{.....`.................................................@8.......`..............H.......p.......^..T...................P`..(... _..0...............X............................text...R........................... ..`.rdata..............................@..@.data....3.......(...|..............@....pdata.............................@..@.rsrc........`.......,..............@..@.reloc.......p.......2..............@..B........................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5network.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):1340400
                Entropy (8bit):6.41486755163134
                Encrypted:false
                SSDEEP:24576:eXPn73RXox1U9M0m+1ffSDY565RzHUY1iaRy95hdGehEM:+7hXU1U95m4ff9A5RviaRy9NGI
                MD5:3569693D5BAE82854DE1D88F86C33184
                SHA1:1A6084ACFD2AA4D32CEDFB7D9023F60EB14E1771
                SHA-256:4EF341AE9302E793878020F0740B09B0F31CB380408A697F75C69FDBD20FC7A1
                SHA-512:E5EFF4A79E1BDAE28A6CA0DA116245A9919023560750FC4A087CDCD0AB969C2F0EEEC63BBEC2CD5222D6824A01DD27D2A8E6684A48202EA733F9BB2FAB048B32
                Malicious:false
                Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........Yt..7'..7'..7'...'..7'..3&..7'}.3&..7'}.4&..7'}.2&..7'}.6&..7'..6&..7'0.6&..7'..6'c.7'0.2&2.7'0.7&..7'0..'..7'...'..7'0.5&..7'Rich..7'........................PE..d....._.........." .................................................................c....`......................................... ....n..,...h....................X..........,.......T...................p...(...@...0............................................text...C........................... ..`.rdata...g.......h..................@..@.data...XN...@...2... ..............@....pdata...............R..............@..@.rsrc................>..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5printsupport.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):317424
                Entropy (8bit):6.4458228745525155
                Encrypted:false
                SSDEEP:6144:809B+97t6UOTX3jrhVzgUA2GqWss4G+1gr7pGZmS0bZqXxtUPNs+5o/83+G2jW7:80v4p6UOjzQR0W7
                MD5:61AC08D0E73555352714FF9044130C52
                SHA1:F5FEE2811236640821A2C18C9E2EAADD509C6E62
                SHA-256:783D4F1FEB8DC0BC00ACB8C094D6C1AB39AC6B5858874E60DD3D45677AF4307A
                SHA-512:6ABDBFE5FFBD5C1C1204EDBFCC47F6B1072AA6A5B229901FE9B22CD2E193E7C963C62B8AC3CABEC6467D2440EADDD47214D8F98A06E885822314B98BBCFC2BDE
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Z]..;3.;3.;3.C..;3.JT2.;3.JT6.;3.JT7.;3.JT0.;3.P2.;3..K2.;3.;2.?3..K6.;3..K3.;3..K..;3.;..;3..K1.;3.Rich.;3.........................PE..d...4._.........." .................................................................(....`.........................................0=...q.......................&..............L.......T.......................(...`...0...............( ...........................text...O........................... ..`.rdata.............................@..@.data................p..............@....pdata...&.......(..................@..@.rsrc...............................@..@.reloc..L...........................@..B........................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5qml.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):3591664
                Entropy (8bit):6.333693598000157
                Encrypted:false
                SSDEEP:98304:iPnt09+kVh2NrSdSG779LLLS/o/L4YqoY0Xba+mRRH2T:iPnt2ZVhT
                MD5:D055566B5168D7B1D4E307C41CE47C4B
                SHA1:043C0056E9951DA79EC94A66A784972532DC18EF
                SHA-256:30035484C81590976627F8FACE9507CAA8581A7DC7630CCCF6A8D6DE65CAB707
                SHA-512:4F12D17AA8A3008CAA3DDD0E41D3ED713A24F9B5A465EE93B2E4BECCF876D5BDF0259AA0D2DD77AD61BB59DC871F78937FFBE4D0F60638014E8EA8A27CAF228D
                Malicious:false
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.4...Z...Z...Z......Z..^...Z..Y...Z.._...Z..[...Z...[...Z...[...Z...[...Z..._...Z...Z...Z.......Z......Z...X...Z.Rich..Z.........PE..d......_.........." .....^$..........O$.......................................7.....}.7...`...........................................,......2.......6.......4. .....6.......6..J....).T.....................).(...p.).0............p$..%...........................text....\$......^$................. ..`.rdata......p$......b$.............@..@.data.........3..n....2.............@....pdata.. .....4......l4.............@..@.rsrc.........6......`6.............@..@.reloc...J....6..L...f6.............@..B........................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5qmlmodels.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):438768
                Entropy (8bit):6.312090336793804
                Encrypted:false
                SSDEEP:6144:k1tE6lq982HdyuEZ5gw+VHDZjZ0yOWm7Vdcm4GyasLCZCu6vdQp:k1tEuq9Hdyuo5gwguyOtVIup
                MD5:2030C4177B499E6118BE5B9E5761FCE1
                SHA1:050D0E67C4AA890C80F46CF615431004F2F4F8FC
                SHA-256:51E4E5A5E91F78774C44F69B599FAE4735277EF2918F7061778615CB5C4F6E81
                SHA-512:488F7D5D9D8DEEE9BBB9D63DAE346E46EFEB62456279F388B323777999B597C2D5AEA0EE379BDF94C9CBCFD3367D344FB6B5E90AC40BE2CE95EFA5BBDD363BCC
                Malicious:false
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..<...<...<...5.H.4...(...>.......*.......4.......8.......8......9...<...g....../......=....$.=...<.L.=......=...Rich<...................PE..d...M.._.........." .....(...r......d+..............................................MF....`.........................................0E...^..0................`.. F..................H...T.......................(.......0............@...............................text...N&.......(.................. ..`.rdata.......@.......,..............@..@.data...x/...0...(..................@....pdata.. F...`...H...>..............@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5quick.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):4148720
                Entropy (8bit):6.462183686222023
                Encrypted:false
                SSDEEP:49152:EcDwCQsvkBD+ClI3IAVLA7Tr15SokomoqxQhT2bAssCFEUGX5ig:E7CKPsA3p0Z/QV/sS3Ag
                MD5:65F59CFC0C1C060CE20D3B9CEFFBAF46
                SHA1:CFD56D77506CD8C0671CA559D659DAB39E4AD3C2
                SHA-256:C81AD3C1111544064B1830C6F1AEF3C1FD13B401546AB3B852D697C0F4D854B3
                SHA-512:D6F6DC19F1A0495026CBA765B5A2414B6AF0DBFC37B5ACEED1CD0AE37B3B0F574B759A176D75B01EDD74C6CE9A3642D3D29A3FD7F166B53A41C8978F562B4B50
                Malicious:false
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!Fvge'.4e'.4e'.4l_.4i'.4.H.5m'.4.H.5a'.4.H.5|'.4.H.5c'.4.W.5o'.4qL.5`'.4e'.4.,.4.W.5.'.4.W.5d'.4.W.4d'.4e'.4d'.4.W.5d'.4Riche'.4........................PE..d......_.........." ......%..B......L.$.......................................?.......?...`.........................................0)2.P.....8.T.....>.......<..^...2?.......?.py......T.......................(.......0............ %..\...........................text.....%.......%................. ..`.rdata....... %.......%.............@..@.data....I...@;..2... ;.............@....pdata...^....<..`...R<.............@..@.rsrc.........>.......>.............@..@.reloc..py....?..z....>.............@..B........................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5svg.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):330736
                Entropy (8bit):6.381828869454302
                Encrypted:false
                SSDEEP:6144:6qLZcTC3wR/0JNZ+csBkBv0L0hq+SvcO8MsvwbIeblsjTR:6qNcCwqHE2fYlsPR
                MD5:03761F923E52A7269A6E3A7452F6BE93
                SHA1:2CE53C424336BCC8047E10FA79CE9BCE14059C50
                SHA-256:7348CFC6444438B8845FB3F59381227325D40CA2187D463E82FC7B8E93E38DB5
                SHA-512:DE0FF8EBFFC62AF279E239722E6EEDD0B46BC213E21D0A687572BFB92AE1A1E4219322233224CA8B7211FFEF52D26CB9FE171D175D2390E3B3E6710BBDA010CB
                Malicious:false
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............_._._..*_._,.^._..^._,.^._,.^._,.^._a.^._._=.._a.^._a.^._a.F_._.._._a.^._Rich._................PE..d......_.........." .........................................................@.......^....`.................................................((....... ...........0...........0..H...xL..T....................N..(....L..0............................................text............................... ..`.rdata..p...........................@..@.data...8...........................@....pdata...0.......2..................@..@.rsrc........ ......................@..@.reloc..H....0......................@..B................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5websockets.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):149488
                Entropy (8bit):6.116105454277536
                Encrypted:false
                SSDEEP:3072:4sSkET6pEXb3loojg1Q2sorWvZXF2sorrLA7cG27Qhvvc:4sSd6pwzloDbsnX0sCrc7ct7QVc
                MD5:A016545F963548E0F37885E07EF945C7
                SHA1:CBE499E53AB0BD2DA21018F4E2092E33560C846F
                SHA-256:6B56F77DA6F17880A42D2F9D2EC8B426248F7AB2196A0F55D37ADE39E3878BC6
                SHA-512:47A3C965593B97392F8995C7B80394E5368D735D4C77F610AFD61367FFE7658A0E83A0DBD19962C4FA864D94F245A9185A915010AFA23467F999C833982654C2
                Malicious:false
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'`.CF.KCF.KCF.KJ>.KGF.K.).JAF.KW-.JAF.K.).JVF.K.).JKF.K.).J@F.K.6.JFF.KCF.K.G.K.6.JPF.K.6.JBF.K.6.KBF.KCF.KBF.K.6.JBF.KRichCF.K........................PE..d......_.........." .....$..........t(.......................................p.......5....`............................................."..l........P.......0.......,.......`..L...hw..T....................x..(....w..0............@...............................text....".......$.................. ..`.rdata..z....@.......(..............@..@.data...x...........................@....pdata.......0......................@..@.rsrc........P......."..............@..@.reloc..L....`.......(..............@..B........................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\qt5widgets.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):5498352
                Entropy (8bit):6.619117060971844
                Encrypted:false
                SSDEEP:49152:KO+LIFYAPZtMym9RRQ7/KKIXSewIa/2Xqq1sfeOoKGOh6EwNmiHYYwBrK8KMlH0p:IGoKZdRqJD10rK8KMlH0gi5GX0oKZ
                MD5:4CD1F8FDCD617932DB131C3688845EA8
                SHA1:B090ED884B07D2D98747141AEFD25590B8B254F9
                SHA-256:3788C669D4B645E5A576DE9FC77FCA776BF516D43C89143DC2CA28291BA14358
                SHA-512:7D47D2661BF8FAC937F0D168036652B7CFE0D749B571D9773A5446C512C58EE6BB081FEC817181A90F4543EBC2367C7F8881FF7F80908AA48A7F6BB261F1D199
                Malicious:false
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x..................I.......I.......I.......I...........................................9.................................Rich............PE..d....._.........." ......3..P .......3.......................................T......MT...`.........................................0.D.P^....L.h....pS......0P..8....S.......S.d.....?.T...................`.?.(...0.?.0.............3.._...........................text.....3.......3................. ..`.rdata..8.....3.......3.............@..@.data.........O......dO.............@....pdata...8...0P..:....O.............@..@.rsrc........pS......4S.............@..@.reloc..d.....S......:S.............@..B................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\sdl2.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                Category:dropped
                Size (bytes):2227712
                Entropy (8bit):6.1101676126491045
                Encrypted:false
                SSDEEP:49152:otGVV4xwK5c4rvVO2ard4oZut2BRcfcK:f4GrBGc
                MD5:2F4A57E7A4FF7F6EE01BB07D77D89EBC
                SHA1:A03DE0DFD9C94170559097C5D15EF10E1E1AD8C7
                SHA-256:F34CD90B131CEB45B7F32D41680A13FD4B13E5F48F0D1649CBF441833105310C
                SHA-512:4633E946F6CBEA72B3DD4280BE44279565ED50C36DDD5CEF1498975A3FBDA51FD4EE5A6F54C2D249520AF3B8F4161DAA890C90DC831678B2B6C4BB1A969E91FE
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...%......!..0..u.........Gk..............................".....1\"...`... .......................................!..\...."..-...`"....... ..............p".4...............................(...................|.".x............................text...X...........................`..`.data....Y.......Z..................@....rdata..@....0......................@..@.pdata........ .....................@..@.xdata..L..... ....... .............@..@.bss....P/....!..........................edata...\....!..^...N!.............@..@.idata...-....".......!.............@....CRT....X....@".......!.............@....tls.........P".......!.............@....rsrc........`".......!.............@....reloc..4....p".......!.............@..B................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\sdl2_image.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
                Category:dropped
                Size (bytes):125440
                Entropy (8bit):6.248060009482749
                Encrypted:false
                SSDEEP:3072:6bsejIuO504fzsOM05Nmy7iGpJ7SvFisgf:6bmX0qQOhmyPs
                MD5:B8D249A5E394B4E6A954C557AF1B80E6
                SHA1:B03BB9D09447114A018110BFB91D56EF8D5EC3BB
                SHA-256:1E364AF75FEE0C83506FBDFD4D5B0E386C4E9C6A33DDBDDAC61DDB131E360194
                SHA-512:2F2E248C3963711F1A9F5D8BAEA5B8527D1DF1748CD7E33BF898A380AE748F7A65629438711FF9A5343E64762EC0B5DC478CDF19FBF7111DAC9D11A8427E0007
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...........................j.............................p.......V........ .........................................P.... ..L....P..8.......x............`.............................. @..(...................h#...............................text...............................`.P`.data...............................@.`..rdata...&.......(..................@.`@.pdata..x...........................@.0@.xdata..............................@.0@.bss..................................`..edata..P...........................@.0@.idata..L.... ......................@.0..CRT....X....0......................@.@..tls....h....@......................@.`..rsrc...8....P......................@.0..reloc.......`......................@.0B................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\sdl2_mixer.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
                Category:dropped
                Size (bytes):123904
                Entropy (8bit):6.31428829821482
                Encrypted:false
                SSDEEP:3072:GeCtxSl2NCjItkjr2tXYsxSfbWO1i9ssFo2Bm:GeCtslnsw2YsxSZ1KssFo2B
                MD5:8668D84320ACEE48BC64D080DD66A403
                SHA1:1D61D908BFA16CE80E8947100C5F3F936B579C44
                SHA-256:900EEB69B67266946F541BC6DA5460E6CB9ED4F92816A1710A84625AD123808C
                SHA-512:53A57A3619425ABEF718ABF9836E9980C42F4130AFA1D7875C4AD5BD5333A4D02D8DB8F274619E6932C2A4A8F46A8AB1C56AFF8F7AF4B2536873ECEBE13C6D93
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....V.....................g.............................................. .............................................. .......`..8....... ............p..4........................... P..(....................#...............................text....T.......V..................`.P`.data........p.......Z..............@.`..rdata...=.......>...`..............@.`@.pdata.. ...........................@.0@.xdata..L...........................@.0@.bss..................................`..edata..............................@.0@.idata....... ......................@.0..CRT....X....@......................@.@..tls....h....P......................@.`..rsrc...8....`......................@.0..reloc..4....p......................@.0B................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\sdl2_ttf.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
                Category:dropped
                Size (bytes):33792
                Entropy (8bit):5.651428871159069
                Encrypted:false
                SSDEEP:768:ch6nyBqTviPRGTSJuhrLSA9JT1vZgZDAMABz1w:U6yBqeITSm9HW7F
                MD5:14E57C1868EFC1FB2E4787754E233364
                SHA1:09158212CAF3F7F18E3C5AE65EEE4F7A7796CB62
                SHA-256:507DC8A977D543B3E06BD3FCE41F5759D64B2B21AE829CD2EF41B77BF66968C4
                SHA-512:83C0C9E444888D837B95B687E127C0C82FB177A712442DC4303E9D03B837941787449804EFB8A75A3489CCBDB9165BFEC7F99773CAB819B6B14CAC19EB37752C
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....P.....................q............................................. .........................................................(.......................h........................... ...(.......................p............................text....O.......P..................`.P`.data...P....`.......T..............@.P..rdata.. ....p.......V..............@.P@.pdata...............^..............@.0@.xdata...............d..............@.0@.bss....0.............................`..edata...............h..............@.0@.idata...............n..............@.0..CRT....X............z..............@.@..tls....h............|..............@.`..rsrc...(............~..............@.0..reloc..h...........................@.0B................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\select.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):27152
                Entropy (8bit):6.048170705523046
                Encrypted:false
                SSDEEP:384:FekE2XR1G6sOhmQI2HTRcqJcE99qT3dI8qGvnYPLxDG4y8Z6K9:F9csXHN/d9qT3dI8qGvWDG4yM
                MD5:FB4A0D7ABAEAA76676846AD0F08FEFA5
                SHA1:755FD998215511506EDD2C5C52807B46CA9393B2
                SHA-256:65A3C8806D456E9DF2211051ED808A087A96C94D38E23D43121AC120B4D36429
                SHA-512:F5B3557F823EE4C662F2C9B7ECC5497934712E046AA8AE8E625F41756BEB5E524227355316F9145BFABB89B0F6F93A1F37FA94751A66C344C38CE449E879D35F
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i...`.e.k...R...k...R...j...R...c...R...c......k...2...l...i...R......h......h......h......h...Richi...........................PE..d...v.:_.........." .........4.......................................................C....`.........................................0:..L...|:..x............`.......P..........,....3..T...........................`3...............0...............................text............................... ..`.rdata.......0......."..............@..@.data........P.......6..............@....pdata.......`.......<..............@..@.gfids.......p.......@..............@..@.rsrc................B..............@..@.reloc..,............N..............@..B........................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\ssleay32.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                Category:dropped
                Size (bytes):361984
                Entropy (8bit):6.122702766666827
                Encrypted:false
                SSDEEP:6144:40HTL9wWNf4yMpLc5AdAZSNSxKqpZfyxDEagXPwkqHSu7miSOKIDermsP8CyjzLI:40HTL9wWNf/Mpg5AdAZSNUh/fyxDEagt
                MD5:9DAAB52CECB3107A84062E3FA94945A3
                SHA1:FB8C63FC1E9203915BE82442269A2A63F3D38916
                SHA-256:A62510849ADECDA090F53A132BE49DAA3ACD92B4EACB02D0464F62C06D655AF6
                SHA-512:75F096A146C3E75B2886149E8684E374560DB884256276D2D11B9DB09C78C99EAAC7227A888E7B282A03C2002765F0EF97DA19CD2789C6B6D566E79580E59A24
                Malicious:false
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]..h...;...;...;..U;...;K..:...;v..:...;K..:...;K..:...;K..:...;...:...;...;...;...:+..;...:...;..9;...;...:...;Rich...;........................PE..d...N..].........." .....................................................................`.........................................P'...)...P..........H....p..@&.................. ...T...............................................@............................text............................... ..`.rdata..............................@..@.data........p.......X..............@....pdata..@&...p...(...J..............@..@.rsrc...H............r..............@..@.reloc...............x..............@..B................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exe

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):22602752
                Entropy (8bit):6.416901024594742
                Encrypted:false
                SSDEEP:98304:7lGnit2d4bS4AxCOjmu/uDv08cl9rvTQEO/yocBeaQGbYw5atLgatF4+95Bgw6cq:uEu4AhruL0t/2/34eU5ujtF4+udl
                MD5:D735279B3606F59AAD13FAB2AA9E9CD5
                SHA1:1DDA8FA756C9A706CC2CD7B72593302346094529
                SHA-256:E19E7629BACED5112011C8700999901DB780083DA2BCD4D35C946BF43CC19474
                SHA-512:A8C91E67651B82B3148280D60CF47CF823323A15EF4D5376EFE0ABD18F650ECEF1E599A1214452A55ED9529EE3666128C57606D13FA9E28E7C1411E741EB162F
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........]...3...3...3...0...3...6.s.3...7...3.....3..6...3..7...3..0...3.K.2...3...2...3...2.q.3..p:...3..p1...3.Rich..3.........PE..d.....mf.........."....%......................@.............................._...........`.................................................|K..<.......$...p..P............`_.p....k...............................i..@............ ...............................text............................... ..`.rdata..4U... ...V..................@..@.data...(............h..............@....pdata..P....p......................@..@_RDATA..\....p......................@..@.rsrc...$.........................@..@.reloc..p....`_.......X.............@..B........................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\tcl86t.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):1705120
                Entropy (8bit):6.496511987047776
                Encrypted:false
                SSDEEP:24576:umJTd0nVi/Md3bupZkKBhWPRIlq5YZ6a2CXH7oZgKGc+erWJUVWyubuapwQDlaTR:umJTd4iMwXH7oZgKb++BVL4B+GITgr0h
                MD5:C0B23815701DBAE2A359CB8ADB9AE730
                SHA1:5BE6736B645ED12E97B9462B77E5A43482673D90
                SHA-256:F650D6BC321BCDA3FC3AC3DEC3AC4E473FB0B7B68B6C948581BCFC54653E6768
                SHA-512:ED60384E95BE8EA5930994DB8527168F78573F8A277F8D21C089F0018CD3B9906DA764ED6FCC1BD4EFAD009557645E206FBB4E5BAEF9AB4B2E3C8BB5C3B5D725
                Malicious:false
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k)...GD..GD..GD.bFE..GD9..D..GD.bDE..GD.bBE..GD.bCE..GD.r.D..GD.jAE..GD.jFE..GD..FD..GD.bOE..GD.bGE..GD.b.D..GD.bEE..GDRich..GD........PE..d......\.........." .....d..........0h.......................................@.......b....`..........................................p..._......T.......0.... ............... .......<...............................=...............................................text....b.......d.................. ..`.rdata...k.......l...h..............@..@.data...."..........................@....pdata....... ......................@..@.rsrc...0...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\tk86t.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):1468064
                Entropy (8bit):6.165850680457804
                Encrypted:false
                SSDEEP:24576:J7+Vm6O8hbcrckTNrkhaJVQhWnmb7u/DSe9qT03ZjLmFMoERDY5TUT/tXzddGyIK:JCQ69cYY9JVQWx/DSe9qTqJLUMPsJUT/
                MD5:FDC8A5D96F9576BD70AA1CADC2F21748
                SHA1:BAE145525A18CE7E5BC69C5F43C6044DE7B6E004
                SHA-256:1A6D0871BE2FA7153DE22BE008A20A5257B721657E6D4B24DA8B1F940345D0D5
                SHA-512:816ADA61C1FD941D10E6BB4350BAA77F520E2476058249B269802BE826BAB294A9C18EDC5D590F5ED6F8DAFED502AB7FFB29DB2F44292CB5BEDF2F5FA609F49C
                Malicious:false
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........................................B................R..................Rich..................PE..d......\.........." .........J......@........................................p.......f....`.............................................@@..P>..|........{......,....L.......0...?..`................................................ ..P............................text...c........................... ..`.rdata...?... ...@..................@..@.data........`.......N..............@....pdata..,...........................@..@.rsrc....{.......|..................@..@.reloc...?...0...@..................@..B........................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\unicodedata.pyd

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                Category:dropped
                Size (bytes):1073680
                Entropy (8bit):5.327852618149687
                Encrypted:false
                SSDEEP:12288:ge+YbeoEYa6l0SYxytHcQJJwEI+V/IFx7agsSJNzkRoEVnOPmrZ6bK:ge+BN6axoc1r+VUx7agnNctOo6K
                MD5:4D3D8E16E98558FF9DAC8FC7061E2759
                SHA1:C918AB67B580F955B6361F9900930DA38CEC7C91
                SHA-256:016D962782BEAE0EA8417A17E67956B27610F4565CFF71DD35A6E52AB187C095
                SHA-512:0DFABFAD969DA806BC9C6C664CDF31647D89951832FF7E4E5EEED81F1DE9263ED71BDDEFF76EBB8E47D6248AD4F832CB8AD456F11E401C3481674BD60283991A
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........VQx..Qx..Qx..X.O.Wx..j&..Sx..j&..Sx..j&..Zx..j&..[x...&..Rx......Sx..Qx...x...&..Px...&..Px...&#.Px...&..Px..RichQx..........................PE..d...w.:_.........." .....@..........h5....................................................`..........................................b..X...Hc.......p.......P..X....H..............`u..T............................u...............P..8............................text...Q?.......@.................. ..`.rdata.......P.......D..............@..@.data........p.......`..............@....pdata..X....P......................@..@.gfids.......`.......8..............@..@.rsrc........p.......:..............@..@.reloc...............F..............@..B........................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\vcruntime140.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                Category:dropped
                Size (bytes):87864
                Entropy (8bit):6.50974924823557
                Encrypted:false
                SSDEEP:1536:JiOTTyNdd/mqN5fomseOpLJ5UP4nVnWecbtGgcNZVKL:JD4Vzgh5UXecbt2ju
                MD5:89A24C66E7A522F1E0016B1D0B4316DC
                SHA1:5340DD64CFE26E3D5F68F7ED344C4FD96FBD0D42
                SHA-256:3096CAFB6A21B6D28CF4FE2DD85814F599412C0FE1EF090DD08D1C03AFFE9AB6
                SHA-512:E88E0459744A950829CD508A93E2EF0061293AB32FACD9D8951686CBE271B34460EFD159FD8EC4AA96FF8A629741006458B166E5CFF21F35D049AD059BC56A1A
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......).uym~.*m~.*m~.*...*o~.*d..*f~.*m~.*F~.*V .+n~.*V .+g~.*V .+f~.*V .+s~.*V .+l~.*V .*l~.*V .+l~.*Richm~.*........PE..d....Z.........." .........T......@........................................p......m.....`A........................................0...4...d........P.......0..........8?...`..p...p...8............................................................................text...'........................... ..`.rdata..f5.......6..................@..@.data........ ......................@....pdata.......0......................@..@_RDATA.......@......................@..@.rsrc........P......................@..@.reloc..p....`......................@..B........................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\vcruntime140_1.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                Category:dropped
                Size (bytes):44528
                Entropy (8bit):6.627837381503075
                Encrypted:false
                SSDEEP:384:Aim/NRETi8kykt25HwviU5fJUiP2551xWmbTqOA7SXf+Ny85xM8ATJWr3KWoC8cS:0Ie8kySL2iPQxdvjAevcMESW5lxJG
                MD5:6BC084255A5E9EB8DF2BCD75B4CD0777
                SHA1:CF071AD4E512CD934028F005CABE06384A3954B6
                SHA-256:1F0F5F2CE671E0F68CF96176721DF0E5E6F527C8CA9CFA98AA875B5A3816D460
                SHA-512:B822538494D13BDA947655AF791FED4DAA811F20C4B63A45246C8F3BEFA3EC37FF1AA79246C89174FE35D76FFB636FA228AFA4BDA0BD6D2C41D01228B151FD89
                Malicious:false
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ .S.A...A...A..0.m..A..O....A...9...A...A...A..O....A..O....A..O....A..O....A..O.}..A..O....A..Rich.A..................PE..d.....t^.........." .....:...4......pA...............................................Z....`A.........................................j......|k..x....................l...A......8....b..8...........................@b..0............P..X............................text....9.......:.................. ..`.rdata... ...P..."...>..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..8............j..............@..B........................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\zlib1.dll

                Download File
                Process:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                File Type:PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
                Category:dropped
                Size (bytes):108544
                Entropy (8bit):6.422076432206121
                Encrypted:false
                SSDEEP:3072:wLmjK8n5MYk+NqZSB23eRenGvTBfs9Yy0J:wLl8n5MYCjFnaTBwYy0
                MD5:5EAC41B641E813F2A887C25E7C87A02E
                SHA1:EC3F6CF88711EF8CFB3CC439CB75471A2BB9E1B5
                SHA-256:B1F58A17F3BFD55523E7BEF685ACF5B32D1C2A6F25ABDCD442681266FD26AB08
                SHA-512:CAD34A495F1D67C4D79ED88C5C52CF9F2D724A1748EE92518B8ECE4E8F2FE1D443DFE93FB9DBA8959C0E44C7973AF41EB1471507AB8A5B1200A25D75287D5DE5
                Malicious:true
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....&.....................b.............................@................ .........................................|.......x.... .......................0.............................. ...(....................................................text....%.......&..................`.P`.data...P....@.......*..............@.P..rdata...Q...P...R...,..............@.`@.pdata...............~..............@.0@.xdata..l...........................@.0@.bss..................................`..edata..|...........................@.0@.idata..x...........................@.0..CRT....X...........................@.@..tls....h...........................@.`..rsrc........ ......................@.0..reloc.......0......................@.0B................................................................................................................................

                C:\Users\user\AppData\Local\Temp\rkn.exe

                Download File
                Process:C:\Windows\SysWOW64\rundll32.exe
                File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                Category:dropped
                Size (bytes):47104
                Entropy (8bit):6.948416585892318
                Encrypted:false
                SSDEEP:768:iq6bYI7ev0DeJpFgjzjW8SGJVnxsJ/cS7iKGztVuanh8w2OfJ7ejaP6yEqzeGO0I:iXbWv04jgXjW8PHccS7i9u6yeNejY6ys
                MD5:4B683807246FC18189D63DD9A4E9429F
                SHA1:1DED192558723EBE1DE20B099343DA06D6A215C5
                SHA-256:BA77B5949CA2198459C7F2F260C1B57AF93F4B3466F8278BFCAB114C9E0B2D79
                SHA-512:7B177DE3ADB54FE049E5A4D927957008F4829A46FC6C8206657F5BC6435F079A6E47FD3FFCCFD03D6F40F125855659B3380E9C33C1EDA0E7E5D14180CA761377
                Malicious:true
                Yara Hits:
                • Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\rkn.exe, Author: unknown
                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h..S,.x.,.x.,.x.%...&.x.~.}.?.x.~.|. .x.~.{.-.x.~.y.(.x.g.y.).x.,.y...x...q.-.x.....-.x...z.-.x.Rich,.x.................PE..L...m]nf..................................... ....@.......................................@..................................%..................................p...,!..p............................!..@............ ...............................text...)........................... ..`.rdata..t.... ......................@..@.data.......0....... ..............@....rsrc...............................@..@.reloc..p...........................@..B................................................................................................................................................................................................................................................................................................................

                C:\Users\user\AppData\Local\Temp\unity.pdf

                Download File
                Process:C:\Users\user\AppData\Local\Temp\rkn.exe
                File Type:PDF document, version 1.7, 4 pages
                Category:dropped
                Size (bytes):86196
                Entropy (8bit):7.87858938350625
                Encrypted:false
                SSDEEP:1536:hBhksShBntb0liRZmRKIQh13cqT+Mve6US2c6fGJ76c3oW9CMJ6yd:lk1N9bRZmRDQuUPe6US2c6No9CM3
                MD5:CC4676EF08E8AECBE22B9232F27B2141
                SHA1:03BB3A2CB2C8A5CF7B93CF7C666C470144CFD724
                SHA-256:48331EA4E205E07525F47149D19C8F78DBA24EE63147A74F7D0A443008E4587D
                SHA-512:A27DAEF2DB426114F9B45F9EAD7C0CF5E6C84389570E51C749C9CE9BAD8AB6D2C866C54A291FA5A6D83AB7B476A00E9AD4729C92ED53B5371AF7E2382CCBEC96
                Malicious:false
                Preview:%PDF-1.7.%.....2 0 obj.<</Length 3 0 R/Filter/FlateDecode>>.stream.x..XK..G...(.-..R.....n.....B...6.8f..I.}$..3.x.Nou=.O.>.Fv .><<..~...W1.;......*..m....@.......?.?...zx.}.....$.0.....^>.......cb.t...a...8.... ...H+.}/.....2J'..s....<..p...FN ....c..4....O..|x..:?.........o1...*.b........b..h........G5>..I.....M.9..H.....34.<..#..qV.=.V.|..y.....q&8|.<.ox..q<..Az.7.....g}...F...a.H.....b:..C..t.......;.Y....D..o...........F..q.'..#.h....A...$rH2..(.V......1.ML4....0......-.>+.S`....e.zC~.ls.1..>A..F@...3..,D.+...b.xo...Ekh.e.oca.XxL..~.8.=.*[...(3fQ........^[..M.\.T%;}!..$.,..{.......@.<E2G...g{.y.g..J^y[DEq./|..)....ce..... .............q.m...L..*{..X.A3VA^.....`m...=..I"#s..e.%5. .8k..XOJh...]"Tr.d.-s.s..3.6>.....s.B..a.8-.6....~....21.j...."A.....Vz;.j....a.&*..L.......x...dd..T......9..e.\.....oZ..DaS./..lN2j*E......p......2....s.`3........A_k.U.fN.....Y9..~...b.4...:..N..K..R.t.2.S ..Q..M....E.J!.YN.[.o.tN.f=....r...w..ud...Iq..j;

                C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:data
                Category:dropped
                Size (bytes):85893
                Entropy (8bit):6.4285188239971465
                Encrypted:false
                SSDEEP:1536:Lh3s60i02RwxwFnZNt0zfIagnbSLDII+DY:LVs/i0C4IZN+gbE8pDY
                MD5:B7A9A5A223B9DCE0E7D10E2B32A0BA07
                SHA1:FFB925FA80873CF50D8CB6DA530BA8CD7F0D9922
                SHA-256:4EF52E63D45F5230C47DBD3764AA90768F708B24885579375724473BB3FFB255
                SHA-512:A46488535961F26B7E41E1BA98E2015627917366BE08B172B0A5377E5A4EC1C0BD14F1A4E2473B5831A7538B3554E818FE3349DA42C0F40E03B3474EC77532F4
                Malicious:false
                Preview:0..O.0..Mg...0...*.H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240403114831Z..240410114831Z0..L.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...*B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!......S....fNj'.wy..210602000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

                C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

                Download File
                Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                File Type:data
                Category:dropped
                Size (bytes):737
                Entropy (8bit):7.5099882082938105
                Encrypted:false
                SSDEEP:12:yeRLaWQMnFQlRmyOFfBS9i7u8meIHKbw2O9TrU/Y/QmpFlT1xaOu8OAbsHqvNDVk:y2GWnSmyOtci7umNbQ9TrUw/QmxT1xsD
                MD5:152F65AAA856C44E87C8ED561AE43C0F
                SHA1:B6440383DBC4D3446E91CBB58EEB8C8BD6671F50
                SHA-256:48AC59FC9FA38016B6D5A4CB5D89A2C0CABCD8A0404AF29FBE995B4AA647A292
                SHA-512:106287A2EA36511D229E6991638D99B796B24B05D4BC8AE75BE5E9B79EA7A324330A26B3B4028FC4A8523FB82D7E3F9A793AE0E9C1F377939956C5667E44381E
                Malicious:false
                Preview:0...0.....0...*.H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240401194722Z..240422194722Z.00.0...U.#..0.......q]dL..g?....O0...U........0...*.H............._..T...?..G).L/..K..5...3.j(..G.D0...>...bH.p.O{..Y....^.]I.G......~r.Ye...Sy...*..X...1........8'../...O...P;QO.-O.BUq......1s..(,....v....*L.q..H.6j %..R.p..H..).;vt.....6...r]/.....4.%....G....J..3Y.....d....N....tu...q....2.wm..$...d...w...G?..h.?.+E...$d.........80X45[...A.7,.....s`...sS.g.]...].i...y].bu.U.......AP....T.d!...eB.`...u.....Z....&.....*$mY..q7.;.5..s..x.$.._..5.W..F?p@.+Ud-...&'...po$..4R7L.`.g.......J...........h...M(./>)..;.g....B..F.?>...Q{%.i.....!lm||..cxb..

                \Device\Null

                Download File
                Process:C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exe
                File Type:ASCII text, with CRLF line terminators
                Category:dropped
                Size (bytes):289
                Entropy (8bit):5.156721778700509
                Encrypted:false
                SSDEEP:6:fFN3vPINwkn23fARBA6RNwkn23fARBAmGwq5MtfrDRd+rg:f7f4sf4Iwq5obn
                MD5:DE027C8AC18269DAF2B284463324BE83
                SHA1:FAF53E7F87F094B2962E7482FEE7DF7DA2A1BC8A
                SHA-256:73C0B7807F591B87D3337E5E10543E58189B100586E73B717D724844FCC092A0
                SHA-512:1BE57A4B0213191B3C6C0040D30B21FA41902ECC74DED81CB57BCDED56A1B20B0C4F1BF5EDD4E918345879C325C36A4118F41AE7C8983E880C020A3A1A1D05E1
                Malicious:false
                Preview:Traceback (most recent call last):.. File "C:\Users\user\AppData\Local\Temp\ONEFIL~1\staged_out.py", line 42, in <module>.. File "C:\Users\user\AppData\Local\Temp\ONEFIL~1\staged_out.py", line 9, in extract_bytes2..FileNotFoundError: [Errno 2] No such file or directory: 'image1.jpg'..

                Static File Info

                General

                File type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                Entropy (8bit):5.158356107957075
                TrID:
                • Win32 Dynamic Link Library (generic) (1002004/3) 99.60%
                • Generic Win/DOS Executable (2004/3) 0.20%
                • DOS Executable Generic (2002/1) 0.20%
                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                File name:FFbd.dll
                File size:10'240 bytes
                MD5:ff70a29ec9361ec5c5107788dfa3fcb3
                SHA1:3a8206eba21c66c2955f970dbb8ceac36dbab917
                SHA256:87904f0d8a76ca68a802faa3987df9490b8bd213937c9028afe6089f036a864c
                SHA512:3b8b43f54332027a7dd56283a13dd998793a9ca2b32df6d128708e813b01d02ceccf77c4ad23449ad62b0bd5d5aa4fe7123afee6c1aba74d5b86a78833e6a1ee
                SSDEEP:192:OECWJBPHhqt33bXvFQWyjOvp/C2j3WzMVft4L:O0hwt3btsj4p/rj3WCfu
                TLSH:0B222A82FE0446B6EA6901323477863A876CFA345FE55D43FB13E60908262D1BD35DAE
                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.[7.g5d.g5d.g5d...d.g5dG.4e.g5dG.0e.g5dG.1e.g5dG.6e.g5d^.4e.g5d.g4d:g5d..<e.g5d..5e.g5d...d.g5d..7e.g5dRich.g5d...............

                File Icon

                Icon Hash:7ae282899bbab082

                Static PE Info

                General

                Entrypoint:0x10001682
                Entrypoint Section:.text
                Digitally signed:false
                Imagebase:0x10000000
                Subsystem:windows gui
                Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
                DLL Characteristics:DYNAMIC_BASE, NX_COMPAT
                Time Stamp:0x666E5DAB [Sun Jun 16 03:36:11 2024 UTC]
                TLS Callbacks:
                CLR (.Net) Version:
                OS Version Major:6
                OS Version Minor:0
                File Version Major:6
                File Version Minor:0
                Subsystem Version Major:6
                Subsystem Version Minor:0
                Import Hash:472c0afeb8cf617f8176b68d6ff4e0bd

                Entrypoint Preview

                Instruction
                push ebp
                mov ebp, esp
                cmp dword ptr [ebp+0Ch], 01h
                jne 00007F88DCC81EF7h
                call 00007F88DCC82079h
                push dword ptr [ebp+10h]
                push dword ptr [ebp+0Ch]
                push dword ptr [ebp+08h]
                call 00007F88DCC81DA3h
                add esp, 0Ch
                pop ebp
                retn 000Ch
                push ebp
                mov ebp, esp
                push 00000000h
                call dword ptr [1000304Ch]
                push dword ptr [ebp+08h]
                call dword ptr [10003050h]
                push C0000409h
                call dword ptr [10003048h]
                push eax
                call dword ptr [10003044h]
                pop ebp
                ret
                push ebp
                mov ebp, esp
                sub esp, 00000324h
                push 00000017h
                call dword ptr [10003040h]
                test eax, eax
                je 00007F88DCC81EF7h
                push 00000002h
                pop ecx
                int 29h
                mov dword ptr [10004128h], eax
                mov dword ptr [10004124h], ecx
                mov dword ptr [10004120h], edx
                mov dword ptr [1000411Ch], ebx
                mov dword ptr [10004118h], esi
                mov dword ptr [10004114h], edi
                mov word ptr [10004140h], ss
                mov word ptr [10004134h], cs
                mov word ptr [10004110h], ds
                mov word ptr [1000410Ch], es
                mov word ptr [10004108h], fs
                mov word ptr [10004104h], gs
                pushfd
                pop dword ptr [10004138h]
                mov eax, dword ptr [ebp+00h]
                mov dword ptr [1000412Ch], eax
                mov eax, dword ptr [ebp+04h]
                mov dword ptr [00004130h], eax

                Rich Headers

                Programming Language:
                • [IMP] VS2008 SP1 build 30729

                Data Directories

                NameVirtual AddressVirtual Size Is in Section
                IMAGE_DIRECTORY_ENTRY_EXPORT0x36600x48.rdata
                IMAGE_DIRECTORY_ENTRY_IMPORT0x36a80x8c.rdata
                IMAGE_DIRECTORY_ENTRY_RESOURCE0x50000xf8.rsrc
                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                IMAGE_DIRECTORY_ENTRY_BASERELOC0x60000x180.reloc
                IMAGE_DIRECTORY_ENTRY_DEBUG0x31980x70.rdata
                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x32080x40.rdata
                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                IMAGE_DIRECTORY_ENTRY_IAT0x30000xb0.rdata
                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                Sections

                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                .text0x10000x106b0x1200fe6ea84ae81bf518f0ac1b1a95efdfb6False0.5831163194444444COM executable for DOS5.877702727235797IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                .rdata0x30000xb780xc00556001c6423ab2aa70cc37d52c3915c0False0.4303385416666667data4.355577703366855IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                .data0x40000x39c0x2003daece0110e8b3671b990d52a1a0ab2dFalse0.0546875data0.26546687076190567IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                .rsrc0x50000xf80x200363d86a144062b41d123c32b4b5cf515False0.3359375data2.5119620156497993IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                .reloc0x60000x1800x200254f0214a77c46cdf221e12d089146d7False0.7734375data5.352463600576371IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                Resources

                NameRVASizeTypeLanguageCountryZLIB Complexity
                RT_MANIFEST0x50600x91XML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.8689655172413793

                Imports

                DLLImport
                KERNEL32.dllGetTempPathW, CreateFileW, WriteFile, CloseHandle, CopyFileW, ExpandEnvironmentStringsW, CreateProcessW, WaitForSingleObject, Sleep, IsDebuggerPresent, InitializeSListHead, DisableThreadLibraryCalls, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, IsProcessorFeaturePresent, TerminateProcess, GetCurrentProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter
                WININET.dllInternetCloseHandle, InternetReadFile, InternetOpenW, InternetOpenUrlW
                SHLWAPI.dllPathCombineW
                VCRUNTIME140.dllmemset, __std_type_info_destroy_list, _except_handler4_common
                api-ms-win-crt-stdio-l1-1-0.dll__stdio_common_vswprintf_s
                api-ms-win-crt-runtime-l1-1-0.dll_initialize_narrow_environment, _seh_filter_dll, _initterm, _cexit, _initialize_onexit_table, _initterm_e, _configure_narrow_argv, _execute_onexit_table

                Exports

                NameOrdinalAddress
                apt6610x10001040

                Possible Origin

                Language of compilation systemCountry where language is spokenMap
                EnglishUnited States

                Network Behavior

                ⊘No network behavior found

                Statistics

                CPU Usage

                Click to jump to process

                Memory Usage

                Click to jump to process

                High Level Behavior Distribution

                Click to dive into process behavior distribution

                Behavior

                Click to jump to process

                System Behavior

                General

                Target ID:0
                Start time:00:58:54
                Start date:05/07/2024
                Path:C:\Windows\System32\loaddll32.exe
                Wow64 process (32bit):true
                Commandline:loaddll32.exe "C:\Users\user\Desktop\FFbd.dll"
                Imagebase:0x8d0000
                File size:126'464 bytes
                MD5 hash:51E6071F9CBA48E79F10C84515AAE618
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:1
                Start time:00:58:54
                Start date:05/07/2024
                Path:C:\Windows\System32\conhost.exe
                Wow64 process (32bit):false
                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Imagebase:0x7ff7699e0000
                File size:862'208 bytes
                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:2
                Start time:00:58:54
                Start date:05/07/2024
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\FFbd.dll",#1
                Imagebase:0x240000
                File size:236'544 bytes
                MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:3
                Start time:00:58:54
                Start date:05/07/2024
                Path:C:\Windows\SysWOW64\rundll32.exe
                Wow64 process (32bit):true
                Commandline:rundll32.exe C:\Users\user\Desktop\FFbd.dll,apt66
                Imagebase:0x2b0000
                File size:61'440 bytes
                MD5 hash:889B99C52A60DD49227C5E485A016679
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:4
                Start time:00:58:54
                Start date:05/07/2024
                Path:C:\Windows\SysWOW64\rundll32.exe
                Wow64 process (32bit):true
                Commandline:rundll32.exe "C:\Users\user\Desktop\FFbd.dll",#1
                Imagebase:0x2b0000
                File size:61'440 bytes
                MD5 hash:889B99C52A60DD49227C5E485A016679
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:5
                Start time:00:58:57
                Start date:05/07/2024
                Path:C:\Windows\SysWOW64\rundll32.exe
                Wow64 process (32bit):true
                Commandline:rundll32.exe "C:\Users\user\Desktop\FFbd.dll",apt66
                Imagebase:0x2b0000
                File size:61'440 bytes
                MD5 hash:889B99C52A60DD49227C5E485A016679
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high
                Has exited:true

                General

                Target ID:6
                Start time:00:58:58
                Start date:05/07/2024
                Path:C:\Users\user\AppData\Local\Temp\rkn.exe
                Wow64 process (32bit):true
                Commandline:"C:\Users\user\AppData\Local\Temp\rkn.exe"
                Imagebase:0x580000
                File size:47'104 bytes
                MD5 hash:4B683807246FC18189D63DD9A4E9429F
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Yara matches:
                • Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000006.00000000.1716817368.0000000000583000.00000008.00000001.01000000.00000005.sdmp, Author: unknown
                • Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000006.00000002.2394995201.00000000014F0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000006.00000002.2394739280.0000000000584000.00000008.00000001.01000000.00000005.sdmp, Author: unknown
                • Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\rkn.exe, Author: unknown
                Reputation:low
                Has exited:true

                General

                Target ID:7
                Start time:00:58:58
                Start date:05/07/2024
                Path:C:\Users\user\AppData\Local\Temp\rkn.exe
                Wow64 process (32bit):true
                Commandline:"C:\Users\user\AppData\Local\Temp\rkn.exe"
                Imagebase:0x580000
                File size:47'104 bytes
                MD5 hash:4B683807246FC18189D63DD9A4E9429F
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Yara matches:
                • Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000007.00000002.1859570340.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000007.00000002.1859480878.0000000000584000.00000008.00000001.01000000.00000005.sdmp, Author: unknown
                • Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000007.00000000.1720009194.0000000000583000.00000008.00000001.01000000.00000005.sdmp, Author: unknown
                Reputation:low
                Has exited:true

                General

                Target ID:8
                Start time:00:59:00
                Start date:05/07/2024
                Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                Wow64 process (32bit):false
                Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\unity.pdf"
                Imagebase:0x7ff6bc1b0000
                File size:5'641'176 bytes
                MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:moderate
                Has exited:false

                General

                Target ID:9
                Start time:00:59:01
                Start date:05/07/2024
                Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                Wow64 process (32bit):false
                Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
                Imagebase:0x7ff74bb60000
                File size:3'581'912 bytes
                MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:moderate
                Has exited:false

                General

                Target ID:10
                Start time:00:59:01
                Start date:05/07/2024
                Path:C:\Users\user\AppData\Local\Temp\rkn.exe
                Wow64 process (32bit):true
                Commandline:"C:\Users\user\AppData\Local\Temp\rkn.exe"
                Imagebase:0x580000
                File size:47'104 bytes
                MD5 hash:4B683807246FC18189D63DD9A4E9429F
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Yara matches:
                • Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000000A.00000002.1906067523.0000000001510000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000000A.00000002.1905614691.0000000000584000.00000008.00000001.01000000.00000005.sdmp, Author: unknown
                • Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000000A.00000000.1748245426.0000000000583000.00000008.00000001.01000000.00000005.sdmp, Author: unknown
                Reputation:low
                Has exited:true

                General

                Target ID:12
                Start time:00:59:02
                Start date:05/07/2024
                Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
                Wow64 process (32bit):false
                Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2068 --field-trial-handle=1668,i,5790033669171981686,32294422139624892,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
                Imagebase:0x7ff74bb60000
                File size:3'581'912 bytes
                MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:moderate
                Has exited:false

                General

                Target ID:13
                Start time:00:59:05
                Start date:05/07/2024
                Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                Wow64 process (32bit):false
                Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\unity.pdf"
                Imagebase:0x7ff6bc1b0000
                File size:5'641'176 bytes
                MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:19
                Start time:00:59:41
                Start date:05/07/2024
                Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
                Wow64 process (32bit):false
                Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\unity.pdf"
                Imagebase:0x7ff6bc1b0000
                File size:5'641'176 bytes
                MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                General

                Target ID:20
                Start time:00:59:42
                Start date:05/07/2024
                Path:C:\Users\user\AppData\Local\Temp\apt66ext.exe
                Wow64 process (32bit):false
                Commandline:"C:\Users\user\AppData\Local\Temp\apt66ext.exe"
                Imagebase:0x7ff638500000
                File size:55'675'088 bytes
                MD5 hash:494A19DC7E5EAA0E516ECE245D2661DE
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Antivirus matches:
                • Detection: 18%, ReversingLabs
                Has exited:true

                General

                Target ID:22
                Start time:00:59:50
                Start date:05/07/2024
                Path:C:\Users\user\AppData\Local\Temp\onefile_8740_133646291825138024\staged_out.exe
                Wow64 process (32bit):false
                Commandline:"C:\Users\user\AppData\Local\Temp\apt66ext.exe"
                Imagebase:0x7ff6dad70000
                File size:22'602'752 bytes
                MD5 hash:D735279B3606F59AAD13FAB2AA9E9CD5
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Has exited:true

                Disassembly

                Reset < >

                  Executed Functions

                  Function 02FC1050 Relevance: 16.6, APIs: 11, Instructions: 100networkfileCOMMON
                  Download Yara Rule
                  APIs
                  • InternetOpenW.WININET(02FC3140,00000001,00000000,00000000,00000000), ref: 02FC107B
                  • InternetOpenUrlW.WININET(00000000,?,00000000,00000000,80000000,00000000), ref: 02FC109E
                  • GetTempPathW.KERNEL32(00000104,?,?,00000000,00000000,80000000,00000000), ref: 02FC10BA
                  • PathCombineW.SHLWAPI(?,?,?,?,00000000,00000000,80000000,00000000), ref: 02FC10CF
                  • CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,00000000,00000000,80000000,00000000), ref: 02FC10EE
                  • InternetReadFile.WININET(00000000,?,00001000,?,?,?,00000000,00000000,80000000,00000000), ref: 02FC1115
                  • WriteFile.KERNELBASE(00000000,?,?,00000000,00000000,?,?,00000000,00000000,80000000,00000000), ref: 02FC1137
                  • InternetReadFile.WININET(00000000,?,00001000,?,?,?,00000000,00000000,80000000,00000000), ref: 02FC1151
                  • CloseHandle.KERNEL32(00000000,?,?,00000000,00000000,80000000,00000000), ref: 02FC1158
                  • InternetCloseHandle.WININET(00000000), ref: 02FC1165
                  • InternetCloseHandle.WININET(00000000), ref: 02FC116C
                  Memory Dump Source
                  • Source File: 00000006.00000002.2395294109.0000000002FC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02FC1000, based on PE: false
                  Similarity
                  • API ID: Internet$File$CloseHandle$OpenPathRead$CombineCreateTempWrite
                  • String ID:
                  • API String ID: 3296775279-0
                  • Opcode ID: 676f7f4e612bd20c09852c602f24cdb7f7b04d5c39362828f684dc7b18920670
                  • Instruction ID: 8ad911c982fe67bc610306efaa62817a193b9d849b22a7b8dd4779c0ca360053
                  • Opcode Fuzzy Hash: 676f7f4e612bd20c09852c602f24cdb7f7b04d5c39362828f684dc7b18920670
                  • Instruction Fuzzy Hash: 1E31B972EC031DBBE7208A609D85FDBB36CEB04B94F2044A5F705E7281DB70A9948B64
                  Function 014F7EC8 Relevance: 12.7, APIs: 8, Instructions: 730memorynativeCOMMON
                  Download Yara Rule
                  APIs
                  • NtCreateSection.NTDLL(?,000F001F,00000000,?,00000040,08000000,00000000,00000000), ref: 014F7F61
                  • NtMapViewOfSection.NTDLL(?,00000000), ref: 014F8009
                  • VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 014F837D
                  • NtUnmapViewOfSection.NTDLL(00000000,?,?,?,?,?,?), ref: 014F83F0
                  • NtMapViewOfSection.NTDLL(?,00000000,?,?,?,?,?,?), ref: 014F8432
                  • VirtualProtect.KERNELBASE(?,?,00000008,?,?,?,?,?,?,?), ref: 014F844F
                  • VirtualProtect.KERNELBASE(?,?,?,00000000), ref: 014F84F2
                  • VirtualProtect.KERNELBASE(?,?,00000002,?,?,?,?,?,?,?), ref: 014F8525
                  Memory Dump Source
                  • Source File: 00000006.00000002.2394995201.00000000014F0000.00000040.10000000.00040000.00000000.sdmp, Offset: 014F0000, based on PE: false
                  Yara matches
                  Similarity
                  • API ID: SectionVirtual$ProtectView$AllocCreateUnmap
                  • String ID:
                  • API String ID: 1653215272-0
                  • Opcode ID: 42def313b3f27d7dbc40fe03692585391203b583680a0eb8e46ebb5996ff43a6
                  • Instruction ID: fbc68bdfec28b9a9a9fa0deb12fd632ddeb0389cc0f82461811c7eb25669851b
                  • Opcode Fuzzy Hash: 42def313b3f27d7dbc40fe03692585391203b583680a0eb8e46ebb5996ff43a6
                  • Instruction Fuzzy Hash: C5425971604302AFEB25CF19C844B6BBBE9EF88714F04492EFA859B361E770E945CB51
                  Function 02FC1290 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 74sleepCOMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 02FC1050: InternetOpenW.WININET(02FC3140,00000001,00000000,00000000,00000000), ref: 02FC107B
                    • Part of subcall function 02FC1050: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,80000000,00000000), ref: 02FC109E
                    • Part of subcall function 02FC1050: GetTempPathW.KERNEL32(00000104,?,?,00000000,00000000,80000000,00000000), ref: 02FC10BA
                    • Part of subcall function 02FC1050: PathCombineW.SHLWAPI(?,?,?,?,00000000,00000000,80000000,00000000), ref: 02FC10CF
                    • Part of subcall function 02FC1050: CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,00000000,00000000,80000000,00000000), ref: 02FC10EE
                    • Part of subcall function 02FC1050: InternetReadFile.WININET(00000000,?,00001000,?,?,?,00000000,00000000,80000000,00000000), ref: 02FC1115
                    • Part of subcall function 02FC1050: WriteFile.KERNELBASE(00000000,?,?,00000000,00000000,?,?,00000000,00000000,80000000,00000000), ref: 02FC1137
                    • Part of subcall function 02FC1050: InternetReadFile.WININET(00000000,?,00001000,?,?,?,00000000,00000000,80000000,00000000), ref: 02FC1151
                    • Part of subcall function 02FC1050: CloseHandle.KERNEL32(00000000,?,?,00000000,00000000,80000000,00000000), ref: 02FC1158
                    • Part of subcall function 02FC1050: InternetCloseHandle.WININET(00000000), ref: 02FC1165
                    • Part of subcall function 02FC1050: InternetCloseHandle.WININET(00000000), ref: 02FC116C
                  • GetTempPathW.KERNEL32(00000104,?), ref: 02FC12D4
                  • ShellExecuteW.SHELL32(00000000,02FC3160,?,00000000,00000000,00000001), ref: 02FC1309
                  • Sleep.KERNELBASE(000003E8), ref: 02FC131A
                    • Part of subcall function 02FC1190: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 02FC1204
                    • Part of subcall function 02FC1190: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,?,?,00000104), ref: 02FC124D
                    • Part of subcall function 02FC1190: WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000104), ref: 02FC125F
                    • Part of subcall function 02FC1190: CloseHandle.KERNEL32(?,?,?,?,00000104), ref: 02FC126B
                    • Part of subcall function 02FC1190: CloseHandle.KERNEL32(?,?,?,?,00000104), ref: 02FC1277
                  • Sleep.KERNELBASE(000003E8), ref: 02FC1341
                  • Sleep.KERNELBASE(00002710), ref: 02FC1368
                  Strings
                  Memory Dump Source
                  • Source File: 00000006.00000002.2395294109.0000000002FC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02FC1000, based on PE: false
                  Similarity
                  • API ID: Internet$CloseHandle$File$PathSleep$CreateOpenReadTemp$CombineEnvironmentExecuteExpandObjectProcessShellSingleStringsWaitWrite
                  • String ID: apt66ext.exe$http://121.127.33.39/apt66ext.log$http://121.127.33.39/unity.pdf$unity.pdf
                  • API String ID: 1787014113-3409970014
                  • Opcode ID: fe0ee226f29a62ce9d5f5dd78580c97e25cd99507b9c15cbad151291cd79cc88
                  • Instruction ID: b952014a7d64e5178609cfc317457699e6d575788915b87cd4be079fc08838f9
                  • Opcode Fuzzy Hash: fe0ee226f29a62ce9d5f5dd78580c97e25cd99507b9c15cbad151291cd79cc88
                  • Instruction Fuzzy Hash: 0E21A772A843496EE220E7A4CD45FDB77ECEB847D0F20895DB74A87180DD70E514CBA2
                  Function 00581000 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 34fileCOMMON
                  Download Yara Rule
                  APIs
                  • GetConsoleWindow.KERNEL32(00000000), ref: 00581003
                  • ShowWindow.USER32(00000000), ref: 0058100A
                  • CreateFileMappingW.KERNELBASE(000000FF,00000000,00000040,00000000,0000924A,00000000), ref: 0058101F
                  • MapViewOfFile.KERNELBASE(00000000,000F003F,00000000,00000000,0000924A), ref: 00581034
                  • memcpy.VCRUNTIME140(00000000,40,0000924A), ref: 00581047
                  • ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z.MSVCP140(00000000), ref: 0058105D
                  • ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z.MSVCP140 ref: 00581065
                  Strings
                  Memory Dump Source
                  • Source File: 00000006.00000002.2394673042.0000000000581000.00000020.00000001.01000000.00000005.sdmp, Offset: 00580000, based on PE: true
                  • Associated: 00000006.00000002.2394648370.0000000000580000.00000002.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394697025.0000000000582000.00000002.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394721262.0000000000583000.00000004.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394739280.0000000000584000.00000008.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394758729.000000000058C000.00000004.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394778370.000000000058D000.00000002.00000001.01000000.00000005.sdmpDownload File
                  Yara matches
                  Similarity
                  • API ID: V01@$??6?$basic_ostream@D@std@@@std@@FileU?$char_traits@Window$ConsoleCreateMappingShowV01@@Viewmemcpy
                  • String ID: 40
                  • API String ID: 2293564385-2042779591
                  • Opcode ID: 17ade0fe27d972e3836d1dd9892a0aa5c43fd1b3175bfca4301eb8c190419292
                  • Instruction ID: ac827547556286517ebeb325bc5b15e57880110709fe8fba28c7f87d5437974e
                  • Opcode Fuzzy Hash: 17ade0fe27d972e3836d1dd9892a0aa5c43fd1b3175bfca4301eb8c190419292
                  • Instruction Fuzzy Hash: B4F01C327C0310F7E62427B06C0EF593E58BB29B11F201504FB12BE0D1D9A46409D759
                  Function 02FC1190 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59processsynchronizationCOMMON
                  Download Yara Rule
                  APIs
                  • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 02FC1204
                  • CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,?,?,00000104), ref: 02FC124D
                  • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000104), ref: 02FC125F
                  • CloseHandle.KERNEL32(?,?,?,?,00000104), ref: 02FC126B
                  • CloseHandle.KERNEL32(?,?,?,?,00000104), ref: 02FC1277
                  Strings
                  Memory Dump Source
                  • Source File: 00000006.00000002.2395294109.0000000002FC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02FC1000, based on PE: false
                  Similarity
                  • API ID: CloseHandle$CreateEnvironmentExpandObjectProcessSingleStringsWait
                  • String ID: D
                  • API String ID: 4019750949-2746444292
                  • Opcode ID: 6655adfa3258466157a36c53c0ae6c56b9346f06d4e784ca0573b845d246d5c5
                  • Instruction ID: 1b95fbbe31bef483cdd5759269dbe9e4de095eb2f73796cf7c682bde56c45019
                  • Opcode Fuzzy Hash: 6655adfa3258466157a36c53c0ae6c56b9346f06d4e784ca0573b845d246d5c5
                  • Instruction Fuzzy Hash: 91215072C8161D9BEB20DB60CE44BE9B37ABB99758F1053D9A50CA2044DF725AE4CF50
                  Function 014F6928 Relevance: 6.1, APIs: 4, Instructions: 99memoryCOMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 014F8B46: LoadLibraryA.KERNELBASE(00000000,?,?), ref: 014F8BD8
                  • VirtualProtect.KERNELBASE(00000000,0000000C,00000040,?), ref: 014F6983
                  • VirtualProtect.KERNELBASE(00000000,0000000C,?,?), ref: 014F69B6
                  • VirtualProtect.KERNELBASE(00000000,0040145E,00000040,?), ref: 014F69E9
                  • VirtualProtect.KERNELBASE(00000000,0040145E,?,?), ref: 014F6A13
                  Memory Dump Source
                  • Source File: 00000006.00000002.2394995201.00000000014F0000.00000040.10000000.00040000.00000000.sdmp, Offset: 014F0000, based on PE: false
                  Yara matches
                  Similarity
                  • API ID: ProtectVirtual$LibraryLoad
                  • String ID:
                  • API String ID: 895956442-0
                  • Opcode ID: a56ed81a1d84b944742d0747a68d40b3543833d3a1cefaab2c4871146f0272aa
                  • Instruction ID: 5d5bd1d9e3c0b13640d4a22023cad5310de9d72b81db4c0af8babc855bccfc3b
                  • Opcode Fuzzy Hash: a56ed81a1d84b944742d0747a68d40b3543833d3a1cefaab2c4871146f0272aa
                  • Instruction Fuzzy Hash: 9921BBB250460A7FF310EA669C44FB7769CDB96300F05443FFB06E6361E775A9098A71
                  Function 014F8B46 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66libraryCOMMON
                  Download Yara Rule
                  APIs
                  • LoadLibraryA.KERNELBASE(00000000,?,?), ref: 014F8BD8
                  Strings
                  Memory Dump Source
                  • Source File: 00000006.00000002.2394995201.00000000014F0000.00000040.10000000.00040000.00000000.sdmp, Offset: 014F0000, based on PE: false
                  Yara matches
                  Similarity
                  • API ID: LibraryLoad
                  • String ID: .$.dll
                  • API String ID: 1029625771-979041800
                  • Opcode ID: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
                  • Instruction ID: 18dcb52cde186b7e11f6bfaebb9f323075811a58f8f3d9d1728712ee6593051b
                  • Opcode Fuzzy Hash: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
                  • Instruction Fuzzy Hash: 9421BBB660428A9FEB12CF6DC445A6B7BA4AF05364F18416EEA058F751D730E845C750
                  Function 014F6A23 Relevance: 3.0, APIs: 2, Instructions: 48memoryCOMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 014F8B46: LoadLibraryA.KERNELBASE(00000000,?,?), ref: 014F8BD8
                  • VirtualProtect.KERNELBASE(00000000,00000004,00000040,?), ref: 014F6A5B
                  • VirtualProtect.KERNELBASE(00000000,00000004,?,?), ref: 014F6A7E
                  Memory Dump Source
                  • Source File: 00000006.00000002.2394995201.00000000014F0000.00000040.10000000.00040000.00000000.sdmp, Offset: 014F0000, based on PE: false
                  Yara matches
                  Similarity
                  • API ID: ProtectVirtual$LibraryLoad
                  • String ID:
                  • API String ID: 895956442-0
                  • Opcode ID: de7bf3638c1a279d2bf7cad106927c36582a9c3e4c3deca2e798828624f61198
                  • Instruction ID: ffa839156d57ce971e00665f1ada6203e2a134593f33de0fda1c315a1e2f19f1
                  • Opcode Fuzzy Hash: de7bf3638c1a279d2bf7cad106927c36582a9c3e4c3deca2e798828624f61198
                  • Instruction Fuzzy Hash: 94F0A4B65006057EF6109B65CC41FFB77ACDF45650F00042EFB0ADA290EB71E60587A1
                  Function 014F7798 Relevance: 2.8, APIs: 2, Instructions: 325memoryCOMMON
                  Download Yara Rule
                  APIs
                  • VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 014F7812
                  • VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 014F7A01
                  Memory Dump Source
                  • Source File: 00000006.00000002.2394995201.00000000014F0000.00000040.10000000.00040000.00000000.sdmp, Offset: 014F0000, based on PE: false
                  Yara matches
                  Similarity
                  • API ID: AllocVirtual
                  • String ID:
                  • API String ID: 4275171209-0
                  • Opcode ID: 3ef942e361509333a6c4df6da77594675f5189c2bdfdb6f3c545f129199b24a5
                  • Instruction ID: 425ecf44c8c32af22c7575963e3c88f5ff3bb29f0d7f3b8aadbbfaf2a29eaed7
                  • Opcode Fuzzy Hash: 3ef942e361509333a6c4df6da77594675f5189c2bdfdb6f3c545f129199b24a5
                  • Instruction Fuzzy Hash: 12B10731500706ABEB229EA5CC80FA7BBE9FF15302F14052FEB5986360D739E555CB91
                  Function 02FC15A0 Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 02FC1A83: GetModuleHandleW.KERNEL32(00000000,02FC1569), ref: 02FC1A85
                  • ___security_init_cookie.LIBCMT ref: 02FC15E7
                  Memory Dump Source
                  • Source File: 00000006.00000002.2395294109.0000000002FC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02FC1000, based on PE: false
                  Similarity
                  • API ID: HandleModule___security_init_cookie
                  • String ID:
                  • API String ID: 1525027140-0
                  • Opcode ID: 597784c5743ab1e5f16a074fea63c5de92a888201797272d4011e8994ba73eb7
                  • Instruction ID: 8d931412af8b16754e1b60277d5fde2538e39b4207179cdd923740412e65a762
                  • Opcode Fuzzy Hash: 597784c5743ab1e5f16a074fea63c5de92a888201797272d4011e8994ba73eb7
                  • Instruction Fuzzy Hash: F5E01A72E0825B8FDF24AB94DA013AEB772EF413A5F20096DD61A6269297255420CA50

                  Non-executed Functions

                  Function 00581668 Relevance: 9.1, APIs: 6, Instructions: 73COMMON
                  Download Yara Rule
                  APIs
                  • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00581674
                  • memset.VCRUNTIME140(?,00000000,00000003), ref: 0058169A
                  • memset.VCRUNTIME140(?,00000000,00000050), ref: 00581724
                  • IsDebuggerPresent.KERNEL32 ref: 00581740
                  • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00581760
                  • UnhandledExceptionFilter.KERNEL32(?), ref: 0058176A
                  Memory Dump Source
                  • Source File: 00000006.00000002.2394673042.0000000000581000.00000020.00000001.01000000.00000005.sdmp, Offset: 00580000, based on PE: true
                  • Associated: 00000006.00000002.2394648370.0000000000580000.00000002.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394697025.0000000000582000.00000002.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394721262.0000000000583000.00000004.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394739280.0000000000584000.00000008.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394758729.000000000058C000.00000004.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394778370.000000000058D000.00000002.00000001.01000000.00000005.sdmpDownload File
                  Yara matches
                  Similarity
                  • API ID: ExceptionFilterPresentUnhandledmemset$DebuggerFeatureProcessor
                  • String ID:
                  • API String ID: 1045392073-0
                  • Opcode ID: 53f27e76970415a2153dfbab8c5b9d1715032f6170ded3a2092f2457a6ae1eb9
                  • Instruction ID: 200032e537ab0716d312687c84e4bc47408a8e1f1c9c7a9a69c7b22953529579
                  • Opcode Fuzzy Hash: 53f27e76970415a2153dfbab8c5b9d1715032f6170ded3a2092f2457a6ae1eb9
                  • Instruction Fuzzy Hash: D9311C75D45219DBDB11EF64D989BCCBBB8FF18300F1041AAE90CAB250EB705A85DF45
                  Function 02FC1963 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                  Download Yara Rule
                  APIs
                  • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 02FC196F
                  • IsDebuggerPresent.KERNEL32 ref: 02FC1A3B
                  • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 02FC1A5B
                  • UnhandledExceptionFilter.KERNEL32(?), ref: 02FC1A65
                  Memory Dump Source
                  • Source File: 00000006.00000002.2395294109.0000000002FC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02FC1000, based on PE: false
                  Similarity
                  • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                  • String ID:
                  • API String ID: 254469556-0
                  • Opcode ID: 7549c57c72136d2b9d997977dc2485c27c1b9f7f15d8cbfa5a2d24eb0617dfcc
                  • Instruction ID: f59fa4f3b5e158a27f1d4be909957a77834b5a8d84f5fb72b889d418302acf83
                  • Opcode Fuzzy Hash: 7549c57c72136d2b9d997977dc2485c27c1b9f7f15d8cbfa5a2d24eb0617dfcc
                  • Instruction Fuzzy Hash: AD312B75D4121D9BDB10DFA4DA89BCDBBB8AF08784F2041DAE50DAB240EB715A98CF44
                  Function 014F4C1C Relevance: 2.3, Strings: 1, Instructions: 1070COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000006.00000002.2394995201.00000000014F0000.00000040.10000000.00040000.00000000.sdmp, Offset: 014F0000, based on PE: false
                  Yara matches
                  Similarity
                  • API ID:
                  • String ID: @
                  • API String ID: 0-2766056989
                  • Opcode ID: 82f163e4761bd8698f5f866852cd4e0229762b1cc4392098708726b2277ebcfa
                  • Instruction ID: 2ae58a3e3374feffb4bea8707902d581eae376f7e54a45f39d575662306434d5
                  • Opcode Fuzzy Hash: 82f163e4761bd8698f5f866852cd4e0229762b1cc4392098708726b2277ebcfa
                  • Instruction Fuzzy Hash: 8072A330618B488FDB69DF2CC8856AA77E1FB98314F54462ED98BC7351EF34E5428B81
                  Function 00581A26 Relevance: 1.6, APIs: 1, Instructions: 144COMMON
                  Download Yara Rule
                  APIs
                  • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00581A3C
                  Memory Dump Source
                  • Source File: 00000006.00000002.2394673042.0000000000581000.00000020.00000001.01000000.00000005.sdmp, Offset: 00580000, based on PE: true
                  • Associated: 00000006.00000002.2394648370.0000000000580000.00000002.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394697025.0000000000582000.00000002.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394721262.0000000000583000.00000004.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394739280.0000000000584000.00000008.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394758729.000000000058C000.00000004.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394778370.000000000058D000.00000002.00000001.01000000.00000005.sdmpDownload File
                  Yara matches
                  Similarity
                  • API ID: FeaturePresentProcessor
                  • String ID:
                  • API String ID: 2325560087-0
                  • Opcode ID: 0b7a44042ff5ecb86acfd47de25bd2fb68c6f2f71312230995b4fd3f3d336aa8
                  • Instruction ID: 976a69db1f055661103882291e0af2ac50392e44aa35f7f2158588739db729ce
                  • Opcode Fuzzy Hash: 0b7a44042ff5ecb86acfd47de25bd2fb68c6f2f71312230995b4fd3f3d336aa8
                  • Instruction Fuzzy Hash: 75518AB1A016058FDB28DF58D8857AEBFF4FB58314F24842AC905FB250E374AA45DBA4
                  Function 02FC1AC6 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                  Download Yara Rule
                  APIs
                  • SetUnhandledExceptionFilter.KERNEL32(Function_00000AD2,02FC1458), ref: 02FC1ACB
                  Memory Dump Source
                  • Source File: 00000006.00000002.2395294109.0000000002FC1000.00000020.10000000.00040000.00000000.sdmp, Offset: 02FC1000, based on PE: false
                  Similarity
                  • API ID: ExceptionFilterUnhandled
                  • String ID:
                  • API String ID: 3192549508-0
                  • Opcode ID: 6f5f907903e2c8d0c079c2059cdb8991ff97ab913538be0cbc303115f6865dfc
                  • Instruction ID: 73e8b02ba1e53b2f75a96d55c8072b9672eb86678c552e46a4542d0805ee5e61
                  • Opcode Fuzzy Hash: 6f5f907903e2c8d0c079c2059cdb8991ff97ab913538be0cbc303115f6865dfc
                  • Instruction Fuzzy Hash:
                  Function 005817CB Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                  Download Yara Rule
                  APIs
                  • SetUnhandledExceptionFilter.KERNEL32(Function_000017D7,00581157), ref: 005817D0
                  Memory Dump Source
                  • Source File: 00000006.00000002.2394673042.0000000000581000.00000020.00000001.01000000.00000005.sdmp, Offset: 00580000, based on PE: true
                  • Associated: 00000006.00000002.2394648370.0000000000580000.00000002.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394697025.0000000000582000.00000002.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394721262.0000000000583000.00000004.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394739280.0000000000584000.00000008.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394758729.000000000058C000.00000004.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394778370.000000000058D000.00000002.00000001.01000000.00000005.sdmpDownload File
                  Yara matches
                  Similarity
                  • API ID: ExceptionFilterUnhandled
                  • String ID:
                  • API String ID: 3192549508-0
                  • Opcode ID: ed9e7869960d23ff87ebebe84924bb5463de8bb1d3d382c8c4fa8da48fee5725
                  • Instruction ID: 13d0a2bd5e5c4b77dff974f951c92dfd033bb7cf7eda5a2803a598ef20edcf69
                  • Opcode Fuzzy Hash: ed9e7869960d23ff87ebebe84924bb5463de8bb1d3d382c8c4fa8da48fee5725
                  • Instruction Fuzzy Hash:
                  Function 014F3534 Relevance: .4, Instructions: 429COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2394995201.00000000014F0000.00000040.10000000.00040000.00000000.sdmp, Offset: 014F0000, based on PE: false
                  Yara matches
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 54a19d4bb2a1054924f4bfc2abc68d4f449b9e1de2d679b882cf74b481fb4666
                  • Instruction ID: 4db3e01b6c9e91a25c6b05b12313f14476d1345680faa4138e22a180aba89673
                  • Opcode Fuzzy Hash: 54a19d4bb2a1054924f4bfc2abc68d4f449b9e1de2d679b882cf74b481fb4666
                  • Instruction Fuzzy Hash: 6CD16531718A498BDB69DF28D889BAEB7E5FB58705F00422ED94AC3350DF30E955C781
                  Function 014F47EC Relevance: .4, Instructions: 405COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2394995201.00000000014F0000.00000040.10000000.00040000.00000000.sdmp, Offset: 014F0000, based on PE: false
                  Yara matches
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a66aa8eccb36b3c863fa0cf2326f118ce4658279e53cce5a51b176019e00911a
                  • Instruction ID: e00c92566226b35a8bdc56467bed763c150ef81d22d48071acaf80c4a68168fc
                  • Opcode Fuzzy Hash: a66aa8eccb36b3c863fa0cf2326f118ce4658279e53cce5a51b176019e00911a
                  • Instruction Fuzzy Hash: AFD15E31508A0C8BDB59DF28C889AEA77E1FF98310F14466EE98BC7255DF30E546CB41
                  Function 014F4410 Relevance: .4, Instructions: 382COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2394995201.00000000014F0000.00000040.10000000.00040000.00000000.sdmp, Offset: 014F0000, based on PE: false
                  Yara matches
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 5d17924f1650dce35aa6cfa67234e302229330514130ed1fd0e34ce5b20ef98f
                  • Instruction ID: 467a8af3914818acc162b99539611c2c2ebf3d92fc26d49065040cba15b1ddb9
                  • Opcode Fuzzy Hash: 5d17924f1650dce35aa6cfa67234e302229330514130ed1fd0e34ce5b20ef98f
                  • Instruction Fuzzy Hash: 85B18330614A099BDB59EA2DC8957ABB3D1FB99300F58422FCA4AC7365DF34E942C781
                  Function 014F56D0 Relevance: .3, Instructions: 283COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000006.00000002.2394995201.00000000014F0000.00000040.10000000.00040000.00000000.sdmp, Offset: 014F0000, based on PE: false
                  Yara matches
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2464d5d1c8744b7938e622091fc8299d1c098dc56941e33080af8fbc6eb05a52
                  • Instruction ID: adc6eab4381cbe34c9cf3ee83943a631403d4547bebd02e9347cc1b8ea2ba1b1
                  • Opcode Fuzzy Hash: 2464d5d1c8744b7938e622091fc8299d1c098dc56941e33080af8fbc6eb05a52
                  • Instruction Fuzzy Hash: 0DA11E31508A4C8FDB55EF28C889BEAB7E5FB58315F10466FD84AC7261EB30D644CB81
                  Function 0058109F Relevance: 12.1, APIs: 8, Instructions: 56COMMON
                  Download Yara Rule
                  APIs
                  • _set_app_type.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000001), ref: 005810A2
                  • _set_fmode.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001), ref: 005810AD
                  • __p__commode.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001), ref: 005810B9
                  • __RTC_Initialize.LIBCMT ref: 005810D1
                  • _configure_narrow_argv.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00581861), ref: 005810E6
                    • Part of subcall function 005815F4: InitializeSListHead.KERNEL32(0058C298,005810F6), ref: 005815F9
                  • __setusermatherr.API-MS-WIN-CRT-MATH-L1-1-0(Function_000015E7), ref: 00581104
                  • _configthreadlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000000), ref: 0058111F
                  • _initialize_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0058112E
                  Memory Dump Source
                  • Source File: 00000006.00000002.2394673042.0000000000581000.00000020.00000001.01000000.00000005.sdmp, Offset: 00580000, based on PE: true
                  • Associated: 00000006.00000002.2394648370.0000000000580000.00000002.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394697025.0000000000582000.00000002.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394721262.0000000000583000.00000004.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394739280.0000000000584000.00000008.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394758729.000000000058C000.00000004.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394778370.000000000058D000.00000002.00000001.01000000.00000005.sdmpDownload File
                  Yara matches
                  Similarity
                  • API ID: Initialize$HeadList__p__commode__setusermatherr_configthreadlocale_configure_narrow_argv_initialize_narrow_environment_set_app_type_set_fmode
                  • String ID:
                  • API String ID: 1933938900-0
                  • Opcode ID: ec0eec8eac4f176ebe47f49b2b32f2d965889e04e09e9312bf2cdb0fd81a2520
                  • Instruction ID: 72e2568a1f9bdff8ea93f89eb46c21d01ddaba21460c0247613f3586bef698b5
                  • Opcode Fuzzy Hash: ec0eec8eac4f176ebe47f49b2b32f2d965889e04e09e9312bf2cdb0fd81a2520
                  • Instruction Fuzzy Hash: 1901B661980E0319E92037F2190FA9D0E4D7FE2B95F080854BD86FA483ED5588838BBE
                  Function 005817D7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON
                  Download Yara Rule
                  APIs
                  • __current_exception.VCRUNTIME140 ref: 00581816
                  • __current_exception_context.VCRUNTIME140 ref: 00581820
                  • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00581827
                  Strings
                  Memory Dump Source
                  • Source File: 00000006.00000002.2394673042.0000000000581000.00000020.00000001.01000000.00000005.sdmp, Offset: 00580000, based on PE: true
                  • Associated: 00000006.00000002.2394648370.0000000000580000.00000002.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394697025.0000000000582000.00000002.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394721262.0000000000583000.00000004.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394739280.0000000000584000.00000008.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394758729.000000000058C000.00000004.00000001.01000000.00000005.sdmpDownload File
                  • Associated: 00000006.00000002.2394778370.000000000058D000.00000002.00000001.01000000.00000005.sdmpDownload File
                  Yara matches
                  Similarity
                  • API ID: __current_exception__current_exception_contextterminate
                  • String ID: csm
                  • API String ID: 2542180945-1018135373
                  • Opcode ID: fa585d20e8cc39dd4445395dddb2f788194a9978ce39d8c0779f611b76f3efee
                  • Instruction ID: 339903a43e036336f369dbe892e09f2091ea99ab8cb8b12c07e5101fad635148
                  • Opcode Fuzzy Hash: fa585d20e8cc39dd4445395dddb2f788194a9978ce39d8c0779f611b76f3efee
                  • Instruction Fuzzy Hash: 31F0A732500A058BCB317F79A40641ABF6DBE503227644816DC89EB610C7B0ED93CFE9

                  Executed Functions

                  Function 005D7EC8 Relevance: 12.7, APIs: 8, Instructions: 730memorynativeCOMMON
                  Download Yara Rule
                  APIs
                  • NtCreateSection.NTDLL(?,000F001F,00000000,?,00000040,08000000,00000000,00000000), ref: 005D7F61
                  • NtMapViewOfSection.NTDLL(?,00000000), ref: 005D8009
                  • VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 005D837D
                  • NtUnmapViewOfSection.NTDLL(00000000,?,?,?,?,?,?), ref: 005D83F0
                  • NtMapViewOfSection.NTDLL(?,00000000,?,?,?,?,?,?), ref: 005D8432
                  • VirtualProtect.KERNELBASE(?,?,00000008,?,?,?,?,?,?,?), ref: 005D844F
                  • VirtualProtect.KERNELBASE(?,?,?,00000000), ref: 005D84F2
                  • VirtualProtect.KERNELBASE(?,?,00000002,?,?,?,?,?,?,?), ref: 005D8525
                  Memory Dump Source
                  • Source File: 00000007.00000002.1859570340.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false
                  Yara matches
                  Similarity
                  • API ID: SectionVirtual$ProtectView$AllocCreateUnmap
                  • String ID:
                  • API String ID: 1653215272-0
                  • Opcode ID: 42def313b3f27d7dbc40fe03692585391203b583680a0eb8e46ebb5996ff43a6
                  • Instruction ID: 6dc4d1b86e41c47e787d816aa3d36786b7ec5f122d2f3f36bfbf3dc50290b57c
                  • Opcode Fuzzy Hash: 42def313b3f27d7dbc40fe03692585391203b583680a0eb8e46ebb5996ff43a6
                  • Instruction Fuzzy Hash: 07425871608301AFDB24DF68C884B6ABBE9FF88714F14492EF9859B351EB70E845CB51
                  Function 009D1050 Relevance: 16.6, APIs: 11, Instructions: 100networkfileCOMMON
                  Download Yara Rule
                  APIs
                  • InternetOpenW.WININET(009D3140,00000001,00000000,00000000,00000000), ref: 009D107B
                  • InternetOpenUrlW.WININET(00000000,?,00000000,00000000,80000000,00000000), ref: 009D109E
                  • GetTempPathW.KERNEL32(00000104,?,?,00000000,00000000,80000000,00000000), ref: 009D10BA
                  • PathCombineW.SHLWAPI(?,?,?,?,00000000,00000000,80000000,00000000), ref: 009D10CF
                  • CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,00000000,00000000,80000000,00000000), ref: 009D10EE
                  • InternetReadFile.WININET(00000000,?,00001000,?,?,?,00000000,00000000,80000000,00000000), ref: 009D1115
                  • WriteFile.KERNELBASE(00000000,?,?,00000000,00000000,?,?,00000000,00000000,80000000,00000000), ref: 009D1137
                  • InternetReadFile.WININET(00000000,?,00001000,?,?,?,00000000,00000000,80000000,00000000), ref: 009D1151
                  • CloseHandle.KERNEL32(00000000,?,?,00000000,00000000,80000000,00000000), ref: 009D1158
                  • InternetCloseHandle.WININET(00000000), ref: 009D1165
                  • InternetCloseHandle.WININET(00000000), ref: 009D116C
                  Memory Dump Source
                  • Source File: 00000007.00000002.1859657861.00000000009D1000.00000020.10000000.00040000.00000000.sdmp, Offset: 009D1000, based on PE: false
                  Similarity
                  • API ID: Internet$File$CloseHandle$OpenPathRead$CombineCreateTempWrite
                  • String ID:
                  • API String ID: 3296775279-0
                  • Opcode ID: c0ea92dbcd8a4172153ed92d38e59e9441997cb534ba5544ae8a07f04f66d88e
                  • Instruction ID: 537f7c2415c157c077a63745d1e829981a73358f30bf2c2ffa377aad9ca1660a
                  • Opcode Fuzzy Hash: c0ea92dbcd8a4172153ed92d38e59e9441997cb534ba5544ae8a07f04f66d88e
                  • Instruction Fuzzy Hash: D831B176685319BBE7208B60DC85FEA737CAB08701F10C1A2F704E62D0DB70AE848B65
                  Function 009D1290 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 74sleepCOMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 009D1050: InternetOpenW.WININET(009D3140,00000001,00000000,00000000,00000000), ref: 009D107B
                    • Part of subcall function 009D1050: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,80000000,00000000), ref: 009D109E
                    • Part of subcall function 009D1050: GetTempPathW.KERNEL32(00000104,?,?,00000000,00000000,80000000,00000000), ref: 009D10BA
                    • Part of subcall function 009D1050: PathCombineW.SHLWAPI(?,?,?,?,00000000,00000000,80000000,00000000), ref: 009D10CF
                    • Part of subcall function 009D1050: CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,00000000,00000000,80000000,00000000), ref: 009D10EE
                    • Part of subcall function 009D1050: InternetReadFile.WININET(00000000,?,00001000,?,?,?,00000000,00000000,80000000,00000000), ref: 009D1115
                    • Part of subcall function 009D1050: WriteFile.KERNELBASE(00000000,?,?,00000000,00000000,?,?,00000000,00000000,80000000,00000000), ref: 009D1137
                    • Part of subcall function 009D1050: InternetReadFile.WININET(00000000,?,00001000,?,?,?,00000000,00000000,80000000,00000000), ref: 009D1151
                    • Part of subcall function 009D1050: CloseHandle.KERNEL32(00000000,?,?,00000000,00000000,80000000,00000000), ref: 009D1158
                    • Part of subcall function 009D1050: InternetCloseHandle.WININET(00000000), ref: 009D1165
                    • Part of subcall function 009D1050: InternetCloseHandle.WININET(00000000), ref: 009D116C
                  • GetTempPathW.KERNEL32(00000104,?), ref: 009D12D4
                  • ShellExecuteW.SHELL32(00000000,009D3160,?,00000000,00000000,00000001), ref: 009D1309
                  • Sleep.KERNELBASE(000003E8), ref: 009D131A
                    • Part of subcall function 009D1190: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 009D1204
                    • Part of subcall function 009D1190: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,?,?,00000104), ref: 009D124D
                    • Part of subcall function 009D1190: WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000104), ref: 009D125F
                    • Part of subcall function 009D1190: CloseHandle.KERNEL32(?,?,?,?,00000104), ref: 009D126B
                    • Part of subcall function 009D1190: CloseHandle.KERNEL32(?,?,?,?,00000104), ref: 009D1277
                  • Sleep.KERNELBASE(000003E8), ref: 009D1341
                  • Sleep.KERNELBASE(00002710), ref: 009D1368
                  Strings
                  Memory Dump Source
                  • Source File: 00000007.00000002.1859657861.00000000009D1000.00000020.10000000.00040000.00000000.sdmp, Offset: 009D1000, based on PE: false
                  Similarity
                  • API ID: Internet$CloseHandle$File$PathSleep$CreateOpenReadTemp$CombineEnvironmentExecuteExpandObjectProcessShellSingleStringsWaitWrite
                  • String ID: apt66ext.exe$http://121.127.33.39/apt66ext.log$http://121.127.33.39/unity.pdf$unity.pdf
                  • API String ID: 1787014113-3409970014
                  • Opcode ID: 90a7dc852d823c31ee740de896d674f2e4571bf340f39959bb746cedbbcd9516
                  • Instruction ID: 8b1544949dfb1f3286e3414d57a0de2c3ca398f3cb5b75c76cbfb08156bccd82
                  • Opcode Fuzzy Hash: 90a7dc852d823c31ee740de896d674f2e4571bf340f39959bb746cedbbcd9516
                  • Instruction Fuzzy Hash: 0E2174766983497AD330EBA4CC45FDB77ECABC4711F00C52BB65986290DA70A644CBA3
                  Function 009D1190 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59processsynchronizationCOMMON
                  Download Yara Rule
                  APIs
                  • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 009D1204
                  • CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,?,?,00000104), ref: 009D124D
                  • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000104), ref: 009D125F
                  • CloseHandle.KERNEL32(?,?,?,?,00000104), ref: 009D126B
                  • CloseHandle.KERNEL32(?,?,?,?,00000104), ref: 009D1277
                  Strings
                  Memory Dump Source
                  • Source File: 00000007.00000002.1859657861.00000000009D1000.00000020.10000000.00040000.00000000.sdmp, Offset: 009D1000, based on PE: false
                  Similarity
                  • API ID: CloseHandle$CreateEnvironmentExpandObjectProcessSingleStringsWait
                  • String ID: D
                  • API String ID: 4019750949-2746444292
                  • Opcode ID: 1590e8784b706a139cb67ac684307d5099c959228d4cbb6244ec99fc08e8667c
                  • Instruction ID: 86f16cbba0c8d50f2075a8ba10fc9a5186cc597badd28b9806554d3eaf6a8a27
                  • Opcode Fuzzy Hash: 1590e8784b706a139cb67ac684307d5099c959228d4cbb6244ec99fc08e8667c
                  • Instruction Fuzzy Hash: C7217C71C9521CABDB20CB60CD44BA8B37ABBD9305F0053D6B50CA2150EE724BE4DF50
                  Function 005D6928 Relevance: 6.1, APIs: 4, Instructions: 99memoryCOMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 005D8B46: LoadLibraryA.KERNELBASE(00000000,?,?), ref: 005D8BD8
                  • VirtualProtect.KERNELBASE(00000000,0000000C,00000040,?), ref: 005D6983
                  • VirtualProtect.KERNELBASE(00000000,0000000C,?,?), ref: 005D69B6
                  • VirtualProtect.KERNELBASE(00000000,0040145E,00000040,?), ref: 005D69E9
                  • VirtualProtect.KERNELBASE(00000000,0040145E,?,?), ref: 005D6A13
                  Memory Dump Source
                  • Source File: 00000007.00000002.1859570340.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false
                  Yara matches
                  Similarity
                  • API ID: ProtectVirtual$LibraryLoad
                  • String ID:
                  • API String ID: 895956442-0
                  • Opcode ID: a56ed81a1d84b944742d0747a68d40b3543833d3a1cefaab2c4871146f0272aa
                  • Instruction ID: c4aadb829d8da7d68ddb4de8851b54eb465256435f04bc85e65fa3c92c4573ef
                  • Opcode Fuzzy Hash: a56ed81a1d84b944742d0747a68d40b3543833d3a1cefaab2c4871146f0272aa
                  • Instruction Fuzzy Hash: A721BE721046067FE330E9698C49F777E9CEB85304F44443FFB46E1251EB69A9068675
                  Function 005D8B46 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66libraryCOMMON
                  Download Yara Rule
                  APIs
                  • LoadLibraryA.KERNELBASE(00000000,?,?), ref: 005D8BD8
                  Strings
                  Memory Dump Source
                  • Source File: 00000007.00000002.1859570340.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false
                  Yara matches
                  Similarity
                  • API ID: LibraryLoad
                  • String ID: .$.dll
                  • API String ID: 1029625771-979041800
                  • Opcode ID: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
                  • Instruction ID: 5f0d657c1cd7c3ad09531cef41e6a8dfd14b53f2821bb7fa03c2f0d886ac274c
                  • Opcode Fuzzy Hash: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
                  • Instruction Fuzzy Hash: 8921C0B56002859FEB31CEACC885A7A7FA4BF05360F1840ABD8428BB41DB20EC458B90
                  Function 005D6A23 Relevance: 3.0, APIs: 2, Instructions: 48memoryCOMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 005D8B46: LoadLibraryA.KERNELBASE(00000000,?,?), ref: 005D8BD8
                  • VirtualProtect.KERNELBASE(00000000,00000004,00000040,?), ref: 005D6A5B
                  • VirtualProtect.KERNELBASE(00000000,00000004,?,?), ref: 005D6A7E
                  Memory Dump Source
                  • Source File: 00000007.00000002.1859570340.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false
                  Yara matches
                  Similarity
                  • API ID: ProtectVirtual$LibraryLoad
                  • String ID:
                  • API String ID: 895956442-0
                  • Opcode ID: de7bf3638c1a279d2bf7cad106927c36582a9c3e4c3deca2e798828624f61198
                  • Instruction ID: 3214b44ac5b844247f8183e77551a7ad75c017b87469ce3ca50c4de64451395f
                  • Opcode Fuzzy Hash: de7bf3638c1a279d2bf7cad106927c36582a9c3e4c3deca2e798828624f61198
                  • Instruction Fuzzy Hash: D0F0A9B61406147EF6219A58CC46FFB77ACEF85750F40041BFB45D5180EB61E601C7A1
                  Function 005D7798 Relevance: 2.8, APIs: 2, Instructions: 325memoryCOMMON
                  Download Yara Rule
                  APIs
                  • VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 005D7812
                  • VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 005D7A01
                  Memory Dump Source
                  • Source File: 00000007.00000002.1859570340.00000000005D0000.00000040.10000000.00040000.00000000.sdmp, Offset: 005D0000, based on PE: false
                  Yara matches
                  Similarity
                  • API ID: AllocVirtual
                  • String ID:
                  • API String ID: 4275171209-0
                  • Opcode ID: 3ef942e361509333a6c4df6da77594675f5189c2bdfdb6f3c545f129199b24a5
                  • Instruction ID: 84d1558ab74cf864eddfd58f72d00516c1e3e343439b4909d18cac0d8987ae78
                  • Opcode Fuzzy Hash: 3ef942e361509333a6c4df6da77594675f5189c2bdfdb6f3c545f129199b24a5
                  • Instruction Fuzzy Hash: A8B1C472508A0AABDB319B68CC84FABBFA9FF49300F14051BF95996341F731E950DB91
                  Function 009D15A0 Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 009D1A83: GetModuleHandleW.KERNEL32(00000000,009D1569), ref: 009D1A85
                  • ___security_init_cookie.LIBCMT ref: 009D15E7
                  Memory Dump Source
                  • Source File: 00000007.00000002.1859657861.00000000009D1000.00000020.10000000.00040000.00000000.sdmp, Offset: 009D1000, based on PE: false
                  Similarity
                  • API ID: HandleModule___security_init_cookie
                  • String ID:
                  • API String ID: 1525027140-0
                  • Opcode ID: 597784c5743ab1e5f16a074fea63c5de92a888201797272d4011e8994ba73eb7
                  • Instruction ID: a444b3da413bf4214c80316e71d5f96574d908b406cf88828b92832a978bb127
                  • Opcode Fuzzy Hash: 597784c5743ab1e5f16a074fea63c5de92a888201797272d4011e8994ba73eb7
                  • Instruction Fuzzy Hash: 57E04F73A88259AFDF10AF98D8023ECB772EF80364F108567F512627A1D73958109B50

                  Non-executed Functions

                  Function 009D1963 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                  Download Yara Rule
                  APIs
                  • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 009D196F
                  • IsDebuggerPresent.KERNEL32 ref: 009D1A3B
                  • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 009D1A5B
                  • UnhandledExceptionFilter.KERNEL32(?), ref: 009D1A65
                  Memory Dump Source
                  • Source File: 00000007.00000002.1859657861.00000000009D1000.00000020.10000000.00040000.00000000.sdmp, Offset: 009D1000, based on PE: false
                  Similarity
                  • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                  • String ID:
                  • API String ID: 254469556-0
                  • Opcode ID: fceb59389fb15909be193d4329a911c5ad23d6eb3104ae24c56be3a0e4ae0681
                  • Instruction ID: f1cd4bbe02cc6bb3f59606782061f6d94cf28f24cc14ab72903bee495ef04101
                  • Opcode Fuzzy Hash: fceb59389fb15909be193d4329a911c5ad23d6eb3104ae24c56be3a0e4ae0681
                  • Instruction Fuzzy Hash: 6D312B75D4621CABDB10DFA4D989BCCBBB8AF08301F1081AAE40DAB250EB705B84DF05

                  Executed Functions

                  Function 01517EC8 Relevance: 12.7, APIs: 8, Instructions: 730memorynativeCOMMON
                  Download Yara Rule
                  APIs
                  • NtCreateSection.NTDLL(?,000F001F,00000000,?,00000040,08000000,00000000,00000000), ref: 01517F61
                  • NtMapViewOfSection.NTDLL(?,00000000), ref: 01518009
                  • VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 0151837D
                  • NtUnmapViewOfSection.NTDLL(00000000,?,?,?,?,?,?), ref: 015183F0
                  • NtMapViewOfSection.NTDLL(?,00000000,?,?,?,?,?,?), ref: 01518432
                  • VirtualProtect.KERNELBASE(?,?,00000008,?,?,?,?,?,?,?), ref: 0151844F
                  • VirtualProtect.KERNELBASE(?,?,?,00000000), ref: 015184F2
                  • VirtualProtect.KERNELBASE(?,?,00000002,?,?,?,?,?,?,?), ref: 01518525
                  Memory Dump Source
                  • Source File: 0000000A.00000002.1906067523.0000000001510000.00000040.10000000.00040000.00000000.sdmp, Offset: 01510000, based on PE: false
                  Yara matches
                  Similarity
                  • API ID: SectionVirtual$ProtectView$AllocCreateUnmap
                  • String ID:
                  • API String ID: 1653215272-0
                  • Opcode ID: 42def313b3f27d7dbc40fe03692585391203b583680a0eb8e46ebb5996ff43a6
                  • Instruction ID: 42dcbcc64c8806bf6d9982c76c0ba8bf5fde8bd2877b0f8bef0b06b9ade73955
                  • Opcode Fuzzy Hash: 42def313b3f27d7dbc40fe03692585391203b583680a0eb8e46ebb5996ff43a6
                  • Instruction Fuzzy Hash: 9A426971608301AFEB26CF18C884B6BBBE9FF88714F08492DF9959B255D770E845CB51
                  Function 016A1290 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 74sleepCOMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 016A1050: InternetOpenW.WININET(016A3140,00000001,00000000,00000000,00000000), ref: 016A107B
                    • Part of subcall function 016A1050: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,80000000,00000000), ref: 016A109E
                    • Part of subcall function 016A1050: GetTempPathW.KERNEL32(00000104,?,?,00000000,00000000,80000000,00000000), ref: 016A10BA
                    • Part of subcall function 016A1050: PathCombineW.SHLWAPI(?,?,?,?,00000000,00000000,80000000,00000000), ref: 016A10CF
                    • Part of subcall function 016A1050: CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,00000000,00000000,80000000,00000000), ref: 016A10EE
                    • Part of subcall function 016A1050: WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,?,00000000,00000000,80000000,00000000), ref: 016A1137
                    • Part of subcall function 016A1050: CloseHandle.KERNEL32(00000000,?,?,00000000,00000000,80000000,00000000), ref: 016A1158
                    • Part of subcall function 016A1050: InternetCloseHandle.WININET(00000000), ref: 016A1165
                    • Part of subcall function 016A1050: InternetCloseHandle.WININET(00000000), ref: 016A116C
                  • GetTempPathW.KERNEL32(00000104,?), ref: 016A12D4
                  • ShellExecuteW.SHELL32(00000000,016A3160,?,00000000,00000000,00000001), ref: 016A1309
                  • Sleep.KERNELBASE(000003E8), ref: 016A131A
                    • Part of subcall function 016A1190: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 016A1204
                    • Part of subcall function 016A1190: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,?,?,00000104), ref: 016A124D
                    • Part of subcall function 016A1190: WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000104), ref: 016A125F
                    • Part of subcall function 016A1190: CloseHandle.KERNEL32(?,?,?,?,00000104), ref: 016A126B
                    • Part of subcall function 016A1190: CloseHandle.KERNEL32(?,?,?,?,00000104), ref: 016A1277
                  • Sleep.KERNELBASE(000003E8), ref: 016A1341
                  • Sleep.KERNELBASE(00002710), ref: 016A1368
                  Strings
                  Memory Dump Source
                  • Source File: 0000000A.00000002.1906457233.00000000016A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 016A1000, based on PE: false
                  Similarity
                  • API ID: CloseHandle$Internet$PathSleep$CreateFileOpenTemp$CombineEnvironmentExecuteExpandObjectProcessShellSingleStringsWaitWrite
                  • String ID: apt66ext.exe$http://121.127.33.39/apt66ext.log$http://121.127.33.39/unity.pdf$unity.pdf
                  • API String ID: 3129924107-3409970014
                  • Opcode ID: b5f8f86bbc1a1a51dfae72a45777269473969484539f6efbbebbcc7c907ee760
                  • Instruction ID: f9f5b8c7e5b131888e43024371492fce52d7490ab5dd7430b125bb31aed3d623
                  • Opcode Fuzzy Hash: b5f8f86bbc1a1a51dfae72a45777269473969484539f6efbbebbcc7c907ee760
                  • Instruction Fuzzy Hash: 862141766443486AD230EBA5CC45FDBB7EDBB85611F80451DF64986280DE70BD04CFA6
                  Function 016A1050 Relevance: 13.6, APIs: 9, Instructions: 100networkfileCOMMON
                  Download Yara Rule
                  APIs
                  • InternetOpenW.WININET(016A3140,00000001,00000000,00000000,00000000), ref: 016A107B
                  • InternetOpenUrlW.WININET(00000000,?,00000000,00000000,80000000,00000000), ref: 016A109E
                  • GetTempPathW.KERNEL32(00000104,?,?,00000000,00000000,80000000,00000000), ref: 016A10BA
                  • PathCombineW.SHLWAPI(?,?,?,?,00000000,00000000,80000000,00000000), ref: 016A10CF
                  • CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,00000000,00000000,80000000,00000000), ref: 016A10EE
                  • WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,?,00000000,00000000,80000000,00000000), ref: 016A1137
                  • CloseHandle.KERNEL32(00000000,?,?,00000000,00000000,80000000,00000000), ref: 016A1158
                  • InternetCloseHandle.WININET(00000000), ref: 016A1165
                  • InternetCloseHandle.WININET(00000000), ref: 016A116C
                  Memory Dump Source
                  • Source File: 0000000A.00000002.1906457233.00000000016A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 016A1000, based on PE: false
                  Similarity
                  • API ID: Internet$CloseHandle$FileOpenPath$CombineCreateTempWrite
                  • String ID:
                  • API String ID: 4120441418-0
                  • Opcode ID: 4e65637a906aef076538071518bf58f1bf3aae48dcaf6f03a837f549ed227dbb
                  • Instruction ID: 9086a5f3e6f58323d036ea629f17d0f333db91d01778b5df6719843c7bea55b1
                  • Opcode Fuzzy Hash: 4e65637a906aef076538071518bf58f1bf3aae48dcaf6f03a837f549ed227dbb
                  • Instruction Fuzzy Hash: D7317171680319BBE7308B649C85FEA77ACAB09701F9041A5F705E6280DB70BD84CF74
                  Function 016A1190 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59processsynchronizationCOMMON
                  Download Yara Rule
                  APIs
                  • ExpandEnvironmentStringsW.KERNEL32(?,?,00000104), ref: 016A1204
                  • CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,?,?,00000104), ref: 016A124D
                  • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000104), ref: 016A125F
                  • CloseHandle.KERNEL32(?,?,?,?,00000104), ref: 016A126B
                  • CloseHandle.KERNEL32(?,?,?,?,00000104), ref: 016A1277
                  Strings
                  Memory Dump Source
                  • Source File: 0000000A.00000002.1906457233.00000000016A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 016A1000, based on PE: false
                  Similarity
                  • API ID: CloseHandle$CreateEnvironmentExpandObjectProcessSingleStringsWait
                  • String ID: D
                  • API String ID: 4019750949-2746444292
                  • Opcode ID: fc2ef598fc18a7488649260e63f5a5fde7a96bac3d8b71ff73d78fd437f5a447
                  • Instruction ID: e6aba49d7661050c4481e659df6d2bd8a99683afc33549141790b1de7e9128a0
                  • Opcode Fuzzy Hash: fc2ef598fc18a7488649260e63f5a5fde7a96bac3d8b71ff73d78fd437f5a447
                  • Instruction Fuzzy Hash: A3215E71D8161C9BDB20CF60CD44BA9B77ABBA9308F4023DAA50CA2144EE725EE4CF50
                  Function 01516928 Relevance: 6.1, APIs: 4, Instructions: 99memoryCOMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 01518B46: LoadLibraryA.KERNELBASE(00000000,?,?), ref: 01518BD8
                  • VirtualProtect.KERNELBASE(00000000,0000000C,00000040,?), ref: 01516983
                  • VirtualProtect.KERNELBASE(00000000,0000000C,?,?), ref: 015169B6
                  • VirtualProtect.KERNELBASE(00000000,0040145E,00000040,?), ref: 015169E9
                  • VirtualProtect.KERNELBASE(00000000,0040145E,?,?), ref: 01516A13
                  Memory Dump Source
                  • Source File: 0000000A.00000002.1906067523.0000000001510000.00000040.10000000.00040000.00000000.sdmp, Offset: 01510000, based on PE: false
                  Yara matches
                  Similarity
                  • API ID: ProtectVirtual$LibraryLoad
                  • String ID:
                  • API String ID: 895956442-0
                  • Opcode ID: a56ed81a1d84b944742d0747a68d40b3543833d3a1cefaab2c4871146f0272aa
                  • Instruction ID: eb6bab00865923048b71f49d320051324ba6947ef938fa2074abb045db3d595c
                  • Opcode Fuzzy Hash: a56ed81a1d84b944742d0747a68d40b3543833d3a1cefaab2c4871146f0272aa
                  • Instruction Fuzzy Hash: 1421BBB310460A7FF321E9658C84FBB76ACFB95300F44483EFB06E9155EBE9A9058671
                  Function 01518B46 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66libraryCOMMON
                  Download Yara Rule
                  APIs
                  • LoadLibraryA.KERNELBASE(00000000,?,?), ref: 01518BD8
                  Strings
                  Memory Dump Source
                  • Source File: 0000000A.00000002.1906067523.0000000001510000.00000040.10000000.00040000.00000000.sdmp, Offset: 01510000, based on PE: false
                  Yara matches
                  Similarity
                  • API ID: LibraryLoad
                  • String ID: .$.dll
                  • API String ID: 1029625771-979041800
                  • Opcode ID: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
                  • Instruction ID: ea362180c3dc535ace56ca73835180055eb2f9474d85a37ae5ebda587ac6f986
                  • Opcode Fuzzy Hash: f6f06f52cd4a024ca790678b75224790e8b38e6a55f670a1ffdfea5ea75d1fe1
                  • Instruction Fuzzy Hash: F221B4B56046859FFB33DFACC884A6E7BA4BF05364F1841ADD9058FA45D730E845C790
                  Function 01516A23 Relevance: 3.0, APIs: 2, Instructions: 48memoryCOMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 01518B46: LoadLibraryA.KERNELBASE(00000000,?,?), ref: 01518BD8
                  • VirtualProtect.KERNELBASE(00000000,00000004,00000040,?), ref: 01516A5B
                  • VirtualProtect.KERNELBASE(00000000,00000004,?,?), ref: 01516A7E
                  Memory Dump Source
                  • Source File: 0000000A.00000002.1906067523.0000000001510000.00000040.10000000.00040000.00000000.sdmp, Offset: 01510000, based on PE: false
                  Yara matches
                  Similarity
                  • API ID: ProtectVirtual$LibraryLoad
                  • String ID:
                  • API String ID: 895956442-0
                  • Opcode ID: de7bf3638c1a279d2bf7cad106927c36582a9c3e4c3deca2e798828624f61198
                  • Instruction ID: d6f653ca01d05f6a39c75f6a66f784757d31bedeffc6f9b606f91e64c001251a
                  • Opcode Fuzzy Hash: de7bf3638c1a279d2bf7cad106927c36582a9c3e4c3deca2e798828624f61198
                  • Instruction Fuzzy Hash: 15F0A4B6140615BEF6229A65CC41FFF77ECEF85A51F000418FB06DA084EBA5E641C7A1
                  Function 01517798 Relevance: 2.8, APIs: 2, Instructions: 325memoryCOMMON
                  Download Yara Rule
                  APIs
                  • VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 01517812
                  • VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 01517A01
                  Memory Dump Source
                  • Source File: 0000000A.00000002.1906067523.0000000001510000.00000040.10000000.00040000.00000000.sdmp, Offset: 01510000, based on PE: false
                  Yara matches
                  Similarity
                  • API ID: AllocVirtual
                  • String ID:
                  • API String ID: 4275171209-0
                  • Opcode ID: 3ef942e361509333a6c4df6da77594675f5189c2bdfdb6f3c545f129199b24a5
                  • Instruction ID: 1a2d2a67a60fe60e7a4a455c086c1060cecd68ebb4cc0fa8954ebb46fd3f9923
                  • Opcode Fuzzy Hash: 3ef942e361509333a6c4df6da77594675f5189c2bdfdb6f3c545f129199b24a5
                  • Instruction Fuzzy Hash: ACB1E672500707ABFB239EACCC80FABBBE9FF49310F140519EA599A144E771E554CB91
                  Function 016A15A0 Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 016A1A83: GetModuleHandleW.KERNEL32(00000000,016A1569), ref: 016A1A85
                  • ___security_init_cookie.LIBCMT ref: 016A15E7
                  Memory Dump Source
                  • Source File: 0000000A.00000002.1906457233.00000000016A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 016A1000, based on PE: false
                  Similarity
                  • API ID: HandleModule___security_init_cookie
                  • String ID:
                  • API String ID: 1525027140-0
                  • Opcode ID: 597784c5743ab1e5f16a074fea63c5de92a888201797272d4011e8994ba73eb7
                  • Instruction ID: 1403ffa4f238a66ec6ecab0e1e6a91c842ba1deef9c88b186ee745195d4cc808
                  • Opcode Fuzzy Hash: 597784c5743ab1e5f16a074fea63c5de92a888201797272d4011e8994ba73eb7
                  • Instruction Fuzzy Hash: E4E0DFB1A0828A8FDF10AB9CCC012ECBBB3EF22224F440529C96263290D7205C008F58

                  Non-executed Functions

                  Function 016A1963 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                  Download Yara Rule
                  APIs
                  • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 016A196F
                  • IsDebuggerPresent.KERNEL32 ref: 016A1A3B
                  • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 016A1A5B
                  • UnhandledExceptionFilter.KERNEL32(?), ref: 016A1A65
                  Memory Dump Source
                  • Source File: 0000000A.00000002.1906457233.00000000016A1000.00000020.10000000.00040000.00000000.sdmp, Offset: 016A1000, based on PE: false
                  Similarity
                  • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                  • String ID:
                  • API String ID: 254469556-0
                  • Opcode ID: 0a66e42ee8abbf029dee5d03207df54b7c97a14d2f45d1586f376912f3b96011
                  • Instruction ID: 5ec9ce3b5eb6a3ad8e37c4340eadf57207c538d0424a163a7049b5a0c802dca0
                  • Opcode Fuzzy Hash: 0a66e42ee8abbf029dee5d03207df54b7c97a14d2f45d1586f376912f3b96011
                  • Instruction Fuzzy Hash: 0D3106B5D412199BDB21DFA4DD89BCCBBF8AF08300F5041AAE509AB240EB709A84CF04

                  Executed Functions

                  Function 00007FF63850AC90 Relevance: 79.3, APIs: 30, Strings: 15, Instructions: 531filewindowCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: File$ErrorFormatLastMessageNamePointer$CreatePathReadShort$ConsoleCtrlDirectoryFeatureHandlerModulePresentProcessor
                  • String ID: $%TEMP%\onefile_%PID%_%TIME%$A$C:\Users\user\AppData\Local\Temp\\onefile_8740_133646291825138024$C:\Users\user\AppData\Local\Temp\\onefile_8740_133646291825138024\pygame\transform.pyd$C:\Users\user\AppData\Local\Temp\\onefile_8740_133646291825138024\staged_out.exe$Error, couldn't runtime expand temporary directory pattern:$Error, failed to access unpacked executable.$Error, failed to locate onefile filename.$Error, failed to open '%ls' for writing.$Error, failed to register signal handler.$K$NUITKA_ONEFILE_PARENT$Y$\dont-search-path
                  • API String ID: 3937968633-1244315316
                  • Opcode ID: 052ab336f62f6aacd9355f45df89163515396c9a00b8d4c695212a01258f1c53
                  • Instruction ID: 88500e5a9c0e0be9e614923702630a51307be3e8e4ff0b20fbe7a519ed8b3549
                  • Opcode Fuzzy Hash: 052ab336f62f6aacd9355f45df89163515396c9a00b8d4c695212a01258f1c53
                  • Instruction Fuzzy Hash: BC328263A0868282EB909B31E8507FA73A1FF847B8F404535D94D837A5EF7EE445E709
                  Function 00007FF63850AB70 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 49synchronizationwindowCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: CloseConsoleCtrlErrorEventFileFormatGenerateHandleLastMessageObjectOperationProcessSingleWait
                  • String ID: C:\Users\user\AppData\Local\Temp\\onefile_8740_133646291825138024$Failed to send CTRL-C to child process.
                  • API String ID: 4185614815-952338065
                  • Opcode ID: f561157c7c38a756df84a534cdef40b17fd149feedbf9c903231cf1b92af38a4
                  • Instruction ID: fd37f5fa107e14cfde2d678115209e1ca0ca00cdd3d2862210521f117969cd5b
                  • Opcode Fuzzy Hash: f561157c7c38a756df84a534cdef40b17fd149feedbf9c903231cf1b92af38a4
                  • Instruction Fuzzy Hash: 2121E972A48B8286E7908B75F8503AA77A5FF857A4F140135E68EC2764DF3EE448D708
                  Function 00007FF63850B860 Relevance: 6.1, APIs: 4, Instructions: 94COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
                  • String ID:
                  • API String ID: 1452418845-0
                  • Opcode ID: dce74b2f6d7858518ca18e5687f89e643830ad491a290fb219cca55f8439f985
                  • Instruction ID: e91a783f45df0f83a4fac9266006a43d9d5ee278fc6d283ebe775354b5e2f2b7
                  • Opcode Fuzzy Hash: dce74b2f6d7858518ca18e5687f89e643830ad491a290fb219cca55f8439f985
                  • Instruction Fuzzy Hash: 75314C93E0C20746FAE4ABB594913F922929F5176CF400434E94DCB3E3DE6FA404A24A
                  Function 00007FF63850F594 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: Process$CurrentExitTerminate
                  • String ID:
                  • API String ID: 1703294689-0
                  • Opcode ID: 4055f651c0c246543d5ac86e3fd3dbac438b4a14224d2e6117c2b18e0789028f
                  • Instruction ID: cf0d4ddcab1ea8c7e842e231a5eb671679c3c98caf7c2219215f84409473972a
                  • Opcode Fuzzy Hash: 4055f651c0c246543d5ac86e3fd3dbac438b4a14224d2e6117c2b18e0789028f
                  • Instruction Fuzzy Hash: 85D06C96B4860243EA98AF7058990FA22516F587BAB101478C88BC6392DD3EE809A248
                  Function 00007FF638515A84 Relevance: 3.0, APIs: 2, Instructions: 19COMMON
                  Download Yara Rule
                  APIs
                  • RtlDeleteBoundaryDescriptor.NTDLL(?,?,00000000,00007FF638519996,?,?,?,00007FF6385199D3,?,?,00000000,00007FF638519ECD,?,?,?,00007FF638519DFF), ref: 00007FF638515A9A
                  • GetLastError.KERNEL32(?,?,00000000,00007FF638519996,?,?,?,00007FF6385199D3,?,?,00000000,00007FF638519ECD,?,?,?,00007FF638519DFF), ref: 00007FF638515AA4
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: BoundaryDeleteDescriptorErrorLast
                  • String ID:
                  • API String ID: 2050971199-0
                  • Opcode ID: ce0948fecc9d7e54df5e8f4da5652d1466c4ce4fa1bfae00bf0852d8f715b78b
                  • Instruction ID: 85b726e44b472c09a2728ab463469c5ff1b374781f73b63e2d09cf3ff692debc
                  • Opcode Fuzzy Hash: ce0948fecc9d7e54df5e8f4da5652d1466c4ce4fa1bfae00bf0852d8f715b78b
                  • Instruction Fuzzy Hash: 2EE0E653F4964243FF949FB158D50F511565F94771F444034C90DC6351DE3EA885A758
                  Function 00007FF63850F4C5 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: HandleModule$AddressFreeLibraryProc
                  • String ID:
                  • API String ID: 3947729631-0
                  • Opcode ID: cbfdff3f66ec1cb61838929dfd3c134f9ff58d4689a51f64f2205533c134c9c9
                  • Instruction ID: 63d47229328a3062e274c1cb2da476ec15a6b2d6ca74c162fb595a75e65af6d3
                  • Opcode Fuzzy Hash: cbfdff3f66ec1cb61838929dfd3c134f9ff58d4689a51f64f2205533c134c9c9
                  • Instruction Fuzzy Hash: E82171B3A04B019AEBA48F78E4402FC33A0EB4472DF540635D69D86BD5DF39D586D744
                  Function 00007FF6385195B8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: _invalid_parameter_noinfo
                  • String ID:
                  • API String ID: 3215553584-0
                  • Opcode ID: 5e09b996b4f39bdc144a7422a4387001fd20d6f67051bfa4429e62758db17776
                  • Instruction ID: b54eeaf57fa90a7512df7fcecb424d7ba120a1161af0b80694a47ef39ba4719a
                  • Opcode Fuzzy Hash: 5e09b996b4f39bdc144a7422a4387001fd20d6f67051bfa4429e62758db17776
                  • Instruction Fuzzy Hash: 4E118C3390D64282FB909F34A4805A9A3A5FB80B60FD50534E65ED7792CF3EF910EB58
                  Function 00007FF638514F38 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMON
                  Download Yara Rule
                  APIs
                  • RtlAllocateHeap.NTDLL(?,?,00000000,00007FF63851590E,?,?,?,00007FF63851487F,?,?,00000000,00007FF638514B1A), ref: 00007FF638514F8D
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: AllocateHeap
                  • String ID:
                  • API String ID: 1279760036-0
                  • Opcode ID: f02394e12f0b0f412ad0511da1f9294b77fa5c43d3fa51ba5ee621305ff8bc5b
                  • Instruction ID: 839b7f9a457f924839147b78df2b66ee189f4b0194a9843f35598c26430a9803
                  • Opcode Fuzzy Hash: f02394e12f0b0f412ad0511da1f9294b77fa5c43d3fa51ba5ee621305ff8bc5b
                  • Instruction Fuzzy Hash: 75F06D02F1934341FFD55FB194502F922825F84BB2F1CA430D80ECA3C1EE2EE685A218
                  Function 00007FF638516974 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON
                  Download Yara Rule
                  APIs
                  • RtlAllocateHeap.NTDLL(?,?,?,00007FF6385168DD,?,?,?,00007FF638510C58), ref: 00007FF6385169B2
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: AllocateHeap
                  • String ID:
                  • API String ID: 1279760036-0
                  • Opcode ID: 4c0717f1cdc8f8df66da853b8d48a1a3a7913ef375afbb5a9b1904c084483452
                  • Instruction ID: dee0f3fbef49bd4322ffee3e5c51c68196edb40174c6e5096775940a9617099d
                  • Opcode Fuzzy Hash: 4c0717f1cdc8f8df66da853b8d48a1a3a7913ef375afbb5a9b1904c084483452
                  • Instruction Fuzzy Hash: 0EF0D412A4E24286FEE56EB169916F511C25F847B1F184634D82EC63C1DE2EE541A118

                  Non-executed Functions

                  Function 00007FF63850BD58 Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                  • String ID:
                  • API String ID: 3140674995-0
                  • Opcode ID: ecc87c728d9134544b44de582408ed54e050f4d2a6405b8fa837f0fbd0d40c3a
                  • Instruction ID: b49042f7a39e825c569b5cb92b35d3d49b1acbab4fa2f1b98e7e519b314b1f92
                  • Opcode Fuzzy Hash: ecc87c728d9134544b44de582408ed54e050f4d2a6405b8fa837f0fbd0d40c3a
                  • Instruction Fuzzy Hash: 06314F73609A8186EBA09F70E8807EA7360FB84758F44403ADB4E87B98DF3DD648D714
                  Function 00007FF6385148F0 Relevance: 9.1, APIs: 6, Instructions: 83COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                  • String ID:
                  • API String ID: 1239891234-0
                  • Opcode ID: 10b7bcf8786016dded377023b6a3d83c6c99cbcb26a7ee9cb633963b1d815aa9
                  • Instruction ID: 9ebe16e92067ee3cc14e0df26552afa1a0a70677f401475e891a60d7ea420756
                  • Opcode Fuzzy Hash: 10b7bcf8786016dded377023b6a3d83c6c99cbcb26a7ee9cb633963b1d815aa9
                  • Instruction Fuzzy Hash: 3D318437618B8186DBA0CF35E8406EE73A1FB847A9F500135EA9D83B55DF3DD1459704
                  Function 00007FF638518370 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: FileFindFirst_invalid_parameter_noinfo
                  • String ID:
                  • API String ID: 2227656907-0
                  • Opcode ID: 18e4e6ac8f53bf10a4fa7cd60f3a5f7228ba7ba0aed65be2a3402df0291c35ed
                  • Instruction ID: 638c13cc6b959c1d792c022b33fe0cd0730d3d4265796105116e49590bf502e0
                  • Opcode Fuzzy Hash: 18e4e6ac8f53bf10a4fa7cd60f3a5f7228ba7ba0aed65be2a3402df0291c35ed
                  • Instruction Fuzzy Hash: 57B1C227B1869241EEB19F3199402FA63A1EB54BF8F444131EA5D8BB85DF7EE441E308
                  Function 00007FF63851A11C Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: HeapProcess
                  • String ID:
                  • API String ID: 54951025-0
                  • Opcode ID: 9c72b5a89da4e52dbf914038315902266e436a9e788fb0955957fe8c3ebdc79d
                  • Instruction ID: 2f49bff2aba0de061b49e5b20dfb8c76e83dc3aecb5157c95470ccba63267d2c
                  • Opcode Fuzzy Hash: 9c72b5a89da4e52dbf914038315902266e436a9e788fb0955957fe8c3ebdc79d
                  • Instruction Fuzzy Hash: 4EB09221E47A02C2EA982B227C8265422A46F88720FA90178C00CC0320EE2D20E5AB14
                  Function 00007FF63850A440 Relevance: 26.4, APIs: 1, Strings: 14, Instructions: 196COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID:
                  • String ID: %TEMP%\onefile_%PID%_%TIME%$%lld$5.3.0.0-5...3...0...0$C:\Users\user\AppData\Local\Temp\\onefile_8740_133646291825138024$CACHE_DIR$COMPANY$HOME$PID$PRODUCT$PROGRAM$TEMP$TIME$VERSION$updatelogic
                  • API String ID: 0-3644340937
                  • Opcode ID: 713767e04934b2dfda0d1b5df6f1d0a54cf91e4dcb0e3adfa77639c17ba4703b
                  • Instruction ID: 6ff2afe5191de6d585e4254fc0fe5825c105a5e4c108c9dcf50f7744807c172d
                  • Opcode Fuzzy Hash: 713767e04934b2dfda0d1b5df6f1d0a54cf91e4dcb0e3adfa77639c17ba4703b
                  • Instruction Fuzzy Hash: 8E81B6A7E1968381EEA19F30E4112F973A5FF507A8F945031C64D86395EF3EE54AE308
                  Function 00007FF638515AC0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117libraryloaderCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: AddressFreeLibraryProc
                  • String ID: %TEMP%\onefile_%PID%_%TIME%$api-ms-$ext-ms-
                  • API String ID: 3013587201-527191339
                  • Opcode ID: 33b2eb8f39e01a37c98db0153a76e138676b2a97e3f530989414cb1786bc45c0
                  • Instruction ID: 355c9dc6bd675a97fea2620073223e76868ca9cc803900d82e5e5e8d18186edf
                  • Opcode Fuzzy Hash: 33b2eb8f39e01a37c98db0153a76e138676b2a97e3f530989414cb1786bc45c0
                  • Instruction Fuzzy Hash: 0D41AB23B19A0242EE96DF26A8005F663A5BF48BF4F494535DD1EC7784EE3EE445A308
                  Function 00007FF63850DFC0 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                  • String ID: csm$csm$csm
                  • API String ID: 849930591-393685449
                  • Opcode ID: c44cdab44309f536c8643caebba11c9f696316a535538b6a18482a3c6b83000f
                  • Instruction ID: 68d08894bd853d654c96827ac0307e4dbed962f392023e7d0bb69746bd5c64b5
                  • Opcode Fuzzy Hash: c44cdab44309f536c8643caebba11c9f696316a535538b6a18482a3c6b83000f
                  • Instruction Fuzzy Hash: 14E15EB3A0878186EBA49B75D4402ED77A0FB457ACF240135EE8D97B95CF39E480D709
                  Function 00007FF63850CBD4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMON
                  Download Yara Rule
                  APIs
                  • LoadLibraryExW.KERNEL32(?,?,?,00007FF63850CE86,?,?,?,00007FF63850CB78,?,?,00000001,00007FF63850C3E1), ref: 00007FF63850CC59
                  • GetLastError.KERNEL32(?,?,?,00007FF63850CE86,?,?,?,00007FF63850CB78,?,?,00000001,00007FF63850C3E1), ref: 00007FF63850CC67
                  • LoadLibraryExW.KERNEL32(?,?,?,00007FF63850CE86,?,?,?,00007FF63850CB78,?,?,00000001,00007FF63850C3E1), ref: 00007FF63850CC91
                  • FreeLibrary.KERNEL32(?,?,?,00007FF63850CE86,?,?,?,00007FF63850CB78,?,?,00000001,00007FF63850C3E1), ref: 00007FF63850CCD7
                  • GetProcAddress.KERNEL32(?,?,?,00007FF63850CE86,?,?,?,00007FF63850CB78,?,?,00000001,00007FF63850C3E1), ref: 00007FF63850CCE3
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: Library$Load$AddressErrorFreeLastProc
                  • String ID: api-ms-
                  • API String ID: 2559590344-2084034818
                  • Opcode ID: be524e1eb67e573fc5b475188c4d948c4325beb85c5a9406d03dd95f9e823d66
                  • Instruction ID: 0268c47f89aee202efa6e461d38fe70520f73c30b135fb316a3d41348531f036
                  • Opcode Fuzzy Hash: be524e1eb67e573fc5b475188c4d948c4325beb85c5a9406d03dd95f9e823d66
                  • Instruction Fuzzy Hash: 0031D863B1AA4281EE91DB26E4405F52794FF09BF8F990535DD2E8B344EF3DE8419309
                  Function 00007FF638515678 Relevance: 10.6, APIs: 7, Instructions: 62COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: Value$ErrorLast
                  • String ID:
                  • API String ID: 2506987500-0
                  • Opcode ID: 0cc5402b84f758c4271f1aa16c01f6fae8a308a818b5928784db28093582c4bf
                  • Instruction ID: 2c20933e160c36e6c39d122122ca886989a89ab434116e0b69763d21011d9ce5
                  • Opcode Fuzzy Hash: 0cc5402b84f758c4271f1aa16c01f6fae8a308a818b5928784db28093582c4bf
                  • Instruction Fuzzy Hash: 31218022F4D24242FED49F3195511F96641AF447F4F540A34E82EC6BD6DE3EB441A208
                  Function 00007FF63851EE78 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                  • String ID: CONOUT$
                  • API String ID: 3230265001-3130406586
                  • Opcode ID: 0e00cd62a7a3902094f99b322ee7b8ee2f62b63f95ad0485e1596a5f5d8da048
                  • Instruction ID: 399fc6ced4823d5b6f02c8aa8871c10cfcae1b107004be36e21228651a6506f1
                  • Opcode Fuzzy Hash: 0e00cd62a7a3902094f99b322ee7b8ee2f62b63f95ad0485e1596a5f5d8da048
                  • Instruction Fuzzy Hash: 34116623B58A8187EB908B62E85436563A0FB58FF4F044234DE5DC7B94DF7DD8448748
                  Function 00007FF6385157F0 Relevance: 9.1, APIs: 6, Instructions: 57COMMON
                  Download Yara Rule
                  APIs
                  • GetLastError.KERNEL32(?,?,?,00007FF638515A6D,?,?,?,?,00007FF638514F9F,?,?,00000000,00007FF63851590E,?,?,?), ref: 00007FF6385157FF
                  • FlsSetValue.KERNEL32(?,?,?,00007FF638515A6D,?,?,?,?,00007FF638514F9F,?,?,00000000,00007FF63851590E,?,?,?), ref: 00007FF638515835
                  • FlsSetValue.KERNEL32(?,?,?,00007FF638515A6D,?,?,?,?,00007FF638514F9F,?,?,00000000,00007FF63851590E,?,?,?), ref: 00007FF638515862
                  • FlsSetValue.KERNEL32(?,?,?,00007FF638515A6D,?,?,?,?,00007FF638514F9F,?,?,00000000,00007FF63851590E,?,?,?), ref: 00007FF638515873
                  • FlsSetValue.KERNEL32(?,?,?,00007FF638515A6D,?,?,?,?,00007FF638514F9F,?,?,00000000,00007FF63851590E,?,?,?), ref: 00007FF638515884
                  • SetLastError.KERNEL32(?,?,?,00007FF638515A6D,?,?,?,?,00007FF638514F9F,?,?,00000000,00007FF63851590E,?,?,?), ref: 00007FF63851589F
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: Value$ErrorLast
                  • String ID:
                  • API String ID: 2506987500-0
                  • Opcode ID: ee148f4be8cfe0799c57237698451a0f6a95b5cdf6484c952ce5099f24ac6d61
                  • Instruction ID: f85d77b6692bd5b69f884bf2957bc68952514d4d6933b4534d527c24fcad3b86
                  • Opcode Fuzzy Hash: ee148f4be8cfe0799c57237698451a0f6a95b5cdf6484c952ce5099f24ac6d61
                  • Instruction Fuzzy Hash: D1115C22E4D24242FEE4AF7195451FE6642AF487B4F640634E83EC67D6DE3EE441A308
                  Function 00007FF63850C1E0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                  • String ID: csm$f
                  • API String ID: 2395640692-629598281
                  • Opcode ID: f8130a11db687009fa6639b95c5e07baec577d4d4f843acdabcdbd7737b3c783
                  • Instruction ID: 1f466383c01fda36def4e7958c39994971c84308174b8d60eaafc7fd4b588a19
                  • Opcode Fuzzy Hash: f8130a11db687009fa6639b95c5e07baec577d4d4f843acdabcdbd7737b3c783
                  • Instruction Fuzzy Hash: 8251A373A1960286DB94CB35E404AED3795FB46BECF108135DA4A87788DF7AEC41E708
                  Function 00007FF63850F5EC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: AddressFreeHandleLibraryModuleProc
                  • String ID: CorExitProcess$mscoree.dll
                  • API String ID: 4061214504-1276376045
                  • Opcode ID: 2af3b227ae15d0f77a1e21f18893b17dba8bef6b3a8307e3f86ec068823517b4
                  • Instruction ID: f44d5b53aa772e176b66be900f5809ca70d6763c47a3188c33d280027f796401
                  • Opcode Fuzzy Hash: 2af3b227ae15d0f77a1e21f18893b17dba8bef6b3a8307e3f86ec068823517b4
                  • Instruction Fuzzy Hash: 26F06267A0864682EF548B34E4853BA6360AF447B5F941239CA6EC53F4DF3EE449E708
                  Function 00007FF63851F2B0 Relevance: 7.6, APIs: 5, Instructions: 56COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: _set_statfp
                  • String ID:
                  • API String ID: 1156100317-0
                  • Opcode ID: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
                  • Instruction ID: b4d0407904fc085d3ee83a02245adf4c2e1472ce5c960c57a5b11121542adc68
                  • Opcode Fuzzy Hash: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
                  • Instruction Fuzzy Hash: 77116D23E1CA0353FED42939E8527F910416F55374F580634E97EC67DB8E2EAC82610C
                  Function 00007FF6385158B8 Relevance: 7.6, APIs: 5, Instructions: 54COMMON
                  Download Yara Rule
                  APIs
                  • FlsGetValue.KERNEL32(?,?,?,00007FF63851487F,?,?,00000000,00007FF638514B1A), ref: 00007FF6385158D7
                  • FlsSetValue.KERNEL32(?,?,?,00007FF63851487F,?,?,00000000,00007FF638514B1A), ref: 00007FF6385158F6
                  • FlsSetValue.KERNEL32(?,?,?,00007FF63851487F,?,?,00000000,00007FF638514B1A), ref: 00007FF63851591E
                  • FlsSetValue.KERNEL32(?,?,?,00007FF63851487F,?,?,00000000,00007FF638514B1A), ref: 00007FF63851592F
                  • FlsSetValue.KERNEL32(?,?,?,00007FF63851487F,?,?,00000000,00007FF638514B1A), ref: 00007FF638515940
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: Value
                  • String ID:
                  • API String ID: 3702945584-0
                  • Opcode ID: 70f22fd26877e26fd1f5677f389258ae140429eb9c16d658f2141398dd3b6569
                  • Instruction ID: 6359965aa3c0e95c5571f0a38b1ed2ef96dd717477f9ff7a3e2db17164e0c3cd
                  • Opcode Fuzzy Hash: 70f22fd26877e26fd1f5677f389258ae140429eb9c16d658f2141398dd3b6569
                  • Instruction Fuzzy Hash: 94117C22F0C24241FEE89F31A5911FE2546AF457B4F584735E83D867C6DE3EA441E209
                  Function 00007FF63851574C Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: Value
                  • String ID:
                  • API String ID: 3702945584-0
                  • Opcode ID: b5b63efb44819eb330ac4f3abc49f6f7f56682563c3d2faa27d9153c1f484041
                  • Instruction ID: c5caf3e0ffa7a8203f667cd09994e289f8424239b5873b91fdc175a123b7e56b
                  • Opcode Fuzzy Hash: b5b63efb44819eb330ac4f3abc49f6f7f56682563c3d2faa27d9153c1f484041
                  • Instruction Fuzzy Hash: 62111E26E4920781FDE8AF3194521F915859F453B4F581B34D83ECABD3DD3EB485B208
                  Function 00007FF63850E498 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: CallEncodePointerTranslator
                  • String ID: MOC$RCC
                  • API String ID: 3544855599-2084237596
                  • Opcode ID: 0be028d7ac0c4ec896316e1f9103cf6cce5ef8834604ae2c1fa05adb49898076
                  • Instruction ID: ee5a143db1450400ba99ffa1b19f7741751d2854f31066d06a68fc7754565a84
                  • Opcode Fuzzy Hash: 0be028d7ac0c4ec896316e1f9103cf6cce5ef8834604ae2c1fa05adb49898076
                  • Instruction Fuzzy Hash: 6C6189B3A08A458AEB608F75E0403ED77A0FB44BACF244225EE8D57B98DF39E455C704
                  Function 00007FF63850E7F4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                  • String ID: csm$csm
                  • API String ID: 3896166516-3733052814
                  • Opcode ID: 2548dea0f533b99c0f1a3f359ddf3b70687b80a6ff4ae413730ab8f4a98dda38
                  • Instruction ID: 071e09921c35a481834395a963d1750d4bf632aea8742e81e2d4af078936452d
                  • Opcode Fuzzy Hash: 2548dea0f533b99c0f1a3f359ddf3b70687b80a6ff4ae413730ab8f4a98dda38
                  • Instruction Fuzzy Hash: C051B1B394868286EFB48B7595443A877A0FB44BA8F244135DA8DC7BD5CF3DE450E708
                  Function 00007FF63851A8F0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: FileWrite$ConsoleErrorLastOutput
                  • String ID:
                  • API String ID: 2718003287-0
                  • Opcode ID: 3361e7b0a4a01c86be7f689050dcb8175c18a7f7fa488bd35ccabded482c3f68
                  • Instruction ID: 61f5e9a7c2fb84b976f0ddd5325143be6fe0b39964fa88ba13915f3000d07eb1
                  • Opcode Fuzzy Hash: 3361e7b0a4a01c86be7f689050dcb8175c18a7f7fa488bd35ccabded482c3f68
                  • Instruction Fuzzy Hash: 4DD1FE73B18A818AEB52CF75D4402EC37B1FB44BA8B204236CE5D97B99DE3AD446D304
                  Function 00007FF63851B218 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                  Download Yara Rule
                  APIs
                  • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF63851B203), ref: 00007FF63851B334
                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FF63851B203), ref: 00007FF63851B3BF
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: ConsoleErrorLastMode
                  • String ID:
                  • API String ID: 953036326-0
                  • Opcode ID: d26b7108da04b1d6ade1a439dc006868cde7a2577c5aa964054f66e6243fd7d4
                  • Instruction ID: 5432bb8b04d9efd034674aca01c22e732a99236b14740f49fc23fb9f9c9a6660
                  • Opcode Fuzzy Hash: d26b7108da04b1d6ade1a439dc006868cde7a2577c5aa964054f66e6243fd7d4
                  • Instruction Fuzzy Hash: 1691B163A0865185FFA08F7594802FD3BA1BB04BA8F544139DE0ED7794DE3ED481E309
                  Function 00007FF63850BC38 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                  • String ID:
                  • API String ID: 2933794660-0
                  • Opcode ID: 266c0d6f6f968f6a4e115eca7bdf0b44c9a17825bcc9060ec7015ac9a463f65a
                  • Instruction ID: 5377db13ff3495c119df4f1617a323a3261dc702ad452f374c67ad246e72b53a
                  • Opcode Fuzzy Hash: 266c0d6f6f968f6a4e115eca7bdf0b44c9a17825bcc9060ec7015ac9a463f65a
                  • Instruction Fuzzy Hash: 5D113C22B54F018AEB40CF70E8552F933A4FB197A8F440E35DA6D867A4EF7CE1998344
                  Function 00007FF6385137AC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                  Download Yara Rule
                  APIs
                  • _invalid_parameter_noinfo.LIBCMT ref: 00007FF6385137DE
                    • Part of subcall function 00007FF638515A84: RtlDeleteBoundaryDescriptor.NTDLL(?,?,00000000,00007FF638519996,?,?,?,00007FF6385199D3,?,?,00000000,00007FF638519ECD,?,?,?,00007FF638519DFF), ref: 00007FF638515A9A
                    • Part of subcall function 00007FF638515A84: GetLastError.KERNEL32(?,?,00000000,00007FF638519996,?,?,?,00007FF6385199D3,?,?,00000000,00007FF638519ECD,?,?,?,00007FF638519DFF), ref: 00007FF638515AA4
                  • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF63850B7D1), ref: 00007FF6385137FC
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: BoundaryDeleteDescriptorErrorFileLastModuleName_invalid_parameter_noinfo
                  • String ID: C:\Users\user\AppData\Local\Temp\apt66ext.exe
                  • API String ID: 3976345311-2449261364
                  • Opcode ID: addb991eec39e7f9dcc760c3be5645f43ef13cf5583ab8fbc0d0e601c7c435c7
                  • Instruction ID: 58a4ad68c5917b568d68b99fcf03fc258411ccb7be45563ed746b6a73eb3ba8d
                  • Opcode Fuzzy Hash: addb991eec39e7f9dcc760c3be5645f43ef13cf5583ab8fbc0d0e601c7c435c7
                  • Instruction Fuzzy Hash: 30416C37A08B4296EF94DF31E8900F827A5EB85BA4B544035E94E87B95DF3EE4859308
                  Function 00007FF63851AF88 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: ErrorFileLastWrite
                  • String ID: U
                  • API String ID: 442123175-4171548499
                  • Opcode ID: edccec16b3022fd624643ca2c3d557c552a0589b9f395fd33be6678bad1b8261
                  • Instruction ID: 8ecbde114b1f8153075a545e1f67d8121670ced42742ef8a92dff482525ccc5e
                  • Opcode Fuzzy Hash: edccec16b3022fd624643ca2c3d557c552a0589b9f395fd33be6678bad1b8261
                  • Instruction Fuzzy Hash: 8B419F63A18A8586DBA0CF25E4443EA77A0FB88BA4F444031EE4DC7798EF7DD445D705
                  Function 00007FF638514484 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: _invalid_parameter_noinfo
                  • String ID: %TEMP%\onefile_%PID%_%TIME%
                  • API String ID: 3215553584-1520714333
                  • Opcode ID: b6f9d8ebf31fa66e504c26de95435c2f10ec97f2079d01c6a1c89ddd030fe641
                  • Instruction ID: cd006163a4558d41e166aa0fad921500406bb5cfdffb5b9b071062f98affcab8
                  • Opcode Fuzzy Hash: b6f9d8ebf31fa66e504c26de95435c2f10ec97f2079d01c6a1c89ddd030fe641
                  • Instruction Fuzzy Hash: CF413C67E0C75281EEA18F3190803F936E2AB44BB6F595131E98D873D5DE3ED681E708
                  Function 00007FF63850F320 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: ExceptionFileHeaderRaise
                  • String ID: csm
                  • API String ID: 2573137834-1018135373
                  • Opcode ID: 6cc3a245ac0ed7d0591d0cdb94bad24c90f55041f70c360502f369ebfc4c35ec
                  • Instruction ID: 1024b183ccf1002bcd6655b4e38e9a4b1088a826bd13ce25653907f414e309ff
                  • Opcode Fuzzy Hash: 6cc3a245ac0ed7d0591d0cdb94bad24c90f55041f70c360502f369ebfc4c35ec
                  • Instruction Fuzzy Hash: CA113033618B4182EBA18F25F44029A77E5FB88BA8F584231DE8C87758DF3DD5518B04
                  Function 00007FF63850A8E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21windowCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • C:\Users\user\AppData\Local\Temp\\onefile_8740_133646291825138024, xrefs: 00007FF63850A8E0
                  Memory Dump Source
                  • Source File: 00000014.00000002.2283969613.00007FF638501000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF638500000, based on PE: true
                  • Associated: 00000014.00000002.2283947232.00007FF638500000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284112581.00007FF638521000.00000002.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF63852E000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638531000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638533000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284139590.00007FF638536000.00000004.00000001.01000000.00000008.sdmpDownload File
                  • Associated: 00000014.00000002.2284244537.00007FF63853F000.00000002.00000001.01000000.00000008.sdmpDownload File
                  Similarity
                  • API ID: ErrorFormatLastMessage
                  • String ID: C:\Users\user\AppData\Local\Temp\\onefile_8740_133646291825138024
                  • API String ID: 3479602957-1811222430
                  • Opcode ID: 1e81388750679c601e3fd34f20a9a7a594047ab76ede4be05ed85ff58875150a
                  • Instruction ID: a66f63a3f5d39838da9acc3a6ee30db3fd072344031b16f7ac28a0e0f90fc61c
                  • Opcode Fuzzy Hash: 1e81388750679c601e3fd34f20a9a7a594047ab76ede4be05ed85ff58875150a
                  • Instruction Fuzzy Hash: 7AE065A3A18B4147D7909731B40019677A0AB8C7A4F040131DA4EC6764EE3DD1854748

                  Non-executed Functions

                  Function 6788DAE0 Relevance: 107.2, APIs: 40, Strings: 21, Instructions: 413COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Read$Error$L_callocL_free
                  • String ID: AIFF$Bad AIFF file (no COMM chunk)$Bad AIFF file (no SSND chunk)$Bad WAV file (no DATA chunk)$Bad WAV file (no FMT chunk)$COMM$Couldn't read %d bytes from WAV file$FORM$Out of memory$RIFF$SSND$Unknown PCM data format$Unknown WAVE data format$Unknown WAVE format$Unknown samplesize in data format$Unrecognized file type (not AIFF)$WAVE$Wave format chunk too small$data$fmt $smpl
                  • API String ID: 2072091600-853149695
                  • Opcode ID: 8b34f66065570afbf2e0271903abc962636e40d0922bc908ff1007dcae85c994
                  • Instruction ID: 5516cda170ee37b41aa470011dca8bb15d992fe04c187bd00f10fad50098a6b9
                  • Opcode Fuzzy Hash: 8b34f66065570afbf2e0271903abc962636e40d0922bc908ff1007dcae85c994
                  • Instruction Fuzzy Hash: 4AE1E03221964486DB08CF2AD45432E77A6FBADB88F504C26DF5947798EF3ACD81C712
                  Function 67885CC0 Relevance: 79.1, APIs: 22, Strings: 23, Instructions: 305COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Read$Error
                  • String ID: 8SVX$8SVX$8SVX$@$AIFF$AIFF$AIFF$AIFF$AIFF$BODY$Bad 8SVX (no BODY chunk)$Bad 8SVX (no VHDR chunk)$Bad AIFF (no COMM chunk)$Bad AIFF (no SSND chunk)$Bad AIFF sample frequency$COMM$FORM$Out of memory$SSND$Unable to read audio data$Unrecognized file type (not AIFF nor 8SVX)$Unsupported AIFF samplesize$VHDR
                  • API String ID: 3978563955-161940102
                  • Opcode ID: 2fc9175a8100607a33c9b2660295ab78bca79300018bb37a1796edf7fbfcc672
                  • Instruction ID: 8be6b3ccff327a29b5940b8dc17f1be3c5e3d7801c3e99ae19b06e67c09002ac
                  • Opcode Fuzzy Hash: 2fc9175a8100607a33c9b2660295ab78bca79300018bb37a1796edf7fbfcc672
                  • Instruction Fuzzy Hash: 29B1D43221978485DB148F2AE85432EB761F7ADB94F845921EFAB47795DF3ECC808B01
                  Function 67886EB0 Relevance: 77.4, APIs: 34, Strings: 10, Instructions: 385COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: ErrorL_memcmp$Audio$BuildConvertL_callocL_freeL_mallocL_memcpyLoad
                  • String ID: Audio device hasn't been opened$Couldn't read first 4 bytes of audio data$Crea$FORM$Mix_LoadWAV_RW with NULL src$No audio data$Out of memory$RIFF$Unrecognized audio format$WAVE
                  • API String ID: 417792382-3017720286
                  • Opcode ID: ebcdc5cf77ca2d24f3ac9c43a5676da713313d3b58285ee6d3de5b892a2d4997
                  • Instruction ID: c9de9c4a6c3e1b51fd8f31b5fec99ffeb3b55fab52be4e18a8c6b34ce32e701b
                  • Opcode Fuzzy Hash: ebcdc5cf77ca2d24f3ac9c43a5676da713313d3b58285ee6d3de5b892a2d4997
                  • Instruction Fuzzy Hash: 1BE1A132309B448AEB14CF6DD85432E63A5FBADB88F4449259F6A47B94EF39CC41CB41
                  Function 6A881820 Relevance: 68.7, APIs: 30, Strings: 9, Instructions: 418COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: Read$Error$Surface$CreateFreeL_strcmp
                  • String ID: CUR$Compressed ICO files not supported$Error reading from ICO$File is not a Windows %s file$ICO$ICO file with unsupported bit count$Unsupported ICO bitmap format$Unsupported or incorrect biClrUsed field$Unsupported or invalid ICO dimensions
                  • API String ID: 3741713136-3655220390
                  • Opcode ID: 9e06aab02bbdd5172d6a46d32db1eb0b00299910a5b0ea19c3782e7b2802d1e3
                  • Instruction ID: 00f89cbec1606e8a9aa90f5b560b3cc605f7aee7155dd288697cafcfe152bba4
                  • Opcode Fuzzy Hash: 9e06aab02bbdd5172d6a46d32db1eb0b00299910a5b0ea19c3782e7b2802d1e3
                  • Instruction Fuzzy Hash: BCE118A270C6448ADB249A2AE81876BBA62F782BCCF454C25CE9A07F65DF3DD541C710
                  Function 710023D0 Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 232COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270895464.0000000071001000.00000020.00000001.01000000.00000029.sdmp, Offset: 71000000, based on PE: true
                  • Associated: 00000016.00000002.2270880501.0000000071000000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270911307.0000000071007000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270926559.000000007100B000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270940910.000000007100C000.00000004.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270955038.000000007100F000.00000008.00000001.01000000.00000029.sdmpDownload File
                  Similarity
                  • API ID: Error$L_mallocL_memset$CharmapSelect_Set_Size
                  • String ID: Can't seek in stream$Couldn't load font file$Couldn't select size$Couldn't select size : no num_fixed_sizes$Couldn't set font size$Library not initialized$Out of memory$Passed a NULL font source
                  • API String ID: 2771789860-3379129167
                  • Opcode ID: 02001742c8cd518bf921a0b06815ba2a084c1228b5de78102e4a9b9dc459a74b
                  • Instruction ID: a8bafa39f7c9e65444ac9386336ef0849a005bad963e2dda09c451f3ea02f9ef
                  • Opcode Fuzzy Hash: 02001742c8cd518bf921a0b06815ba2a084c1228b5de78102e4a9b9dc459a74b
                  • Instruction Fuzzy Hash: C871BC32B0460586FB12DF39E8647A937A2B788F94F848166CE0F47754EBBDD586C740
                  Function 67894200 Relevance: 31.9, APIs: 16, Strings: 2, Instructions: 409COMMON
                  Download Yara Rule
                  APIs
                  • calloc.MSVCRT(?,?,?,?,?,?,?,?,00000000,?,?,?,?,?,67894A57), ref: 67894220
                  • free.MSVCRT(?,?,?,?,?,?,?,?,00000000,?,?,?,?,?,67894A57), ref: 67894263
                  • calloc.MSVCRT ref: 67894321
                  • malloc.MSVCRT ref: 678943E7
                  • SDL_SetError.SDL2 ref: 678943FC
                  • free.MSVCRT ref: 67894418
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: callocfree$Errormalloc
                  • String ID: MThd$Out of memory
                  • API String ID: 1111589278-1728361875
                  • Opcode ID: 1cd61adb71117e34f42cd669d780b26d20527c19caf91d23e934ea8b52fbf1fc
                  • Instruction ID: d76558b6bd80ba282c012a86f8628a394dac88021bce613618626a976c4be92e
                  • Opcode Fuzzy Hash: 1cd61adb71117e34f42cd669d780b26d20527c19caf91d23e934ea8b52fbf1fc
                  • Instruction Fuzzy Hash: 08E1F37230678486EB048F5AA45076B67A1FBE9BC9F144835EFAD4BB55EB3DD840CB00
                  Function 6788C660 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 182COMMON
                  Download Yara Rule
                  APIs
                  • SDL_calloc.SDL2 ref: 6788C687
                  • SDL_memset.SDL2 ref: 6788C6E7
                  • SDL_free.SDL2 ref: 6788C7AB
                  • SDL_strdup.SDL2 ref: 6788C7C1
                  • SDL_strchr.SDL2 ref: 6788C7D1
                  • SDL_strcasecmp.SDL2 ref: 6788C7E8
                  • SDL_strcasecmp.SDL2 ref: 6788C7F7
                  • SDL_strtoull.SDL2 ref: 6788C80E
                  • SDL_strlen.SDL2 ref: 6788C856
                  • SDL_SetError.SDL2 ref: 6788C937
                  • SDL_free.SDL2 ref: 6788C941
                    • Part of subcall function 6788C540: SDL_memcpy.SDL2 ref: 6788C591
                    • Part of subcall function 6788C540: SDL_free.SDL2 ref: 6788C5A2
                    • Part of subcall function 6788C540: SDL_FreeAudioStream.SDL2 ref: 6788C5BE
                    • Part of subcall function 6788C540: SDL_NewAudioStream.SDL2 ref: 6788C5F5
                    • Part of subcall function 6788C540: SDL_malloc.SDL2 ref: 6788C619
                  • SDL_Error.SDL2 ref: 6788C952
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: L_free$AudioErrorL_strcasecmpStream$FreeL_callocL_mallocL_memcpyL_memsetL_strchrL_strdupL_strlenL_strtoull
                  • String ID: LOOPEND$LOOPLENGTH$LOOPSTART$Not an Ogg Vorbis audio stream
                  • API String ID: 432391984-1497601839
                  • Opcode ID: 21bdf80d3832a977e4dbc90b5702d29f3bc7f6b2c1bc182a074a86086a502f53
                  • Instruction ID: 4db0fdd6156ad6c7ee6b3baa5e78f61b9038f7abc8ae26322e7dc31776913be7
                  • Opcode Fuzzy Hash: 21bdf80d3832a977e4dbc90b5702d29f3bc7f6b2c1bc182a074a86086a502f53
                  • Instruction Fuzzy Hash: B7611532349B408AEB098F2DE90435A7269FB99B94F404B75DFAD47788EF38C9518741
                  Function 710030A0 Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 329COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270895464.0000000071001000.00000020.00000001.01000000.00000029.sdmp, Offset: 71000000, based on PE: true
                  • Associated: 00000016.00000002.2270880501.0000000071000000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270911307.0000000071007000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270926559.000000007100B000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270940910.000000007100C000.00000004.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270955038.000000007100F000.00000008.00000001.01000000.00000029.sdmpDownload File
                  Similarity
                  • API ID: ErrorSurface$BlendL_memsetMode$CreateGet_KerningL_strlen
                  • String ID: Couldn't find glyph$Library not initialized$Passed a NULL pointer$Text has zero width
                  • API String ID: 4059292409-850195060
                  • Opcode ID: fb302c6c5516cfd782928ac4dedaefda3da64e10c4faea4011bdee9da72c17c7
                  • Instruction ID: 678471ac8dd04ac4b1622a0116b397bf4d92fe7af1ae098b7ed57b7d8e102b68
                  • Opcode Fuzzy Hash: fb302c6c5516cfd782928ac4dedaefda3da64e10c4faea4011bdee9da72c17c7
                  • Instruction Fuzzy Hash: 07D1D3326097808BE712CF19E68475FBBB2F785B94F448116EB894BB68DB3CD445CB40
                  Function 6A889BF0 Relevance: 24.8, APIs: 9, Strings: 5, Instructions: 333COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • Error reading the PNG file., xrefs: 6A889F60
                  • Couldn't create image information for PNG file, xrefs: 6A88A05B, 6A88A155
                  • Out of memory, xrefs: 6A88A12D
                  • 1.6.37, xrefs: 6A889C4D
                  • Couldn't allocate memory for PNG file or incompatible PNG dll, xrefs: 6A88A032
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: Surface$ColorCreateErrorFreeL_freeL_malloc_setjmp
                  • String ID: 1.6.37$Couldn't allocate memory for PNG file or incompatible PNG dll$Couldn't create image information for PNG file$Error reading the PNG file.$Out of memory
                  • API String ID: 3970683649-1842331973
                  • Opcode ID: f9a897bb115249727ef29c5f1d30b3e7224f5e9124635bcaa43fb11b899a435f
                  • Instruction ID: 7b4a03ccf3f119dbdd94d0bf4e25a4aced944fb26ea6cd8812f73c85a161ef80
                  • Opcode Fuzzy Hash: f9a897bb115249727ef29c5f1d30b3e7224f5e9124635bcaa43fb11b899a435f
                  • Instruction Fuzzy Hash: ABF16776B09B108DEB10CBA9E88479D7BB1F789B98F054516DE8E67BA8DF39C045C700
                  Function 6A8858F0 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 350COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: L_free$CreateErrorL_callocSurface
                  • String ID: Out of memory$decoding out of bounds (corrupt?)$file truncated$unsupported PCX format
                  • API String ID: 2324966149-4087549087
                  • Opcode ID: c2d6b70538f64d8cfdc288a925809c41d8fb79f4678a4d4f3d9f97f44bf3cd92
                  • Instruction ID: 30da56b450a9a69c560cdce243302fab5799981066ee9ee7f63961415586c4e1
                  • Opcode Fuzzy Hash: c2d6b70538f64d8cfdc288a925809c41d8fb79f4678a4d4f3d9f97f44bf3cd92
                  • Instruction Fuzzy Hash: F7D115B230C7908AEB288F29E4543AE7B61F785B88F014816DF8A17B59DF3DD595CB00
                  Function 71003820 Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 284COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270895464.0000000071001000.00000020.00000001.01000000.00000029.sdmp, Offset: 71000000, based on PE: true
                  • Associated: 00000016.00000002.2270880501.0000000071000000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270911307.0000000071007000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270926559.000000007100B000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270940910.000000007100C000.00000004.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270955038.000000007100F000.00000008.00000001.01000000.00000029.sdmpDownload File
                  Similarity
                  • API ID: Error$Surface$BlendCreateFreeGet_KerningL_strlenMode
                  • String ID: Couldn't find glyph$Library not initialized$Passed a NULL pointer$Text has zero width
                  • API String ID: 3712999362-850195060
                  • Opcode ID: 74195b001d46f6c78ceab27f12cc92b70f6a5e4082942d34a11e6e24045e460a
                  • Instruction ID: a857500adbb37b244fd0a986f26da558dd257b484745fc757498a8e1d30c8fa6
                  • Opcode Fuzzy Hash: 74195b001d46f6c78ceab27f12cc92b70f6a5e4082942d34a11e6e24045e460a
                  • Instruction Fuzzy Hash: 99B1E2727146808FE726CF15E588B9BBBB6F785F84F849126DB4A4BB04DB39D146CB00
                  Function 6A889130 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 259COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: L_memset$L_mallocL_memcpy$L_free
                  • String ID: )$IDAT
                  • API String ID: 1563426658-2982913435
                  • Opcode ID: 33e12482f1102b46bc45b48bbe2aee3fc2bd33ea64b52ae9d5f478a0dce8c6f0
                  • Instruction ID: 66536df069859f2a5969a9e37725f1fa5b3a5573e25ddc9a15e4d015c1c2c5c9
                  • Opcode Fuzzy Hash: 33e12482f1102b46bc45b48bbe2aee3fc2bd33ea64b52ae9d5f478a0dce8c6f0
                  • Instruction Fuzzy Hash: CFB1E172218B8086E754CF3AE84839E77A2F785B88F448525DF994BB98DF7DC145CB40
                  Function 6A893360 Relevance: 22.9, APIs: 15, Instructions: 406COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: L_free$L_memset$L_malloc
                  • String ID:
                  • API String ID: 687963837-0
                  • Opcode ID: a2b5284250ca7bacfaf96c749338c76745f3ec37010e61e246a386d081726455
                  • Instruction ID: fd24a9c3c3cb77af140d010fbba42bc85e6f40ea3ea8ea5a82ecaff43d4a251b
                  • Opcode Fuzzy Hash: a2b5284250ca7bacfaf96c749338c76745f3ec37010e61e246a386d081726455
                  • Instruction Fuzzy Hash: 4F02A632A18B8885D716CB3F94413AAF760EFAE744F09CB26DA4937675DF25A441D700
                  Function 6A890B92 Relevance: 22.8, APIs: 15, Instructions: 319COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: L_fabsf$L_sqrtf$L_cosfL_sinf$L_acosf
                  • String ID:
                  • API String ID: 1321304594-0
                  • Opcode ID: 3b242f5645249e725f0fc54a51a152a3a3f45a2f1ebd7093bcc0e676c94c7341
                  • Instruction ID: 0bb8debfcb6db72c6e65e1c799a5d71b1f8202d1f2956b19182004260b96ec23
                  • Opcode Fuzzy Hash: 3b242f5645249e725f0fc54a51a152a3a3f45a2f1ebd7093bcc0e676c94c7341
                  • Instruction Fuzzy Hash: 13E12662D28B8C4AD213D63B54822A6F6609FBF1C5F1DDF07B94031D76DB69B0D5AE00
                  Function 6A88A370 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 263COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: CreateL_freeSurface
                  • String ID: Out of memory$Unable to read image width and height$file truncated$unsupported PNM format
                  • API String ID: 800871281-2211407657
                  • Opcode ID: 4f2b61bd746f8e183860545ccb31e9a5bc292e7642f06f1d77f80d57e375676e
                  • Instruction ID: 8cd57d3a85b327348c70d7e1457d1f5f5dfa1b1108d2f52ec6e702d306fd0ef2
                  • Opcode Fuzzy Hash: 4f2b61bd746f8e183860545ccb31e9a5bc292e7642f06f1d77f80d57e375676e
                  • Instruction Fuzzy Hash: E6A1C1B220C7808ADB24CF69E41432AFBA1FB85B88F465815DE8A57BD9DF7DD445CB00
                  Function 71002B30 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 222COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270895464.0000000071001000.00000020.00000001.01000000.00000029.sdmp, Offset: 71000000, based on PE: true
                  • Associated: 00000016.00000002.2270880501.0000000071000000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270911307.0000000071007000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270926559.000000007100B000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270940910.000000007100C000.00000004.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270955038.000000007100F000.00000008.00000001.01000000.00000029.sdmpDownload File
                  Similarity
                  • API ID: Error$L_memset$L_strlen
                  • String ID: Couldn't find glyph$Library not initialized$Passed a NULL pointer$Text has zero width
                  • API String ID: 3616659634-850195060
                  • Opcode ID: 3cecc11fca74086c1cd84c72186fec6cdfd4e254180b964188c3b4f776a92f97
                  • Instruction ID: 257aaee18d83b9280bf52e48a5d50e488b334d8edb73e213ee13d099f8c444c2
                  • Opcode Fuzzy Hash: 3cecc11fca74086c1cd84c72186fec6cdfd4e254180b964188c3b4f776a92f97
                  • Instruction Fuzzy Hash: 9281D0367046808AEB25DF25D448B5ABBB6FB84F98F458156EF4E07B18DB38D845CB40
                  Function 6A894C8F Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 295COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: CreateErrorSurface
                  • String ID: $Out of memory$Unsupported TGA format
                  • API String ID: 2690087185-2036120875
                  • Opcode ID: 283f6cf9cf742f8e7841b72ebe0781d28a62d028a222191c08ead1bc2a99b2a1
                  • Instruction ID: 0bb7a191954587f6b427a0525b62acf8e0e228a2e6706a196bf59828ab18774e
                  • Opcode Fuzzy Hash: 283f6cf9cf742f8e7841b72ebe0781d28a62d028a222191c08ead1bc2a99b2a1
                  • Instruction Fuzzy Hash: 5FC1DEB260C7C48AD7248B6EE44036EBFA1F3C6B94F058516DAA947B99DF7DC149CB00
                  Function 6A8911D3 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 253COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: L_strchr$L_powL_strtoll
                  • String ID: 0123456789+-.eE$L$l
                  • API String ID: 850652520-954793120
                  • Opcode ID: d48a93b64aeaee53abf328d58b9ad839a5898d43c9d7075b6a6f3f4e2b892634
                  • Instruction ID: 4b9571a029868e426ddfd36635ebc55abe95cc2e74919039f516991df9d45d5d
                  • Opcode Fuzzy Hash: d48a93b64aeaee53abf328d58b9ad839a5898d43c9d7075b6a6f3f4e2b892634
                  • Instruction Fuzzy Hash: 2D914922B0C7C808FB22863E44063FBAA615FAB7C9F494F16CE95569B7DF2D9161C740
                  Function 67895016 Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                  Download Yara Rule
                  APIs
                  • RtlCaptureContext.KERNEL32 ref: 6789502A
                  • RtlLookupFunctionEntry.KERNEL32 ref: 67895041
                  • RtlVirtualUnwind.KERNEL32 ref: 6789507F
                  • SetUnhandledExceptionFilter.KERNEL32 ref: 678950DB
                  • UnhandledExceptionFilter.KERNEL32 ref: 678950E8
                  • GetCurrentProcess.KERNEL32 ref: 678950EE
                  • TerminateProcess.KERNEL32 ref: 678950FC
                  • abort.MSVCRT ref: 67895102
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtualabort
                  • String ID:
                  • API String ID: 4278921479-0
                  • Opcode ID: bec8f4b66753a5ef4c42f4eeb9e38348e079f794680704f10f83612498f5d0b1
                  • Instruction ID: 1629f8ef7daf90ca3d61dba6e5516c704f3d24d0b9a0c647269af07afd29f1c0
                  • Opcode Fuzzy Hash: bec8f4b66753a5ef4c42f4eeb9e38348e079f794680704f10f83612498f5d0b1
                  • Instruction Fuzzy Hash: 52210A3569AB00DDEB14CF6AE84839933B6F758789F540126EA4D47724EF3AC9658B00
                  Function 71004FA6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                  Download Yara Rule
                  APIs
                  • RtlCaptureContext.KERNEL32 ref: 71004FBA
                  • RtlLookupFunctionEntry.KERNEL32 ref: 71004FD1
                  • RtlVirtualUnwind.KERNEL32 ref: 7100500F
                  • SetUnhandledExceptionFilter.KERNEL32 ref: 7100506B
                  • UnhandledExceptionFilter.KERNEL32 ref: 71005078
                  • GetCurrentProcess.KERNEL32 ref: 7100507E
                  • TerminateProcess.KERNEL32 ref: 7100508C
                  • abort.MSVCRT ref: 71005092
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270895464.0000000071001000.00000020.00000001.01000000.00000029.sdmp, Offset: 71000000, based on PE: true
                  • Associated: 00000016.00000002.2270880501.0000000071000000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270911307.0000000071007000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270926559.000000007100B000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270940910.000000007100C000.00000004.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270955038.000000007100F000.00000008.00000001.01000000.00000029.sdmpDownload File
                  Similarity
                  • API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtualabort
                  • String ID:
                  • API String ID: 4278921479-0
                  • Opcode ID: e730c24f6f4270940dc3a4ec1c5317ac22a5d8da0afda9877f8524cf5714b4cc
                  • Instruction ID: 02cbd4e9e713b7b4eabf97c202d3c3cf87c28786783bfd239303b3b1fc4bac6c
                  • Opcode Fuzzy Hash: e730c24f6f4270940dc3a4ec1c5317ac22a5d8da0afda9877f8524cf5714b4cc
                  • Instruction Fuzzy Hash: 9D211576A29F04C4FB008B69F8843C933B4B70CB84F545126EA4E437A4EFBCD6A58390
                  Function 6AEE6866 Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                  Download Yara Rule
                  APIs
                  • RtlCaptureContext.KERNEL32 ref: 6AEE687A
                  • RtlLookupFunctionEntry.KERNEL32 ref: 6AEE6891
                  • RtlVirtualUnwind.KERNEL32 ref: 6AEE68CF
                  • SetUnhandledExceptionFilter.KERNEL32 ref: 6AEE692B
                  • UnhandledExceptionFilter.KERNEL32 ref: 6AEE6938
                  • GetCurrentProcess.KERNEL32 ref: 6AEE693E
                  • TerminateProcess.KERNEL32 ref: 6AEE694C
                  • abort.MSVCRT ref: 6AEE6952
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtualabort
                  • String ID:
                  • API String ID: 4278921479-0
                  • Opcode ID: 12faca6cc4106f70200f2e2d691e526c259b01aeeb8d6c39f0cfe91e75aca8e7
                  • Instruction ID: 7b66e89c02a78bbc3dc56d8ac0dee509e659578bbb070eddf423f38373b3b98e
                  • Opcode Fuzzy Hash: 12faca6cc4106f70200f2e2d691e526c259b01aeeb8d6c39f0cfe91e75aca8e7
                  • Instruction Fuzzy Hash: BD213531B01B44C4FB40ABA1FC5038933A6BB0A784F544139DA4D63725EF3AC9658B06
                  Function 62E925B6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                  Download Yara Rule
                  APIs
                  • RtlCaptureContext.KERNEL32 ref: 62E925CA
                  • RtlLookupFunctionEntry.KERNEL32 ref: 62E925E1
                  • RtlVirtualUnwind.KERNEL32 ref: 62E9261F
                  • SetUnhandledExceptionFilter.KERNEL32 ref: 62E9267B
                  • UnhandledExceptionFilter.KERNEL32 ref: 62E92688
                  • GetCurrentProcess.KERNEL32 ref: 62E9268E
                  • TerminateProcess.KERNEL32 ref: 62E9269C
                  • abort.MSVCRT ref: 62E926A2
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270152250.0000000062E81000.00000020.00000001.01000000.0000001D.sdmp, Offset: 62E80000, based on PE: true
                  • Associated: 00000016.00000002.2270136370.0000000062E80000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270171204.0000000062E95000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270187075.0000000062E9E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270203868.0000000062E9F000.00000004.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270219476.0000000062EA2000.00000008.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270233416.0000000062EA3000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  Similarity
                  • API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtualabort
                  • String ID:
                  • API String ID: 4278921479-0
                  • Opcode ID: 669cd68fe5e985a9d4a1e79e9051a6a7a2a070ba74b8f0ce93d1884096bf3e8c
                  • Instruction ID: cd9161d1f211651673fb50b37096ee6ec02e81ca05da223bd404b289846ad51b
                  • Opcode Fuzzy Hash: 669cd68fe5e985a9d4a1e79e9051a6a7a2a070ba74b8f0ce93d1884096bf3e8c
                  • Instruction Fuzzy Hash: A6211539E02F1095EB00AB66F85038933A6F758788F608137ED4D43B24EF3AC5A58740
                  Function 6A8982C6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                  Download Yara Rule
                  APIs
                  • RtlCaptureContext.KERNEL32 ref: 6A8982DA
                  • RtlLookupFunctionEntry.KERNEL32 ref: 6A8982F1
                  • RtlVirtualUnwind.KERNEL32 ref: 6A89832F
                  • SetUnhandledExceptionFilter.KERNEL32 ref: 6A89838B
                  • UnhandledExceptionFilter.KERNEL32 ref: 6A898398
                  • GetCurrentProcess.KERNEL32 ref: 6A89839E
                  • TerminateProcess.KERNEL32 ref: 6A8983AC
                  • abort.MSVCRT ref: 6A8983B2
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtualabort
                  • String ID:
                  • API String ID: 4278921479-0
                  • Opcode ID: 994c5cbf3f7475b2312e3a01705947069f88c610c126bb3c9abf1ed96280918b
                  • Instruction ID: d9e1f4eceb01e6e7a0f721719b09924f3d4d60d85404b7e67387cc6689a92772
                  • Opcode Fuzzy Hash: 994c5cbf3f7475b2312e3a01705947069f88c610c126bb3c9abf1ed96280918b
                  • Instruction Fuzzy Hash: F7211735715F018DEB40AB6AF88039937B5F74AB94F800126DA4E23B34EF7AC165CB01
                  Function 68B632A6 Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                  Download Yara Rule
                  APIs
                  • RtlCaptureContext.KERNEL32 ref: 68B632BA
                  • RtlLookupFunctionEntry.KERNEL32 ref: 68B632D1
                  • RtlVirtualUnwind.KERNEL32 ref: 68B6330F
                  • SetUnhandledExceptionFilter.KERNEL32 ref: 68B6336B
                  • UnhandledExceptionFilter.KERNEL32 ref: 68B63378
                  • GetCurrentProcess.KERNEL32 ref: 68B6337E
                  • TerminateProcess.KERNEL32 ref: 68B6338C
                  • abort.MSVCRT ref: 68B63392
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtualabort
                  • String ID:
                  • API String ID: 4278921479-0
                  • Opcode ID: e2d0e57e0a3f5476eb55858617c80a222f4f4c5a0a8e88d3deb2bebad8f85a2b
                  • Instruction ID: c3de94f1ca25c818b10f02bf5c024ad15058ae95654b6965ff6fd7a1e77b27fe
                  • Opcode Fuzzy Hash: e2d0e57e0a3f5476eb55858617c80a222f4f4c5a0a8e88d3deb2bebad8f85a2b
                  • Instruction Fuzzy Hash: B9216935641F40C8EB009B25F88038933B6F78DB95F85A229E94D43B34EF39C1A8C304
                  Function 67891AE0 Relevance: 11.0, APIs: 6, Strings: 1, Instructions: 470COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID:
                  • String ID: data
                  • API String ID: 0-2918445923
                  • Opcode ID: ee09e67e7e1157a4f80ce325000cb414de4e09951d15a571678430ed2debc613
                  • Instruction ID: c6e2332b10d559b7c23de47e4eca2c99f137459ecc08a838c6267654d8a64da8
                  • Opcode Fuzzy Hash: ee09e67e7e1157a4f80ce325000cb414de4e09951d15a571678430ed2debc613
                  • Instruction Fuzzy Hash: 06022832B0964486EB15CF29D4007AAB764F7A9FCCF008936DF5A17B58EB79C982C740
                  Function 69A2C3D0 Relevance: 10.6, APIs: 7, Instructions: 50COMMON
                  Download Yara Rule
                  APIs
                  • RtlCaptureContext.KERNEL32 ref: 69A2C3E4
                  • RtlLookupFunctionEntry.KERNEL32 ref: 69A2C3FB
                  • RtlVirtualUnwind.KERNEL32 ref: 69A2C43D
                  • SetUnhandledExceptionFilter.KERNEL32 ref: 69A2C484
                  • UnhandledExceptionFilter.KERNEL32 ref: 69A2C491
                  • GetCurrentProcess.KERNEL32 ref: 69A2C497
                  • TerminateProcess.KERNEL32 ref: 69A2C4A5
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270515173.0000000069A01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 69A00000, based on PE: true
                  • Associated: 00000016.00000002.2270499163.0000000069A00000.00000002.00000001.01000000.0000001E.sdmpDownload File
                  • Associated: 00000016.00000002.2270543058.0000000069A33000.00000002.00000001.01000000.0000001E.sdmpDownload File
                  • Associated: 00000016.00000002.2270561128.0000000069A3E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                  • Associated: 00000016.00000002.2270576553.0000000069A40000.00000004.00000001.01000000.0000001E.sdmpDownload File
                  • Associated: 00000016.00000002.2270591630.0000000069A43000.00000002.00000001.01000000.0000001E.sdmpDownload File
                  Similarity
                  • API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtual
                  • String ID:
                  • API String ID: 3266983031-0
                  • Opcode ID: 46b2b757db6977a73cd98f866ff5bbf2a593f5852d9ad905e024dcc9474230c4
                  • Instruction ID: fdd15295b7ea0af1f44b2bbb5ccb3161f38f30bb1e724ef3be335bd094e36d02
                  • Opcode Fuzzy Hash: 46b2b757db6977a73cd98f866ff5bbf2a593f5852d9ad905e024dcc9474230c4
                  • Instruction Fuzzy Hash: E1211431212B2099EB408FA1FC8438933FAFB09B88F540126DE4D93B64EF7AC564C781
                  Function 6A8874D0 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 494COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID:
                  • String ID: /
                  • API String ID: 0-2043925204
                  • Opcode ID: 26d1997c53e437a7381fd263bb13ce2da7fe6a863ad5bab0762fa1e30d561a10
                  • Instruction ID: 2bbe71f9eab99110589494423ad84a1b6cbe3a5ef7c29e85aada79193f7a781b
                  • Opcode Fuzzy Hash: 26d1997c53e437a7381fd263bb13ce2da7fe6a863ad5bab0762fa1e30d561a10
                  • Instruction Fuzzy Hash: E62222B76187949BD758DF39C480A5D3BB6F749F88B448A29CE0987B48EF39C845CB40
                  Function 68B58590 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 415COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • internal row logic error, xrefs: 68B58B3E
                  • internal row width error, xrefs: 68B58B2F
                  • internal row size calculation error, xrefs: 68B58838
                  • invalid user transform pixel depth, xrefs: 68B58BA6
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: memcpy
                  • String ID: internal row logic error$internal row size calculation error$internal row width error$invalid user transform pixel depth
                  • API String ID: 3510742995-64619857
                  • Opcode ID: 341d4ee0deb37963fcde2b932abbd1b33406f0978c89f2ee327a85f37a008650
                  • Instruction ID: adcd8aee77989ec785d0eb76d943af40f5faa03ac2129b9a37411ad2feda01ae
                  • Opcode Fuzzy Hash: 341d4ee0deb37963fcde2b932abbd1b33406f0978c89f2ee327a85f37a008650
                  • Instruction Fuzzy Hash: 35D16DA3BF95D08ACB198E35D4247BA7B51F342BC4F88D215CE3A17B44DA39C561CB02
                  Function 6A886590 Relevance: 6.4, APIs: 4, Instructions: 443COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: L_memset
                  • String ID:
                  • API String ID: 4214007356-0
                  • Opcode ID: f58d612417deff995b0688f581c6c7e46ff16d5bb12076f902b696b39899234f
                  • Instruction ID: bad7a0797a105f262e74e1c8bd5f44d6fbdf75598c218f0d65f5ac96b4152ed8
                  • Opcode Fuzzy Hash: f58d612417deff995b0688f581c6c7e46ff16d5bb12076f902b696b39899234f
                  • Instruction Fuzzy Hash: 43F114B3B28A6596CB24CF28D4407AD7761F785B8CF428636DB5A43B48EF3AD505CB40
                  Function 6AED6550 Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 359COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID:
                  • String ID: VUUU$VUUU$stib
                  • API String ID: 0-3384839924
                  • Opcode ID: 86f750a632285473b1531c77e8bd64c9c48c8cc63554ca89bb8c03b7572b3282
                  • Instruction ID: bba6a9c72797babccd7b274276f40b8cd09c8c2aa5de017931ce4ce7e946f31c
                  • Opcode Fuzzy Hash: 86f750a632285473b1531c77e8bd64c9c48c8cc63554ca89bb8c03b7572b3282
                  • Instruction Fuzzy Hash: ECE17FB76146848BD750DF2AE444B1EBBA1F385B98F245115EF9A87B28DF38D441CF40
                  Function 68B64209 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 292COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: _errno
                  • String ID: pow
                  • API String ID: 2918714741-2276729525
                  • Opcode ID: 9b37364aa135c37d4cca4033f70eeaefa757048f2544fc7b006156eac6971a31
                  • Instruction ID: f2a3563f7a6291ab338dc55b857b8cb07fd98e2011648f618572d8aaf3a8c659
                  • Opcode Fuzzy Hash: 9b37364aa135c37d4cca4033f70eeaefa757048f2544fc7b006156eac6971a31
                  • Instruction Fuzzy Hash: 19A19A12958EC5C5E7325A34A87139F6356EF937F0FA0A322EA9136455EF29D4C74340
                  Function 6AEC5EB0 Relevance: 5.5, APIs: 4, Instructions: 496COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c07e73d903a8a0228c1d952498c97c6d6a01d7eb6dc21431396ac50b0b350194
                  • Instruction ID: f07ca915a94d5058257e751f7b25af1245911b18e3834168aa588b9d6a6e2b85
                  • Opcode Fuzzy Hash: c07e73d903a8a0228c1d952498c97c6d6a01d7eb6dc21431396ac50b0b350194
                  • Instruction Fuzzy Hash: 0A0244327046848ADB18CF28E6A03AEB762F781B8CF645116DF6A4B749FF39D145C702
                  Function 62E83510 Relevance: 5.4, APIs: 4, Instructions: 416COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270152250.0000000062E81000.00000020.00000001.01000000.0000001D.sdmp, Offset: 62E80000, based on PE: true
                  • Associated: 00000016.00000002.2270136370.0000000062E80000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270171204.0000000062E95000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270187075.0000000062E9E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270203868.0000000062E9F000.00000004.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270219476.0000000062EA2000.00000008.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270233416.0000000062EA3000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: ee367737586054b8c350f0bc5d12d78c7b3bb1bde405c0f267e98c589dc8dd5f
                  • Instruction ID: b733170c441d893c56e6c245ec3bd1b44b9d913032c731ace10e81ce0674a7a6
                  • Opcode Fuzzy Hash: ee367737586054b8c350f0bc5d12d78c7b3bb1bde405c0f267e98c589dc8dd5f
                  • Instruction Fuzzy Hash: 391222B6600A818BC714CF3AD465BDA37A1F758B8CF58813ADF898B708DB39D455CB50
                  Function 67889BF0 Relevance: 121.0, APIs: 37, Strings: 32, Instructions: 243filestringCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: L_strcasecmp$FileFromL_callocstrrchr
                  • String ID: 669$AMF$AMS$Couldn't open '%s'$DBM$DSM$FAR$FLAC$KAR$MAD$MDL$MED$MID$MIDI$MOD$MOL$MP3$MPEG$MPG$MTM$NST$OGG$OKT$OPUS$Out of memory$PTM$S3M$STM$ULT$UMX$WAV$WOW
                  • API String ID: 2770661273-911361207
                  • Opcode ID: 3a1f1b20f2aae0b620c48a7d1274537368c78dc319971ecede0b3bb9a7ea71e9
                  • Instruction ID: bcf32620ec078d7b6f6641ae02c70a90d9bab9379bd8afaec45feea51ef11ddc
                  • Opcode Fuzzy Hash: 3a1f1b20f2aae0b620c48a7d1274537368c78dc319971ecede0b3bb9a7ea71e9
                  • Instruction Fuzzy Hash: BB814A2138470254FF09DF2EED2CB7512565BAD7CAF8468358E1E8B294EF29CE44C791
                  Function 6A889700 Relevance: 103.4, APIs: 30, Strings: 29, Instructions: 190COMMON
                  Download Yara Rule
                  APIs
                  • SDL_LoadObject.SDL2(?,?,?,?,6A8813F5), ref: 6A889727
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813F5), ref: 6A889746
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813F5), ref: 6A889769
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813F5), ref: 6A88978C
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813F5), ref: 6A8897AF
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813F5), ref: 6A8897D2
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813F5), ref: 6A8897F5
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813F5), ref: 6A889818
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813F5), ref: 6A88983B
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813F5), ref: 6A88985E
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813F5), ref: 6A889881
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813F5), ref: 6A8898A4
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813F5), ref: 6A8898C7
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813F5), ref: 6A8898EA
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813F5), ref: 6A88990D
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813F5), ref: 6A889930
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813F5), ref: 6A889953
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: Load$Function$Object
                  • String ID: libpng16-16.dll$png_create_info_struct$png_create_read_struct$png_create_write_struct$png_destroy_read_struct$png_destroy_write_struct$png_get_IHDR$png_get_PLTE$png_get_channels$png_get_io_ptr$png_get_tRNS$png_get_valid$png_read_image$png_read_info$png_read_update_info$png_set_IHDR$png_set_PLTE$png_set_expand$png_set_gray_to_rgb$png_set_interlace_handling$png_set_longjmp_fn$png_set_packing$png_set_read_fn$png_set_rows$png_set_strip_16$png_set_write_fn$png_sig_cmp$png_write_info$png_write_png
                  • API String ID: 669370744-770279478
                  • Opcode ID: a72d65ff21e6bbdf92f575d2c87103d44a0624aa73242d7135d650856215d5d2
                  • Instruction ID: e60470943918883d5190defcc63a0e05d97459b109a5d5a46a1b7fefc6e6f5c2
                  • Opcode Fuzzy Hash: a72d65ff21e6bbdf92f575d2c87103d44a0624aa73242d7135d650856215d5d2
                  • Instruction Fuzzy Hash: 0CA18B60706B0688FE41AB19EC9439A33A2BB46384F414C26C59E6B775FF2ED564CB02
                  Function 6A8843F0 Relevance: 61.4, APIs: 18, Strings: 17, Instructions: 118COMMON
                  Download Yara Rule
                  APIs
                  • SDL_LoadObject.SDL2(?,?,?,?,6A8813DA), ref: 6A884417
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813DA), ref: 6A884436
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813DA), ref: 6A884459
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813DA), ref: 6A88447C
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813DA), ref: 6A88449F
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813DA), ref: 6A8844C2
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813DA), ref: 6A8844E5
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813DA), ref: 6A884508
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813DA), ref: 6A88452B
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813DA), ref: 6A88454E
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813DA), ref: 6A884571
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813DA), ref: 6A884594
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813DA), ref: 6A8845B7
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813DA), ref: 6A8845DA
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813DA), ref: 6A8845F9
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813DA), ref: 6A884618
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A8813DA), ref: 6A884637
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: Load$Function$Object
                  • String ID: jpeg_CreateCompress$jpeg_CreateDecompress$jpeg_calc_output_dimensions$jpeg_destroy_compress$jpeg_destroy_decompress$jpeg_finish_compress$jpeg_finish_decompress$jpeg_read_header$jpeg_read_scanlines$jpeg_resync_to_restart$jpeg_set_defaults$jpeg_set_quality$jpeg_start_compress$jpeg_start_decompress$jpeg_std_error$jpeg_write_scanlines$libjpeg-9.dll
                  • API String ID: 669370744-2926489140
                  • Opcode ID: 6e9f4b16eb9b3d8ae433a4aebbb6f5a9a683a9a1479da96be4ee9283bd5a9eb7
                  • Instruction ID: 22ce87f98be80c2d07ed45085207d518c39f779388ff8dc581b18aaf60553618
                  • Opcode Fuzzy Hash: 6e9f4b16eb9b3d8ae433a4aebbb6f5a9a683a9a1479da96be4ee9283bd5a9eb7
                  • Instruction Fuzzy Hash: 9251BD71B0AB0688FE42EB1CEC9435533B66B8A754F414827C55E6B275FF6DD068CB01
                  Function 6788BA30 Relevance: 57.9, APIs: 17, Strings: 16, Instructions: 112COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Load$Function$Object
                  • String ID: libmpg123-0.dll$mpg123_close$mpg123_delete$mpg123_exit$mpg123_format$mpg123_format_none$mpg123_getformat$mpg123_init$mpg123_new$mpg123_open_handle$mpg123_plain_strerror$mpg123_rates$mpg123_read$mpg123_replace_reader_handle$mpg123_seek$mpg123_strerror
                  • API String ID: 669370744-3627390553
                  • Opcode ID: 8c256a041cb11824b399c8840477ff275a3673b06b6bb0d7b8fec5959141e9c6
                  • Instruction ID: 8255a1193f57017d9b9928496a208b16c6949e8ba3f38282e9393effb6b1c33e
                  • Opcode Fuzzy Hash: 8c256a041cb11824b399c8840477ff275a3673b06b6bb0d7b8fec5959141e9c6
                  • Instruction Fuzzy Hash: A1517E7429AB06C9EE09CB5DF8587E527636BB8358F800926961C4B374EF7ACC75CB40
                  Function 6A88FCC0 Relevance: 52.7, APIs: 22, Strings: 8, Instructions: 201COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: L_strcmp$L_strlcpy$L_mallocL_memsetL_sscanf
                  • String ID: gradientTransform$gradientUnits$objectBoundingBox$pad$reflect$repeat$spreadMethod$xlink:href
                  • API String ID: 1566300197-1476087942
                  • Opcode ID: d282fa1655df98eb59cae59134838c9d01c0dd588273e3dd131842cbaeed4336
                  • Instruction ID: f97c4779e8ef84e974ca8d0b943d150cc4944b04da3c394065680a25dbee7a2b
                  • Opcode Fuzzy Hash: d282fa1655df98eb59cae59134838c9d01c0dd588273e3dd131842cbaeed4336
                  • Instruction Fuzzy Hash: 818194A1309A8598EB10DB3EE85435A7771EB46B8CF458821CF5E8B72AEF39D810C751
                  Function 6A883B40 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 297COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • GIF, xrefs: 6A883BB3
                  • couldn't read left/top/width/height, xrefs: 6A88404E
                  • only %d image%s found in file, xrefs: 6A88403D
                  • bad version number, not '87a' or '89a', xrefs: 6A883FA9
                  • UNKNOWN (0x%02x), xrefs: 6A883E9B
                  • 89a, xrefs: 6A883F92
                  • failed to read screen descriptor, xrefs: 6A884001
                  • EOF / read error on image data, xrefs: 6A884023
                  • error reading magic number, xrefs: 6A883E10
                  • error reading global colormap, xrefs: 6A883FF0
                  • error reading local colormap, xrefs: 6A88405F
                  • not a GIF file, xrefs: 6A883D40
                  • 87a, xrefs: 6A883BE3
                  • EOF / read error on extention function code, xrefs: 6A883D0D
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: Error$L_strcmp$L_strncmp
                  • String ID: 87a$89a$EOF / read error on extention function code$EOF / read error on image data$GIF$UNKNOWN (0x%02x)$bad version number, not '87a' or '89a'$couldn't read left/top/width/height$error reading global colormap$error reading local colormap$error reading magic number$failed to read screen descriptor$not a GIF file$only %d image%s found in file
                  • API String ID: 736009629-3053081922
                  • Opcode ID: e73a1794b0d38718bd123c5bb459804fd0c480e433270a0fb7c322849c41c4f5
                  • Instruction ID: dcabf9ba58463bff98cda1b0ca32f488d79f1b6a9bc7a88d672f48dd605104a0
                  • Opcode Fuzzy Hash: e73a1794b0d38718bd123c5bb459804fd0c480e433270a0fb7c322849c41c4f5
                  • Instruction Fuzzy Hash: F5B119B230C7849AE720DB2AE81479ABB61F781B88F450921DE9D47F99DF3DD541DB00
                  Function 67889920 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 185COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error$L_memcmp$Clear
                  • String ID: Couldn't read first 12 bytes of audio data$FORM$Loaded music with %s$OpusHead$Out of memory$RIFF$RWops pointer is NULL$SDL_MIXER_DEBUG_MUSIC_INTERFACES$Unrecognized audio format$WAVE
                  • API String ID: 1957687311-3667610588
                  • Opcode ID: 1caee3f0e1374f80109e64ad934b670a261feb6ec6134cee07c665293600c9e6
                  • Instruction ID: 4ca83d630f43b66aa72fb78cb0a43d2e1cdb7ff634eee8d2c573b0b5e9e27a1e
                  • Opcode Fuzzy Hash: 1caee3f0e1374f80109e64ad934b670a261feb6ec6134cee07c665293600c9e6
                  • Instruction Fuzzy Hash: A251D13235862186EB159F2FD81836D6361ABADFD8F8448208F5B4B794EF39CD86C741
                  Function 6788C980 Relevance: 36.8, APIs: 11, Strings: 10, Instructions: 76COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Load$Function$Object
                  • String ID: libvorbisfile-3.dll$ov_clear$ov_comment$ov_info$ov_open_callbacks$ov_pcm_seek$ov_pcm_tell$ov_pcm_total$ov_read$ov_time_seek
                  • API String ID: 669370744-2240780040
                  • Opcode ID: abcfae99e73ffcef2623e4ea23f4bd9871d48813b33a1962fbec690d850844d9
                  • Instruction ID: f6efc158ceb7d207a985ae0bcef7cdbf107f58abaa4b6c567b24fc3050ead037
                  • Opcode Fuzzy Hash: abcfae99e73ffcef2623e4ea23f4bd9871d48813b33a1962fbec690d850844d9
                  • Instruction Fuzzy Hash: CD31CF74299B0189EF05CB5DFC943A923976BB8348F804B66961D4B375EF7ACC748B40
                  Function 6A886260 Relevance: 35.2, APIs: 13, Strings: 7, Instructions: 191COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • Couldn't create palette for PNG file, xrefs: 6A886552
                  • Couldn't create image information for PNG file, xrefs: 6A88632C
                  • Out of memory, xrefs: 6A886571
                  • 1.6.37, xrefs: 6A886297
                  • Passed NULL dst, xrefs: 6A886522
                  • Couldn't allocate memory for PNG file or incompatible PNG dll, xrefs: 6A886533
                  • Error writing the PNG file., xrefs: 6A886300
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: Error$L_malloc$FreeL_freeSurface_setjmp
                  • String ID: 1.6.37$Couldn't allocate memory for PNG file or incompatible PNG dll$Couldn't create image information for PNG file$Couldn't create palette for PNG file$Error writing the PNG file.$Out of memory$Passed NULL dst
                  • API String ID: 1573974964-338703926
                  • Opcode ID: 5f7d33d06a2f7ca9e44a4b5340872411070615b0061406244031b27f31360ff4
                  • Instruction ID: a04981e0d8e6ae6e6a1dd4d334503d01ec09be4d0af1a148f81e61f5d82b4ce7
                  • Opcode Fuzzy Hash: 5f7d33d06a2f7ca9e44a4b5340872411070615b0061406244031b27f31360ff4
                  • Instruction Fuzzy Hash: 2D818EB2725A4089EB00DFA9D8543AD3B71FB49B88F414822DF4E63B68DF39C099C751
                  Function 6788B020 Relevance: 35.1, APIs: 9, Strings: 11, Instructions: 82COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • FLAC__stream_decoder_process_until_end_of_stream, xrefs: 6788B150
                  • FLAC__stream_decoder_get_state, xrefs: 6788B18E
                  • FLAC__stream_decoder_delete, xrefs: 6788B082
                  • FLAC__stream_decoder_finish, xrefs: 6788B0C8
                  • FLAC__stream_decoder_init_stream, xrefs: 6788B0A5
                  • FLAC__stream_decoder_process_until_end_of_metadata, xrefs: 6788B131
                  • libFLAC-8.dll, xrefs: 6788B040
                  • FLAC__stream_decoder_flush, xrefs: 6788B0EB
                  • FLAC__stream_decoder_new, xrefs: 6788B05C
                  • FLAC__stream_decoder_seek_absolute, xrefs: 6788B16F
                  • FLAC__stream_decoder_process_single, xrefs: 6788B10E
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: FunctionLoad
                  • String ID: FLAC__stream_decoder_delete$FLAC__stream_decoder_finish$FLAC__stream_decoder_flush$FLAC__stream_decoder_get_state$FLAC__stream_decoder_init_stream$FLAC__stream_decoder_new$FLAC__stream_decoder_process_single$FLAC__stream_decoder_process_until_end_of_metadata$FLAC__stream_decoder_process_until_end_of_stream$FLAC__stream_decoder_seek_absolute$libFLAC-8.dll
                  • API String ID: 3436893612-198033950
                  • Opcode ID: e9f0dc0e2cfab3b7171e5cc2aa83ef561bc784e6c56164aac399c7128f74b531
                  • Instruction ID: 5b7cbcb7264b98331080c4fa58b3f760c0bf634bf17fe15b5da61385183b88d0
                  • Opcode Fuzzy Hash: e9f0dc0e2cfab3b7171e5cc2aa83ef561bc784e6c56164aac399c7128f74b531
                  • Instruction Fuzzy Hash: 2841AF74295B02C9EE06CB5DEC543652397ABB8358F840926965C4B374FF3ACC75CB81
                  Function 6A88EA10 Relevance: 30.0, APIs: 11, Strings: 6, Instructions: 248COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: L_strncmp$L_memcpy
                  • String ID: matrix$rotate$scale$skewX$skewY$translate
                  • API String ID: 4002702117-3523891476
                  • Opcode ID: 705e512f9b136092d0432d573c3790b56b6d6655e44c1bc832051264d8d5a8c3
                  • Instruction ID: f888c61c487dcf7c10d5994a74ae788d63a46093457c732cbfb73c4aa0700fee
                  • Opcode Fuzzy Hash: 705e512f9b136092d0432d573c3790b56b6d6655e44c1bc832051264d8d5a8c3
                  • Instruction Fuzzy Hash: 3EC1BC7260C7859AE721CB2AF40439BF3A0FB8A788F544715EA8817A69DF7DD149CF00
                  Function 6788B6F0 Relevance: 29.8, APIs: 9, Strings: 8, Instructions: 64COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Load$Function$Object
                  • String ID: ModPlug_GetSettings$ModPlug_Load$ModPlug_Read$ModPlug_Seek$ModPlug_SetMasterVolume$ModPlug_SetSettings$ModPlug_Unload$libmodplug-1.dll
                  • API String ID: 669370744-1037378451
                  • Opcode ID: 92f5d6d1139f465bdbac4eded985193997a323ffa29db4dd061c1807f7c16c4c
                  • Instruction ID: 0101941e46be819310c6334d3f75fdc56eea137fd759baf7ef76df28a8d07bce
                  • Opcode Fuzzy Hash: 92f5d6d1139f465bdbac4eded985193997a323ffa29db4dd061c1807f7c16c4c
                  • Instruction Fuzzy Hash: E031B030656B02C5EE06DB1DEC543242752ABB935CF804926D61C47370EF3ACC748B80
                  Function 62E870D0 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 227COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270152250.0000000062E81000.00000020.00000001.01000000.0000001D.sdmp, Offset: 62E80000, based on PE: true
                  • Associated: 00000016.00000002.2270136370.0000000062E80000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270171204.0000000062E95000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270187075.0000000062E9E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270203868.0000000062E9F000.00000004.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270219476.0000000062EA2000.00000008.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270233416.0000000062EA3000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  Similarity
                  • API ID: freemalloc$_wopen
                  • String ID: <fd:%d>
                  • API String ID: 2186332492-558891604
                  • Opcode ID: f03e5923769722364ed8ac5c46693a5a7342e8f9761791d4698c87e82ced876b
                  • Instruction ID: 32c34178d44741f92b6e625600e59d5d23604cb418a9652486d791e28fe12db1
                  • Opcode Fuzzy Hash: f03e5923769722364ed8ac5c46693a5a7342e8f9761791d4698c87e82ced876b
                  • Instruction Fuzzy Hash: BC71D276B41A408AEB14CE39987439D3791E7427ACF248639EDAD4F788DB3CC585C381
                  Function 6788D260 Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 58COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Load$Function$Object
                  • String ID: libopusfile-0.dll$op_free$op_head$op_open_callbacks$op_pcm_seek$op_read$op_seekable
                  • API String ID: 669370744-2222010361
                  • Opcode ID: fd13416dce53bc22dbf29e92f69b495d1705bd99fd1cd5047e018ec467306817
                  • Instruction ID: 90739ed9212df4542442079dd6f7423c4cc4ebab4ac8702459ffb16abb6da037
                  • Opcode Fuzzy Hash: fd13416dce53bc22dbf29e92f69b495d1705bd99fd1cd5047e018ec467306817
                  • Instruction Fuzzy Hash: 6A21817024AB0199EE09CF1DF85437823A66BBD75CF944926A61C473A0EF3EDC759B10
                  Function 678890E0 Relevance: 24.7, APIs: 4, Strings: 10, Instructions: 190COMMON
                  Download Yara Rule
                  APIs
                  • SDL_GetHintBoolean.SDL2(?,?,?,?,?,?,6788A484), ref: 678893BB
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: BooleanHint
                  • String ID: Couldn't open %s: %s$FLAC$MID$MIDI$MOD$MP3$OGG$OPUS$SDL_MIXER_DEBUG_MUSIC_INTERFACES$SDL_NATIVE_MUSIC
                  • API String ID: 1212526686-1554975116
                  • Opcode ID: dd40d30e89bccd62155767143fc517828fa7377f4b603e59f2a5445f578b164f
                  • Instruction ID: d1be28319de17e7b6857e5b8d686e6b9519953a57fda0084cca940b151cb5a56
                  • Opcode Fuzzy Hash: dd40d30e89bccd62155767143fc517828fa7377f4b603e59f2a5445f578b164f
                  • Instruction Fuzzy Hash: 3A61813675C605DDEA10DF2AD8483293376B77879CF858822CB1E93210EB39DC64C712
                  Function 6A897E70 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 137COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • Failed to allocate SDL_Surface, xrefs: 6A8980B0
                  • Failed to decode WEBP, xrefs: 6A8980A0
                  • Failed to read WEBP, xrefs: 6A898061
                  • Invalid WEBP, xrefs: 6A898010
                  • WebPGetFeatures has failed, xrefs: 6A898080
                  • Failed to allocate enough buffer for WEBP, xrefs: 6A898090
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: Surface$FreeL_free$CreateErrorL_malloc
                  • String ID: Failed to allocate SDL_Surface$Failed to allocate enough buffer for WEBP$Failed to decode WEBP$Failed to read WEBP$Invalid WEBP$WebPGetFeatures has failed
                  • API String ID: 679056716-2048540261
                  • Opcode ID: 5e598aeed2453df31616a87246be0adaec850defdcee0d510e35f50c7c978d70
                  • Instruction ID: d46741e99156d9b891114289bc46b7d3d7a91a7e1132dbc3edb70d2c0e694900
                  • Opcode Fuzzy Hash: 5e598aeed2453df31616a87246be0adaec850defdcee0d510e35f50c7c978d70
                  • Instruction Fuzzy Hash: 91519072308A048EEB64DB2DE44475ABB70F786B99F140526EE8D43B68DF3EC545CB00
                  Function 6A8953E0 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 52COMMON
                  Download Yara Rule
                  APIs
                  • SDL_LoadObject.SDL2(?,?,?,?,6A881406), ref: 6A895407
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A881406), ref: 6A895426
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A881406), ref: 6A895449
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A881406), ref: 6A895468
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A881406), ref: 6A895487
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A881406), ref: 6A8954A6
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: Load$Function$Object
                  • String ID: TIFFClientOpen$TIFFClose$TIFFGetField$TIFFReadRGBAImageOriented$TIFFSetErrorHandler$libtiff-5.dll
                  • API String ID: 669370744-3390688994
                  • Opcode ID: 5841041f340710e0a8a40dd7086ba1ff3f049f144cabec32bd938e8e7dbed926
                  • Instruction ID: 5bb65ddb6374ae68501c032866d5525eacd16d4e94dfbe386a3af75bc86c1cf0
                  • Opcode Fuzzy Hash: 5841041f340710e0a8a40dd7086ba1ff3f049f144cabec32bd938e8e7dbed926
                  • Instruction Fuzzy Hash: 5821C9A0349B0288FA45EB2DEC943A837A2BB42345F410D17C59D67771FF6EE5648B02
                  Function 68B5A3A0 Relevance: 21.2, APIs: 7, Strings: 7, Instructions: 187stringCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • Insufficient memory for pCAL params, xrefs: 68B5A568
                  • Insufficient memory for pCAL units, xrefs: 68B5A52F
                  • Invalid pCAL parameter count, xrefs: 68B5A636
                  • Invalid pCAL equation type, xrefs: 68B5A42B
                  • Insufficient memory for pCAL purpose, xrefs: 68B5A65E
                  • Invalid format for pCAL parameter, xrefs: 68B5A4A1
                  • Insufficient memory for pCAL parameter, xrefs: 68B5A611
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: strlen$memcpy
                  • String ID: Insufficient memory for pCAL parameter$Insufficient memory for pCAL params$Insufficient memory for pCAL purpose$Insufficient memory for pCAL units$Invalid format for pCAL parameter$Invalid pCAL equation type$Invalid pCAL parameter count
                  • API String ID: 3396830738-1679587341
                  • Opcode ID: b56315ee9cd25a9ce3e08fd40e965d47282601d62e12e93eced7cb5dbb9b33f2
                  • Instruction ID: bc2789a59cd8a3a6d0a05a3a64bec9a760759b06f12dbef8b5aa5363bf6f3684
                  • Opcode Fuzzy Hash: b56315ee9cd25a9ce3e08fd40e965d47282601d62e12e93eced7cb5dbb9b33f2
                  • Instruction Fuzzy Hash: 866103763167C189DB06CF16F9043AA7B65FB49BD8F806121CE692B748EB38C192CB11
                  Function 62E87EF0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 169COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270152250.0000000062E81000.00000020.00000001.01000000.0000001D.sdmp, Offset: 62E80000, based on PE: true
                  • Associated: 00000016.00000002.2270136370.0000000062E80000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270171204.0000000062E95000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270187075.0000000062E9E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270203868.0000000062E9F000.00000004.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270219476.0000000062EA2000.00000008.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270233416.0000000062EA3000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  Similarity
                  • API ID: freemalloc$_readmemcpy
                  • String ID: 1.2.11$out of memory
                  • API String ID: 40971297-1352906565
                  • Opcode ID: 794a8ee1d8cf104a1f9770f9816aefb9466565901adb7c207cc6e520a235a0dd
                  • Instruction ID: 346e2aaea0cc96b14f069dec9a5b878b53a57a563d7f7f21a3dedeb0f9323245
                  • Opcode Fuzzy Hash: 794a8ee1d8cf104a1f9770f9816aefb9466565901adb7c207cc6e520a235a0dd
                  • Instruction Fuzzy Hash: 93517C76B116148AE715CF3AD82075937A1E745FACF609239DEAC4B798DB3AC881C740
                  Function 67886CB0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 103COMMON
                  Download Yara Rule
                  Strings
                  • MP3 support not available, xrefs: 67886DF1
                  • MIDI support not available, xrefs: 67886E24
                  • OPUS support not available, xrefs: 67886E13
                  • OGG support not available, xrefs: 67886E02
                  • FLAC support not available, xrefs: 67886E40
                  • MOD support not available, xrefs: 67886DE0
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID:
                  • String ID: FLAC support not available$MIDI support not available$MOD support not available$MP3 support not available$OGG support not available$OPUS support not available
                  • API String ID: 0-131451679
                  • Opcode ID: c78bb5aeceaacee056ab1cd6e593de24e2824372f76398d2fb82cdbb1e9c1f50
                  • Instruction ID: 43b3c5711e8c2f0285cbdbb983243d5df7e639176ceae0330696dd515745d286
                  • Opcode Fuzzy Hash: c78bb5aeceaacee056ab1cd6e593de24e2824372f76398d2fb82cdbb1e9c1f50
                  • Instruction Fuzzy Hash: 3531C372B6A21545F7046FACED553A912469F7C358F854C388F4E872D2FF2A8C90D603
                  Function 68B5F1A0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91filestringCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • png_image_write_to_file: invalid argument, xrefs: 68B5F2A0
                  • png_image_write_to_file: incorrect PNG_IMAGE_VERSION, xrefs: 68B5F1CC
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: _errnofclosefopenremovestrerror
                  • String ID: png_image_write_to_file: incorrect PNG_IMAGE_VERSION$png_image_write_to_file: invalid argument
                  • API String ID: 3227256967-850184487
                  • Opcode ID: 5e716385136c0cd1ee77e248e448671fd8c2f33456a570de5724197491ef4a34
                  • Instruction ID: beda45300334b97bf57f8927930a567e1e1bfd30b51ccd10d86a9ca220069153
                  • Opcode Fuzzy Hash: 5e716385136c0cd1ee77e248e448671fd8c2f33456a570de5724197491ef4a34
                  • Instruction Fuzzy Hash: D721B66A39628486EA059F56B81077FA351EB8ABE4FC45024AD2547704DF79C4A2C703
                  Function 6A88B160 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 189COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: L_sscanfL_strchrL_strcmpL_strlen
                  • String ID: $%d%[%%, ]%d%[%%, ]%d$($b$g
                  • API String ID: 2652930987-284087616
                  • Opcode ID: 60f643f97ac2fde8f7e8885a0ce98b3f3980195ebd02859e4a4d7e081dee833d
                  • Instruction ID: da8960655ae2ff42f6531c28b7a917c15b6b6178ea29233a7e36693111d56a1f
                  • Opcode Fuzzy Hash: 60f643f97ac2fde8f7e8885a0ce98b3f3980195ebd02859e4a4d7e081dee833d
                  • Instruction Fuzzy Hash: AC610873B1CA904AF7548B2CE80835EB7A2E3C5344F588A25EBA887B5ADF3DC505C740
                  Function 6788BD30 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 113COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • mpg123_replace_reader_handle: %s, xrefs: 6788BE87
                  • mpg123_format_none: %s, xrefs: 6788BEB7
                  • mpg123_open_handle: %s, xrefs: 6788BEE7
                  • mpg123_new failed, xrefs: 6788BE5B
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error$L_callocL_malloc
                  • String ID: mpg123_format_none: %s$mpg123_new failed$mpg123_open_handle: %s$mpg123_replace_reader_handle: %s
                  • API String ID: 2795210825-1411402186
                  • Opcode ID: a023fac5453f84ce31ee330ca790932b4d6f3dd6feb3e11e1696d780fec1ecc6
                  • Instruction ID: ebf444cb3a8e28a8ed167aa661677995d3811a1d5b9cc3c1879e484cf00d1e73
                  • Opcode Fuzzy Hash: a023fac5453f84ce31ee330ca790932b4d6f3dd6feb3e11e1696d780fec1ecc6
                  • Instruction Fuzzy Hash: 06417232249B05CADB20CB6AE49435EA761EBECB88F404526DB4E47764EF3DCD41CB41
                  Function 68B5AD50 Relevance: 18.2, APIs: 8, Strings: 4, Instructions: 201stringCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: memcpy$strlen
                  • String ID: 8$text chunk: out of memory$text compression mode is out of range$too many text chunks
                  • API String ID: 2619041689-1300225907
                  • Opcode ID: de0479b2b741c2d868154ae8d2d54fe19db19cf8eb7988a08751deb449bd521b
                  • Instruction ID: 55eecca92df50a9b4e41bfdfd0ff2da51ed7a0f0200a273299cebd2c0544bf4b
                  • Opcode Fuzzy Hash: de0479b2b741c2d868154ae8d2d54fe19db19cf8eb7988a08751deb449bd521b
                  • Instruction Fuzzy Hash: 5B812172200BC486EB51CF21E488B9E3BA8FB45B94F919221DFA97B744DF38C491CB41
                  Function 68B48A10 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 148COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • IDAT: ADLER32 checksum mismatch, xrefs: 68B49541
                  • Not enough compressed data, xrefs: 68B49782
                  • progressive row overflow, xrefs: 68B48BB2
                  • Decompression error in IDAT, xrefs: 68B49569
                  • No IDAT data (internal error), xrefs: 68B49578
                  • bad adaptive filter value, xrefs: 68B4938D
                  • Truncated compressed data in IDAT, xrefs: 68B49555
                  • TADI, xrefs: 68B4960A
                  • Extra compression data in IDAT, xrefs: 68B49500
                  • Extra compressed data in IDAT, xrefs: 68B494D0
                  • internal progressive row size calculation error, xrefs: 68B4939C
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: memcpy
                  • String ID: Decompression error in IDAT$Extra compressed data in IDAT$Extra compression data in IDAT$IDAT: ADLER32 checksum mismatch$No IDAT data (internal error)$Not enough compressed data$TADI$Truncated compressed data in IDAT$bad adaptive filter value$internal progressive row size calculation error$progressive row overflow
                  • API String ID: 3510742995-1600552616
                  • Opcode ID: bfbd4b4735670cfbc7e1359376f7b94ae530c07e849bcad6ecef0f071f22bc89
                  • Instruction ID: 71a57def4d1858e7a7ff74a9ead34b5367b587b8aa212194cb4ff14d57b3ca6d
                  • Opcode Fuzzy Hash: bfbd4b4735670cfbc7e1359376f7b94ae530c07e849bcad6ecef0f071f22bc89
                  • Instruction Fuzzy Hash: 2651136A36A7E485CB50DF26A4497AD3B21E742F88F8C5035DE490B70DDF3AC146EB50
                  Function 6AECC890 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 216COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID:
                  • String ID: darkening-parameters$default-script$fallback-script$increase-x-height$no-stem-darkening$warping
                  • API String ID: 0-1657319759
                  • Opcode ID: 8bc6254f43fad75a440a070f49205dcc874a83c3ba926e549916f45d6326f873
                  • Instruction ID: a614eeac773552de4cb7f3d32fc9517daa72fb8da514f31cba1688a7ac683f0a
                  • Opcode Fuzzy Hash: 8bc6254f43fad75a440a070f49205dcc874a83c3ba926e549916f45d6326f873
                  • Instruction Fuzzy Hash: CD7124367053519AE728CF26934075D3B6AF3C5788FA99029DEAA17B45EF3DE402C702
                  Function 62E87500 Relevance: 16.7, APIs: 11, Instructions: 163COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270152250.0000000062E81000.00000020.00000001.01000000.0000001D.sdmp, Offset: 62E80000, based on PE: true
                  • Associated: 00000016.00000002.2270136370.0000000062E80000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270171204.0000000062E95000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270187075.0000000062E9E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270203868.0000000062E9F000.00000004.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270219476.0000000062EA2000.00000008.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270233416.0000000062EA3000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  Similarity
                  • API ID: freemalloc
                  • String ID:
                  • API String ID: 3061335427-0
                  • Opcode ID: 85588bfe33cb50f3c3e9560f0dda6b7cc6b5bf2616dce4d95876cfef0f153718
                  • Instruction ID: f952b18bac02f399f6e1c3d5cea7df0be94acdda7918e8db8b7b254dd14e8590
                  • Opcode Fuzzy Hash: 85588bfe33cb50f3c3e9560f0dda6b7cc6b5bf2616dce4d95876cfef0f153718
                  • Instruction Fuzzy Hash: FE51CE7A7056008AEB158F39D56436D3B91E742B5CF648239DA6C4E7C8EB3EC585C780
                  Function 62E86A90 Relevance: 16.6, APIs: 11, Instructions: 146COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270152250.0000000062E81000.00000020.00000001.01000000.0000001D.sdmp, Offset: 62E80000, based on PE: true
                  • Associated: 00000016.00000002.2270136370.0000000062E80000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270171204.0000000062E95000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270187075.0000000062E9E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270203868.0000000062E9F000.00000004.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270219476.0000000062EA2000.00000008.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270233416.0000000062EA3000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  Similarity
                  • API ID: free$_close
                  • String ID:
                  • API String ID: 3165389682-0
                  • Opcode ID: 53288b26e1dbdcc7018ae6fc46242f35be52861488d964b471d55169c69a5f30
                  • Instruction ID: 7e12b61f011d315439c44055fe11807a0e08752fab85dc4e0ebc30a6e9af15b9
                  • Opcode Fuzzy Hash: 53288b26e1dbdcc7018ae6fc46242f35be52861488d964b471d55169c69a5f30
                  • Instruction Fuzzy Hash: AD419033B5451086DB14DE3AD8706692360AB85BAC735D336EDAE9B3D4DB2CCC42C781
                  Function 67886710 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 196COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • VOC data had no sound!, xrefs: 678869D1
                  • Unrecognized file type (not VOC), xrefs: 678869C0
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: L_mallocL_memset
                  • String ID: Unrecognized file type (not VOC)$VOC data had no sound!
                  • API String ID: 4214098910-2890471074
                  • Opcode ID: 75001832de2fd17bc4f802e2701cee00314390896d7a5fc8aa0960bc86f61b6f
                  • Instruction ID: c52e8f684c901183c8d10f367646d2ff1a3816e9b986c112aa3cd42312116b71
                  • Opcode Fuzzy Hash: 75001832de2fd17bc4f802e2701cee00314390896d7a5fc8aa0960bc86f61b6f
                  • Instruction Fuzzy Hash: D061E83632578086DB148F2AD80471A7761FBADBD8F548924DF994BB89EF3DC944CB40
                  Function 68B5FD00 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 140COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: deflate$Init2_
                  • String ID: using zstream$1.2.11$TADI$TADI$X$deflateEnd failed (ignored)$in use by IDAT
                  • API String ID: 4144194033-2902800670
                  • Opcode ID: 12e0cf40da8453346d9062cc1a5e13ac26e6cb5a2a2cce645327eb7ef058601b
                  • Instruction ID: d5439c5278c71e574c5421f68861b0bf408ec60c12b1d9965e51bbe8f1f832e9
                  • Opcode Fuzzy Hash: 12e0cf40da8453346d9062cc1a5e13ac26e6cb5a2a2cce645327eb7ef058601b
                  • Instruction Fuzzy Hash: 86518A726082C08AE711CF25D4083DEB7A0F349B9CF984136DE294BB9CDBB9C596CB11
                  Function 67888000 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 122COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • No free channels available, xrefs: 678880F2
                  • Tried to play a NULL chunk, xrefs: 6788819B
                  • Tried to play a chunk with a bad frame, xrefs: 67888185
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: AudioDeviceError$LockUnlock
                  • String ID: No free channels available$Tried to play a NULL chunk$Tried to play a chunk with a bad frame
                  • API String ID: 3602365329-2722142103
                  • Opcode ID: f0e840a78abc9e4e404a5b9539d4f861a609044b65babe2167ba355ed7b09562
                  • Instruction ID: 484abbfebc01a66baa669bcf9cb15d9d187109f8bdc12394cf11f4df47592d37
                  • Opcode Fuzzy Hash: f0e840a78abc9e4e404a5b9539d4f861a609044b65babe2167ba355ed7b09562
                  • Instruction Fuzzy Hash: E241E0727287098AE7589F1DDC8472936A6FB7D748F444A29DB2887350EB36CC91CB40
                  Function 678887F0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 83COMMON
                  Download Yara Rule
                  APIs
                  • SDL_malloc.SDL2(?,00000001,00000000,?,67884BBB), ref: 67888844
                  • SDL_SetError.SDL2(?,00000001,00000000,?,67884BBB), ref: 67888897
                  • SDL_SetError.SDL2(?,00000001,00000000,?,67884BBB), ref: 678888C7
                  • SDL_SetError.SDL2(?,00000001,00000000,?,67884BBB), ref: 678888F8
                  • SDL_SetError.SDL2(?,00000001,00000000,?,67884BBB), ref: 67888908
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error$L_malloc
                  • String ID: Internal error$Invalid channel number$NULL effect callback$Out of memory
                  • API String ID: 1434575867-1081786704
                  • Opcode ID: 14453033132b8d28fb19496d3c451c75dadbdbe7a51de481a27bde3b92904fe6
                  • Instruction ID: 9e66a91ff7844942ffa656f9119cc1d74502a212ba99691e0c6888d017f6bcc1
                  • Opcode Fuzzy Hash: 14453033132b8d28fb19496d3c451c75dadbdbe7a51de481a27bde3b92904fe6
                  • Instruction Fuzzy Hash: 7421B67375660599FA0A9F2CEC403A82255A7BC7A9F984C349F0D87390EB39CDE1C310
                  Function 67888970 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 79COMMON
                  Download Yara Rule
                  APIs
                  • SDL_SetError.SDL2(?,00000000,00000000,67884B93), ref: 678889F7
                  • SDL_SetError.SDL2(?,00000000,00000000,67884B93), ref: 67888A67
                  • SDL_free.SDL2(?,00000000,00000000,67884B93), ref: 67888A85
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error$L_free
                  • String ID: Internal error$Invalid channel number$No such effect registered
                  • API String ID: 2131358166-1682025351
                  • Opcode ID: ece72047a72624f2335fd4fb8d9380ee53ae9f082dd2e344d09c13b0edd58a25
                  • Instruction ID: 1471a6aa080711cadd55ccfb0ed6c3991b46aa2a6528f9bcefb2404d57ce3ead
                  • Opcode Fuzzy Hash: ece72047a72624f2335fd4fb8d9380ee53ae9f082dd2e344d09c13b0edd58a25
                  • Instruction Fuzzy Hash: F721B23236960484EA558F6EE9403AD2325AB7CB94F8809318B6E5B794DF39DDD1C342
                  Function 6788ACD0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 71COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • FLAC__stream_decoder_new() failed, xrefs: 6788ADF0
                  • FLAC__stream_decoder_init_stream() failed, xrefs: 6788AD93
                  • FLAC__stream_decoder_process_until_end_of_metadata() failed, xrefs: 6788ADC0
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error$L_callocL_free
                  • String ID: FLAC__stream_decoder_init_stream() failed$FLAC__stream_decoder_new() failed$FLAC__stream_decoder_process_until_end_of_metadata() failed
                  • API String ID: 3656619956-3234596698
                  • Opcode ID: 58297971c178b832c55bb5ab1897553cd4c5c133079356e6d907f3cb4a20318a
                  • Instruction ID: bad8bfe8c6110dac102c4c6a23492a78cad56cc409c62e6cb856c3d1766bf24d
                  • Opcode Fuzzy Hash: 58297971c178b832c55bb5ab1897553cd4c5c133079356e6d907f3cb4a20318a
                  • Instruction Fuzzy Hash: 06216F32249B00C5E7018F19F84835973A6F798B89F844526DA4D877E4DF3ECDA6C742
                  Function 68B5A670 Relevance: 15.2, APIs: 4, Strings: 6, Instructions: 168stringCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • Invalid sCAL unit, xrefs: 68B5A7F5
                  • Invalid sCAL width ignored, xrefs: 68B5A8C0
                  • Invalid sCAL height ignored, xrefs: 68B5A8A0
                  • Memory allocation failed while processing sCAL, xrefs: 68B5A7BA
                  • Invalid sCAL width, xrefs: 68B5A7D7
                  • Invalid sCAL height, xrefs: 68B5A7E6
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: memcpystrlen
                  • String ID: Invalid sCAL height$Invalid sCAL height ignored$Invalid sCAL unit$Invalid sCAL width$Invalid sCAL width ignored$Memory allocation failed while processing sCAL
                  • API String ID: 3412268980-2569950517
                  • Opcode ID: 3c0cfce2e6f29b5ae9e38c73318dab0031aac86a91fcb41b038f75a440ea77f1
                  • Instruction ID: ce4f3d651c74ce7e0e290bc4071aa15d669ad507a1b5058cab20684f7f12e396
                  • Opcode Fuzzy Hash: 3c0cfce2e6f29b5ae9e38c73318dab0031aac86a91fcb41b038f75a440ea77f1
                  • Instruction Fuzzy Hash: B841FA677126C044FA169F22BC047BE6661EB4AFD8FC895358E192B748EF38C096D711
                  Function 68B617B0 Relevance: 15.2, APIs: 2, Strings: 8, Instructions: 163stringCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: strlen
                  • String ID: tEXt: invalid keyword$tEXt: text too long$tXEt$tXEt$tXTz$tXTz$zTXt: invalid compression type$zTXt: invalid keyword
                  • API String ID: 39653677-983415896
                  • Opcode ID: 6798c04fdf1bddd16d72688d1a6c2fcc8b4fb6dec9d010c9b7d84883e54a6240
                  • Instruction ID: 323452f2553d366a1bb0815f94e35a6914f00bf6f3bc027708b11a41e0743207
                  • Opcode Fuzzy Hash: 6798c04fdf1bddd16d72688d1a6c2fcc8b4fb6dec9d010c9b7d84883e54a6240
                  • Instruction Fuzzy Hash: DA4125667856D086EA159A67A91037D5350EB87FF8FDC81248E281BB49EF28C2C7C701
                  Function 6AE86B40 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 177stringCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID: strtol
                  • String ID: adobe$darkening-parameters$hinting-engine$no-stem-darkening$random-seed
                  • API String ID: 76114499-3433897967
                  • Opcode ID: 60c945a260a077abb69a66c626744bff04cade5567e9e7e8f0d2a53de6b02617
                  • Instruction ID: 476eee7f9d8566e48551239a04afe6507c8592e343ca540081448516e0a12af5
                  • Opcode Fuzzy Hash: 60c945a260a077abb69a66c626744bff04cade5567e9e7e8f0d2a53de6b02617
                  • Instruction Fuzzy Hash: B35124B27243919AE7258F26D544B5E3B66F3457C8FAA8039CE0C1BB95CF3AD446CB00
                  Function 6788BF60 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 128COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: AudioStream$ErrorFlush
                  • String ID: mpg123_getformat: %s$mpg123_read: %s
                  • API String ID: 842372658-488187233
                  • Opcode ID: b8d3ee4382ed9f09b89188665445d10e153522ed37fb1ee6d2368ccbd23b8a63
                  • Instruction ID: 16319da0f2fbd5df2850828d62fc004b5710a001fe5f037448b3d027be50f504
                  • Opcode Fuzzy Hash: b8d3ee4382ed9f09b89188665445d10e153522ed37fb1ee6d2368ccbd23b8a63
                  • Instruction Fuzzy Hash: DC418F32704A4986DB108F39E85036D37A1E7A9BA8F544B22DF6987398DF39CC818B41
                  Function 6788D130 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 78COMMON
                  Download Yara Rule
                  APIs
                  • SDL_calloc.SDL2 ref: 6788D14F
                  • SDL_memset.SDL2 ref: 6788D181
                  • SDL_SetError.SDL2 ref: 6788D20E
                    • Part of subcall function 6788D040: SDL_free.SDL2 ref: 6788D089
                    • Part of subcall function 6788D040: SDL_FreeAudioStream.SDL2 ref: 6788D09F
                    • Part of subcall function 6788D040: SDL_NewAudioStream.SDL2 ref: 6788D0D5
                    • Part of subcall function 6788D040: SDL_malloc.SDL2 ref: 6788D0F3
                  • SDL_Error.SDL2 ref: 6788D222
                  • SDL_SetError.SDL2 ref: 6788D247
                  • SDL_free.SDL2 ref: 6788D251
                  Strings
                  • Not an Opus audio stream, xrefs: 6788D240
                  • Opus stream not seekable, xrefs: 6788D207
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error$AudioL_freeStream$FreeL_callocL_mallocL_memset
                  • String ID: Not an Opus audio stream$Opus stream not seekable
                  • API String ID: 1755661713-1478100019
                  • Opcode ID: e63d2ecc2588c10a9b72efab7af3d2d297d4e81266b8d4ebcc19f0717969fe75
                  • Instruction ID: 03eef4540d804fb8d9cec15052516e29b652c2a4dd3eb057bd51b307ab5ccb83
                  • Opcode Fuzzy Hash: e63d2ecc2588c10a9b72efab7af3d2d297d4e81266b8d4ebcc19f0717969fe75
                  • Instruction Fuzzy Hash: 04212432349B0089EA009F6DF90431EA265EBADB98F900A369F0D03794EF3DDC95CB10
                  Function 6A8979C0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 75COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: L_memcmp
                  • String ID: #BUILTIN:$#END_OF_COMMENTS$%d %d$P7 332
                  • API String ID: 683559773-3990420408
                  • Opcode ID: 51aa7bf60f7ef172b49d17ae7076ac2c39a1ce9882cec3473bad38b41e34d477
                  • Instruction ID: 67eaddf3b94f5414eebb6aba50ed4f10134bc96ae53fb01950c6e18ab83303c8
                  • Opcode Fuzzy Hash: 51aa7bf60f7ef172b49d17ae7076ac2c39a1ce9882cec3473bad38b41e34d477
                  • Instruction Fuzzy Hash: 4511E9623082058DFA009B6FBC047AF2A566B02BD4F855532EE159F755EF3DC241C700
                  Function 67889870 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 44COMMON
                  Download Yara Rule
                  APIs
                  • SDL_memcmp.SDL2(?,?,00000000,678871E8), ref: 67889885
                  • SDL_memcmp.SDL2(?,?,00000000,678871E8), ref: 678898B0
                  • SDL_memcmp.SDL2(?,?,00000000,678871E8), ref: 678898CE
                  • SDL_memcmp.SDL2(?,?,00000000,678871E8), ref: 678898EC
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: L_memcmp
                  • String ID: ID3$MThd$OggS$fLaC
                  • API String ID: 683559773-3113663369
                  • Opcode ID: b28e6693842ee0b662b17607a35252bb9530c80efa7afe6d19587220a2657475
                  • Instruction ID: 6bea330d1576cc6aa88a91b894aeba8d6949ffbfdbf76296eb4dfaea0469949a
                  • Opcode Fuzzy Hash: b28e6693842ee0b662b17607a35252bb9530c80efa7afe6d19587220a2657475
                  • Instruction Fuzzy Hash: 6701A2D175478252FF108F7ED804366125387A9794F8886318E218F6D8DB3ECD96CB40
                  Function 6AEBABA0 Relevance: 13.9, APIs: 2, Strings: 7, Instructions: 351COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID:
                  • String ID: $COMMENT$DEFAULT_CHAR$FONT_ASCENT$FONT_DESCENT$Hj$SPACING
                  • API String ID: 0-3391101835
                  • Opcode ID: 067752e3316942edc5f25a89ab02020f32a99a7f34ba7012f35fad3d0e5dfc9e
                  • Instruction ID: b067356e40a5919d15abd8dab12ce57265e0c3322c11e381601b5197e71960e3
                  • Opcode Fuzzy Hash: 067752e3316942edc5f25a89ab02020f32a99a7f34ba7012f35fad3d0e5dfc9e
                  • Instruction Fuzzy Hash: 32D1DFB2244B409BEB21CF29E58835E7BA1F346B8CF658125DF598B758DF39C586CB00
                  Function 6AEBBA50 Relevance: 13.8, APIs: 2, Strings: 7, Instructions: 274COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID: sprintf
                  • String ID: %hd$COMMENT$ENDPROPERTIES$FONT_ASCENT$FONT_DESCENT$Hj$_XFREE86_GLYPH_RANGES
                  • API String ID: 590974362-2996864646
                  • Opcode ID: 48c922f1c25b6d2a8b8c0874859785f9602527c918a8358b50392423469a5755
                  • Instruction ID: ee796f7aba7e7050efc8094a1a1f0be4b2e56d835f91af1ad29c1f49b5edf284
                  • Opcode Fuzzy Hash: 48c922f1c25b6d2a8b8c0874859785f9602527c918a8358b50392423469a5755
                  • Instruction Fuzzy Hash: BBA12352B0479895EF118B16D6DC7AA2B56EB46BC8FA94022CE5C0B357DF3EC44AC341
                  Function 68B61A10 Relevance: 13.7, APIs: 3, Strings: 6, Instructions: 195stringCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: strlen
                  • String ID: iTXt: invalid compression$iTXt: invalid keyword$iTXt: uncompressed text too long$tXTi$tXTi$tXTi
                  • API String ID: 39653677-2017232406
                  • Opcode ID: 5249266083bdb2770bff4bbb40bb244648c034372107a55b7466efa4df2aa4cf
                  • Instruction ID: d2e5f497347e07d806d1dbec7b6f2afa952a2e4946be7431352e02ebde6cc86b
                  • Opcode Fuzzy Hash: 5249266083bdb2770bff4bbb40bb244648c034372107a55b7466efa4df2aa4cf
                  • Instruction Fuzzy Hash: C061F666308BC086DA258B23A85036F6655F746BE8FC85214CE655BB49EF3CC287CB05
                  Function 62E86DD0 Relevance: 13.6, APIs: 9, Instructions: 147COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270152250.0000000062E81000.00000020.00000001.01000000.0000001D.sdmp, Offset: 62E80000, based on PE: true
                  • Associated: 00000016.00000002.2270136370.0000000062E80000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270171204.0000000062E95000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270187075.0000000062E9E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270203868.0000000062E9F000.00000004.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270219476.0000000062EA2000.00000008.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270233416.0000000062EA3000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  Similarity
                  • API ID: freemalloc
                  • String ID:
                  • API String ID: 3061335427-0
                  • Opcode ID: 6dd54ecc9b3cc9ec9082bc0c2d8f6cb2b0a57e9e3756c51ef39b7c722e8bd509
                  • Instruction ID: faa08318df7146f1624fa011c84016a3d3a13195dc848444693ea33c8f610fad
                  • Opcode Fuzzy Hash: 6dd54ecc9b3cc9ec9082bc0c2d8f6cb2b0a57e9e3756c51ef39b7c722e8bd509
                  • Instruction Fuzzy Hash: 425180B275560186EB048F39D57435D3BA1E745B9CF208239DE9D4B388EB3DCA86C780
                  Function 6788AE00 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 146COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • Couldn't allocate %d bytes stack memory, xrefs: 6788AFFF
                  • FLAC decoder doesn't support %d bits_per_sample, xrefs: 6788AE3F
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: AudioErrorL_freeL_mallocStream
                  • String ID: Couldn't allocate %d bytes stack memory$FLAC decoder doesn't support %d bits_per_sample
                  • API String ID: 1260482519-1396303032
                  • Opcode ID: 628e7faf06933f2ef57e11a221626f29765ac4a903f4b14aaefb890f446271b8
                  • Instruction ID: 8719544f2c9f38b72f0642bac846fda12e54590863a483774169da404dc5eb38
                  • Opcode Fuzzy Hash: 628e7faf06933f2ef57e11a221626f29765ac4a903f4b14aaefb890f446271b8
                  • Instruction Fuzzy Hash: B941007362469597D704CE29D940B6D3396EB39788F418E26DF09877D0EB39EC85C302
                  Function 62E881A0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 133COMMON
                  Download Yara Rule
                  Strings
                  • out of memory, xrefs: 62E882E2
                  • unexpected end of file, xrefs: 62E88225
                  • internal error: inflate stream corrupt, xrefs: 62E882C5
                  • compressed data error, xrefs: 62E88307
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270152250.0000000062E81000.00000020.00000001.01000000.0000001D.sdmp, Offset: 62E80000, based on PE: true
                  • Associated: 00000016.00000002.2270136370.0000000062E80000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270171204.0000000062E95000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270187075.0000000062E9E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270203868.0000000062E9F000.00000004.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270219476.0000000062EA2000.00000008.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270233416.0000000062EA3000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  Similarity
                  • API ID:
                  • String ID: compressed data error$internal error: inflate stream corrupt$out of memory$unexpected end of file
                  • API String ID: 0-895915629
                  • Opcode ID: c07508fe93e2d1019cd9dd88cdb8a98b6d4e61f08e38a02fc8d0f25165b93561
                  • Instruction ID: a022ce379276d5af19ea58f9253f17220beb3ad44b6538ed2fc71ff5c7911ab1
                  • Opcode Fuzzy Hash: c07508fe93e2d1019cd9dd88cdb8a98b6d4e61f08e38a02fc8d0f25165b93561
                  • Instruction Fuzzy Hash: 34413D72700A0486D714CF79986075A33A2B785BACF74D3369DAC4B398DF39C9468791
                  Function 6788A0D0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 129COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • Position not implemented for music type, xrefs: 6788A2C0
                  • music parameter was NULL, xrefs: 6788A2EC
                  • Audio device hasn't been opened, xrefs: 6788A2D6
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: Audio device hasn't been opened$Position not implemented for music type$music parameter was NULL
                  • API String ID: 2619118453-3140506348
                  • Opcode ID: e1afb2fa7321c005dc4b2ac3b6af498e05a8cbe7ebc1deaf912b28d1c0db62ab
                  • Instruction ID: e55f597f91862c5fc13feee4d9d2fb796685b63a22dda3e3144f8c09ed61241f
                  • Opcode Fuzzy Hash: e1afb2fa7321c005dc4b2ac3b6af498e05a8cbe7ebc1deaf912b28d1c0db62ab
                  • Instruction Fuzzy Hash: E2511F76749B44C5EB158F2DE8453292361FBA8B98F054A12EA2D573F0DF3ACC90C792
                  Function 6A8814B0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • Passed a NULL data source, xrefs: 6A881610
                  • Unsupported image format, xrefs: 6A8815DE
                  • Can't seek in this data source, xrefs: 6A8815F1
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: L_toupper$Error
                  • String ID: Can't seek in this data source$Passed a NULL data source$Unsupported image format
                  • API String ID: 2779365143-803797162
                  • Opcode ID: e9f7484ea931adaea1c3c747d2c786b394b281b9a5f195589e819bded592e2e2
                  • Instruction ID: 8f6306eb41ae4c9e5e1305ac8e3205c9490877bede31475b523b5839b4a6c9cb
                  • Opcode Fuzzy Hash: e9f7484ea931adaea1c3c747d2c786b394b281b9a5f195589e819bded592e2e2
                  • Instruction Fuzzy Hash: 6231B4D3A0869895DA15CB2A941837A3AA0BF46F88F474921DEBB57B51FF29C105C360
                  Function 6788B590 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 87COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error$AudioL_callocL_freeL_mallocStream
                  • String ID: ModPlug_Load failed
                  • API String ID: 291637187-783326602
                  • Opcode ID: 001160fcd427015fd9702ece2cdcba634659005d789e15445cb4bcb701d321a0
                  • Instruction ID: 54a53cfdffd50f80f1ef3482cfee991773d0d7fbaee3abeeb9b7310b6cf15162
                  • Opcode Fuzzy Hash: 001160fcd427015fd9702ece2cdcba634659005d789e15445cb4bcb701d321a0
                  • Instruction Fuzzy Hash: C331B332349744CAEB1ACF2D941432D6A91ABADB89F484839DF4E07794EF39DD90CB40
                  Function 71004800 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270895464.0000000071001000.00000020.00000001.01000000.00000029.sdmp, Offset: 71000000, based on PE: true
                  • Associated: 00000016.00000002.2270880501.0000000071000000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270911307.0000000071007000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270926559.000000007100B000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270940910.000000007100C000.00000004.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270955038.000000007100F000.00000008.00000001.01000000.00000029.sdmpDownload File
                  Similarity
                  • API ID: Error$L_freeL_malloc
                  • String ID: Library not initialized$Passed a NULL pointer
                  • API String ID: 2258667193-710601900
                  • Opcode ID: 32abe6dcf726108181d6d6ac9c7b178ca5ac79aa5486a22cfae99942fa9378cb
                  • Instruction ID: 03c655ded5107eabfd81fd5690a90166fe752476724c179823187c7a1d79351c
                  • Opcode Fuzzy Hash: 32abe6dcf726108181d6d6ac9c7b178ca5ac79aa5486a22cfae99942fa9378cb
                  • Instruction Fuzzy Hash: 5A215E227052C049FF16CB7628643BD1AA21F5AFD4F4888679E4ACB781D66EC24ED354
                  Function 710035E0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270895464.0000000071001000.00000020.00000001.01000000.00000029.sdmp, Offset: 71000000, based on PE: true
                  • Associated: 00000016.00000002.2270880501.0000000071000000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270911307.0000000071007000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270926559.000000007100B000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270940910.000000007100C000.00000004.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270955038.000000007100F000.00000008.00000001.01000000.00000029.sdmpDownload File
                  Similarity
                  • API ID: Error$L_freeL_malloc
                  • String ID: Library not initialized$Passed a NULL pointer
                  • API String ID: 2258667193-710601900
                  • Opcode ID: dfaa3ddd511dc66e91e7f20d504d7a27f87df6e88391a56f219d5745292697f2
                  • Instruction ID: 91f129ddbf889aaf5cf79b398fb520cefe462f5a2093e1a471d80b8cdbe914ca
                  • Opcode Fuzzy Hash: dfaa3ddd511dc66e91e7f20d504d7a27f87df6e88391a56f219d5745292697f2
                  • Instruction Fuzzy Hash: 28213512B056804EFF13CB3A1E643B95AA21F5EFD8F88C167AD4A4F781DA5EC14AC350
                  Function 6A8895D0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON
                  Download Yara Rule
                  APIs
                  • SDL_ConvertSurfaceFormat.SDL2 ref: 6A889608
                  • SDL_FreeSurface.SDL2 ref: 6A889645
                  • SDL_free.SDL2 ref: 6A889671
                  • SDL_SetError.SDL2 ref: 6A88969C
                    • Part of subcall function 6A889130: SDL_malloc.SDL2 ref: 6A889165
                    • Part of subcall function 6A889130: SDL_memset.SDL2 ref: 6A889195
                    • Part of subcall function 6A889130: SDL_malloc.SDL2 ref: 6A8891BF
                    • Part of subcall function 6A889130: SDL_memset.SDL2 ref: 6A88923A
                    • Part of subcall function 6A889130: SDL_memset.SDL2 ref: 6A889315
                    • Part of subcall function 6A889130: SDL_memset.SDL2 ref: 6A889329
                  • SDL_SetError.SDL2 ref: 6A8896EF
                  Strings
                  • Failed to convert and save image, xrefs: 6A889690
                  • Passed NULL dst, xrefs: 6A8896E3
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: L_memset$ErrorL_mallocSurface$ConvertFormatFreeL_free
                  • String ID: Failed to convert and save image$Passed NULL dst
                  • API String ID: 297194350-561261200
                  • Opcode ID: 1c753831462dc2f1e518b86e0285a5b0cf42056b15dc3e2fd16588cf3874171e
                  • Instruction ID: de8f88705ecfe131e5ca93a46b38333087cb8e0253264f518a1ca902561c20e2
                  • Opcode Fuzzy Hash: 1c753831462dc2f1e518b86e0285a5b0cf42056b15dc3e2fd16588cf3874171e
                  • Instruction Fuzzy Hash: EB21F2B631975886DA24CF6AE40465E7B60FB89FD4F560A14DEAE03B64EF38C441CB50
                  Function 71003C70 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 75COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270895464.0000000071001000.00000020.00000001.01000000.00000029.sdmp, Offset: 71000000, based on PE: true
                  • Associated: 00000016.00000002.2270880501.0000000071000000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270911307.0000000071007000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270926559.000000007100B000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270940910.000000007100C000.00000004.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270955038.000000007100F000.00000008.00000001.01000000.00000029.sdmpDownload File
                  Similarity
                  • API ID: Error$L_freeL_malloc
                  • String ID: Library not initialized$Passed a NULL pointer
                  • API String ID: 2258667193-710601900
                  • Opcode ID: 1e6c570ecc2bd31c8393f9c32418aff978d095c4d3e15dd7cf09401183f7e3b4
                  • Instruction ID: 59e3af2883767648f75ac14879524591892bc90ca2975098d6fa90d73a87ac6d
                  • Opcode Fuzzy Hash: 1e6c570ecc2bd31c8393f9c32418aff978d095c4d3e15dd7cf09401183f7e3b4
                  • Instruction Fuzzy Hash: EE1136127092844DFE07EB366A647AD5AA24F5AF94F9880639E4F8F381DA1EC14FD350
                  Function 71002E90 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 75COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270895464.0000000071001000.00000020.00000001.01000000.00000029.sdmp, Offset: 71000000, based on PE: true
                  • Associated: 00000016.00000002.2270880501.0000000071000000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270911307.0000000071007000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270926559.000000007100B000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270940910.000000007100C000.00000004.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270955038.000000007100F000.00000008.00000001.01000000.00000029.sdmpDownload File
                  Similarity
                  • API ID: Error$L_freeL_malloc
                  • String ID: Library not initialized$Passed a NULL pointer
                  • API String ID: 2258667193-710601900
                  • Opcode ID: 6a95a7cf7e41c665dea1830c1b89e55582e3c89da2729cd1081ec2c6473fbb18
                  • Instruction ID: ddf2d1f0d95e379a4aa3cb2b1f8360b169e08621c92c59d9494ede851bb8121a
                  • Opcode Fuzzy Hash: 6a95a7cf7e41c665dea1830c1b89e55582e3c89da2729cd1081ec2c6473fbb18
                  • Instruction Fuzzy Hash: 2B112C1270968049FE07DB3558643BD1AA24F5AFD8F98807B9D4F4B386DA5EC14FD350
                  Function 71004910 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270895464.0000000071001000.00000020.00000001.01000000.00000029.sdmp, Offset: 71000000, based on PE: true
                  • Associated: 00000016.00000002.2270880501.0000000071000000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270911307.0000000071007000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270926559.000000007100B000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270940910.000000007100C000.00000004.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270955038.000000007100F000.00000008.00000001.01000000.00000029.sdmpDownload File
                  Similarity
                  • API ID: Error$L_freeL_malloc
                  • String ID: Library not initialized$Passed a NULL pointer
                  • API String ID: 2258667193-710601900
                  • Opcode ID: 57ecbd78b7e476ecce4bb004ed29a7c4049c6294d8e15f4595c3896378626e65
                  • Instruction ID: cf5806b9ec57338caf492412412c57fab64a57e4c664f90adc5d2ccf061b90cf
                  • Opcode Fuzzy Hash: 57ecbd78b7e476ecce4bb004ed29a7c4049c6294d8e15f4595c3896378626e65
                  • Instruction Fuzzy Hash: 3911E777B0512241FE2AE75B65147B951A15F88FE4FC880765D4F8B780EE2C99C7C388
                  Function 710036F0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270895464.0000000071001000.00000020.00000001.01000000.00000029.sdmp, Offset: 71000000, based on PE: true
                  • Associated: 00000016.00000002.2270880501.0000000071000000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270911307.0000000071007000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270926559.000000007100B000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270940910.000000007100C000.00000004.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270955038.000000007100F000.00000008.00000001.01000000.00000029.sdmpDownload File
                  Similarity
                  • API ID: Error$L_freeL_malloc
                  • String ID: Library not initialized$Passed a NULL pointer
                  • API String ID: 2258667193-710601900
                  • Opcode ID: 10f373a5d15d4511849c39d0a21348ab83e49ade61569e89b5be831b8a48dcfa
                  • Instruction ID: d6cfcfe771e1616f47258a6d60843c4b586a26eb9b51cdb75bb348b7b2f16fcf
                  • Opcode Fuzzy Hash: 10f373a5d15d4511849c39d0a21348ab83e49ade61569e89b5be831b8a48dcfa
                  • Instruction Fuzzy Hash: 7C1127ABB0512249FE3BE75666143BA91616F44FD4FC881769D0E4F780EE2C95C7C380
                  Function 6788AA00 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 69stringCOMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 6788A950: SDL_getenv.SDL2 ref: 6788A95C
                    • Part of subcall function 6788A950: SDL_GetHintBoolean.SDL2 ref: 6788A96D
                  • SDL_strdup.SDL2 ref: 6788AA1D
                  • strtok.MSVCRT ref: 6788AA63
                  • SDL_free.SDL2 ref: 6788AA78
                  • SDL_SetError.SDL2 ref: 6788AA99
                  • SDL_SetError.SDL2 ref: 6788AAB9
                  Strings
                  • No SoundFonts have been requested, xrefs: 6788AA90
                  • Insufficient memory to iterate over SoundFonts, xrefs: 6788AAB0
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error$BooleanHintL_freeL_getenvL_strdupstrtok
                  • String ID: Insufficient memory to iterate over SoundFonts$No SoundFonts have been requested
                  • API String ID: 3847849284-2597955508
                  • Opcode ID: 3f5cc5291001ce18fc7a088d700ca2390940d62dace783eb41e3dc483c04734e
                  • Instruction ID: 1a8d8bd2d96bdf73d4a7333ef957a97c97acc9f538e06bb18c393c82c9ff0f12
                  • Opcode Fuzzy Hash: 3f5cc5291001ce18fc7a088d700ca2390940d62dace783eb41e3dc483c04734e
                  • Instruction Fuzzy Hash: E901822334730149ED069BAE6D842B942415B6D7E6F8859799F1E0A3C0EE3DCCC9C751
                  Function 71002A40 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 69COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270895464.0000000071001000.00000020.00000001.01000000.00000029.sdmp, Offset: 71000000, based on PE: true
                  • Associated: 00000016.00000002.2270880501.0000000071000000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270911307.0000000071007000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270926559.000000007100B000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270940910.000000007100C000.00000004.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270955038.000000007100F000.00000008.00000001.01000000.00000029.sdmpDownload File
                  Similarity
                  • API ID: Error$L_freeL_malloc
                  • String ID: Library not initialized$Passed a NULL pointer
                  • API String ID: 2258667193-710601900
                  • Opcode ID: 660dddbac87d67179e314cb79f2d50ecabb6d3044d00badd7c8fe265486afb8a
                  • Instruction ID: 28a73c02168c882883ebb799be406953a8dc0f10b722c5cff86888a1dfda16dc
                  • Opcode Fuzzy Hash: 660dddbac87d67179e314cb79f2d50ecabb6d3044d00badd7c8fe265486afb8a
                  • Instruction Fuzzy Hash: 7F115B66B0411142FA25977698143BA2261AF09FF0FC84272AD6F473C4EF2CC4C6C340
                  Function 71003D60 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 69COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270895464.0000000071001000.00000020.00000001.01000000.00000029.sdmp, Offset: 71000000, based on PE: true
                  • Associated: 00000016.00000002.2270880501.0000000071000000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270911307.0000000071007000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270926559.000000007100B000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270940910.000000007100C000.00000004.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270955038.000000007100F000.00000008.00000001.01000000.00000029.sdmpDownload File
                  Similarity
                  • API ID: Error$L_freeL_malloc
                  • String ID: Library not initialized$Passed a NULL pointer
                  • API String ID: 2258667193-710601900
                  • Opcode ID: 5fc3452b40ae1ae6f37344bf9d49ed3a88988e9aa3672aa734556ba6ea76cf4e
                  • Instruction ID: 6e370f9b8e884f8aadee9fe495db37cad55811132d57467b9afbbf4739363af4
                  • Opcode Fuzzy Hash: 5fc3452b40ae1ae6f37344bf9d49ed3a88988e9aa3672aa734556ba6ea76cf4e
                  • Instruction Fuzzy Hash: 9B110666B051564AFE1BA71A6A183BE62619F44FD0FC880379D0F4F380EE2C99C78380
                  Function 71002F80 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 69COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270895464.0000000071001000.00000020.00000001.01000000.00000029.sdmp, Offset: 71000000, based on PE: true
                  • Associated: 00000016.00000002.2270880501.0000000071000000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270911307.0000000071007000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270926559.000000007100B000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270940910.000000007100C000.00000004.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270955038.000000007100F000.00000008.00000001.01000000.00000029.sdmpDownload File
                  Similarity
                  • API ID: Error$L_freeL_malloc
                  • String ID: Library not initialized$Passed a NULL pointer
                  • API String ID: 2258667193-710601900
                  • Opcode ID: 65a58048f7ea486c2e9d19c7de3b6c3f9bb3c9019e65de1c53c1136f00b03d0d
                  • Instruction ID: 22ae9f3f232d863568cfe025c802f773bc2cd4e18509059ecfaf6025664d9697
                  • Opcode Fuzzy Hash: 65a58048f7ea486c2e9d19c7de3b6c3f9bb3c9019e65de1c53c1136f00b03d0d
                  • Instruction Fuzzy Hash: 6D112C66B0611645FD1BE72696243BE61615F44FD0FC4803A9D0F4B784EE1C95C7D350
                  Function 6788E1D0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 67filestringCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: FileFrom$memcpystrcatstrlen
                  • String ID: \$\
                  • API String ID: 1597890494-164819647
                  • Opcode ID: 9d2f63296c03abec27af8ba61958e70fb7a6218c6e14c8ccca853f0a663dc2f5
                  • Instruction ID: 8740d33c7010a55206208c21dbb3627d6a696a29fa5081270379f95dab0c4b0e
                  • Opcode Fuzzy Hash: 9d2f63296c03abec27af8ba61958e70fb7a6218c6e14c8ccca853f0a663dc2f5
                  • Instruction Fuzzy Hash: 6911D66234A6C498FE128F1A9804B5A57407B7EB9CF8C4D29AF690B744EF3CC845C741
                  Function 6788C540 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 67COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: AudioStream$ErrorFreeL_freeL_mallocL_memcpy
                  • String ID: ov_info returned NULL
                  • API String ID: 3241142781-851569440
                  • Opcode ID: 3558540398401ddc4baf021c9eaa18a80eb4d171a79755f7988d800da257f15c
                  • Instruction ID: 777e635a27c1c1757dd5b6224ccaacd1ec9e1fccd40b7abf2e31d5483e75104e
                  • Opcode Fuzzy Hash: 3558540398401ddc4baf021c9eaa18a80eb4d171a79755f7988d800da257f15c
                  • Instruction Fuzzy Hash: BF21D3322057808BDB19CF39E01036D37A4FB69B58F4847399B694B7C8DB39CA90C710
                  Function 678874F0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 48COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error$L_callocL_memcpy
                  • String ID: Audio device hasn't been opened$Out of memory$data
                  • API String ID: 3502504245-1682312173
                  • Opcode ID: 6b1237e0fe86e0e3cfaa04e0af902acca7c4901d5ac93aac0cbb935a94c4bbc3
                  • Instruction ID: 385ec16644a22111ac96844cd3d74f858527e8d185a19bc4233dee9b1a74d86d
                  • Opcode Fuzzy Hash: 6b1237e0fe86e0e3cfaa04e0af902acca7c4901d5ac93aac0cbb935a94c4bbc3
                  • Instruction Fuzzy Hash: FC01D63274431086EB108B5DF80035AA361ABA9788F844630DF6C4B790EB38CD82CB80
                  Function 6A88CE40 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 43COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: L_strcmp
                  • String ID: defs$path$style
                  • API String ID: 1150865741-2564353329
                  • Opcode ID: 4153d80590466afc12714a4fd8a12f55c0f7c802b8e7c6d3018bd1a5e2d5c391
                  • Instruction ID: a36a05a14ce5e188cbe785997c465d64e864a2bbe86f7062fa01a843878548c6
                  • Opcode Fuzzy Hash: 4153d80590466afc12714a4fd8a12f55c0f7c802b8e7c6d3018bd1a5e2d5c391
                  • Instruction Fuzzy Hash: F101F7F2B4E24588F604AB3EF8447822FA5A747384F891A21CE1587217EF6DE055C700
                  Function 62E86AD0 Relevance: 12.1, APIs: 8, Instructions: 147COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270152250.0000000062E81000.00000020.00000001.01000000.0000001D.sdmp, Offset: 62E80000, based on PE: true
                  • Associated: 00000016.00000002.2270136370.0000000062E80000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270171204.0000000062E95000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270187075.0000000062E9E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270203868.0000000062E9F000.00000004.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270219476.0000000062EA2000.00000008.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270233416.0000000062EA3000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  Similarity
                  • API ID: freemalloc
                  • String ID:
                  • API String ID: 3061335427-0
                  • Opcode ID: 8591c4166f04cd7223bf53badd9c6685c9994b16c0141d03ac727ab8bb33184c
                  • Instruction ID: 5a0ea6bb4b726fd94d8bcf52ebbba3f4d77f3ca64c543539b3305a5473e10242
                  • Opcode Fuzzy Hash: 8591c4166f04cd7223bf53badd9c6685c9994b16c0141d03ac727ab8bb33184c
                  • Instruction Fuzzy Hash: 6751B1B261560186EB049F39D57436D3BA1E745B9CF208239CA9D4B388EB3DC986C780
                  Function 62E82E80 Relevance: 11.7, APIs: 9, Instructions: 438COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270152250.0000000062E81000.00000020.00000001.01000000.0000001D.sdmp, Offset: 62E80000, based on PE: true
                  • Associated: 00000016.00000002.2270136370.0000000062E80000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270171204.0000000062E95000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270187075.0000000062E9E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270203868.0000000062E9F000.00000004.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270219476.0000000062EA2000.00000008.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270233416.0000000062EA3000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  Similarity
                  • API ID: memcpy
                  • String ID:
                  • API String ID: 3510742995-0
                  • Opcode ID: a0ea90ea25654dff8d36670da0a77f2f66b4cc183196aefea7f898e77ceebbf7
                  • Instruction ID: 6058432fb27faaa9689db917d0a731eaa8f3424c8034f9f524c3007879f571ab
                  • Opcode Fuzzy Hash: a0ea90ea25654dff8d36670da0a77f2f66b4cc183196aefea7f898e77ceebbf7
                  • Instruction Fuzzy Hash: 26F1A277A106908BC711CF3AC460A9D37A1F788F8CB659536DE9D9BB08DB39C941CB81
                  Function 6AE85960 Relevance: 10.9, APIs: 1, Strings: 6, Instructions: 389COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID:
                  • String ID: Type 1$font-format$ltuo$pmoc$stib$stib
                  • API String ID: 0-190193734
                  • Opcode ID: 9d21ad6d914058eff011ec00b2b8708fb5ae98a6ff9b0da49e7a0cf27cd9ea56
                  • Instruction ID: bbeb383a0a2941d0e2fc3d4dda6f8e4b6618b7bab5f47dc842d600a3fc78e7d5
                  • Opcode Fuzzy Hash: 9d21ad6d914058eff011ec00b2b8708fb5ae98a6ff9b0da49e7a0cf27cd9ea56
                  • Instruction Fuzzy Hash: BEF1CAB36207408AD789CF2AD494B4E3BA0F744F9CF24512ADE5A57798DF39C884CB90
                  Function 68B60A00 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 268COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: deflate
                  • String ID: TADI$TADI$TADI$TADI$Z_OK on Z_FINISH with output space
                  • API String ID: 3803212549-126405610
                  • Opcode ID: 4b93f5549626665ce1f4ecc4d03e82af774ea68960e42e841df8817c5a61968b
                  • Instruction ID: a8fb89db8639611b7c4da78b879c4584d613b28e8e48147628cfc1201fb7b4dd
                  • Opcode Fuzzy Hash: 4b93f5549626665ce1f4ecc4d03e82af774ea68960e42e841df8817c5a61968b
                  • Instruction Fuzzy Hash: 4EA1F4776056C48AE725CF26E8087DEBBA0F349BA8F988125DF6917350DB39D487C700
                  Function 67893C10 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 207COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • Surround sound not supported, xrefs: 67893FC3
                  • Unsupported audio format, xrefs: 67893EA3
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Errorfree
                  • String ID: Surround sound not supported$Unsupported audio format
                  • API String ID: 4048819709-4095526001
                  • Opcode ID: 61cc495134c42f18d6bbf5df9c109e52fbe97307206a53b2c32f6132b84855bc
                  • Instruction ID: d9334ebc2a4af331468cec3a9fb5e0f2163f32554426cdfde0b1a6b1f93ee4b5
                  • Opcode Fuzzy Hash: 61cc495134c42f18d6bbf5df9c109e52fbe97307206a53b2c32f6132b84855bc
                  • Instruction Fuzzy Hash: F0919C72205B5995DB00CF2DE4587A837A9F36CB98F818A36DE9D43B90DF398D81C740
                  Function 68B5B710 Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 168COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID:
                  • String ID: 3333$3333$bKGD$png_set_keep_unknown_chunks: invalid keep$png_set_keep_unknown_chunks: no chunk list$png_set_keep_unknown_chunks: too many chunks
                  • API String ID: 0-807601816
                  • Opcode ID: c0bab0575f4d0556d32a67aed80f132509c56d325a2ca530e28597e4d1352399
                  • Instruction ID: be8d831c9659c1bbca8abc8b597258d6589cf577762ab73edc8c5f2aede85592
                  • Opcode Fuzzy Hash: c0bab0575f4d0556d32a67aed80f132509c56d325a2ca530e28597e4d1352399
                  • Instruction Fuzzy Hash: EA51D2B6B066C886DE0ACF1AD2507AD7726FB05FD8FC8D526CF250B341EB29D1618742
                  Function 6A884840 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 152COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: ErrorSurface$CreateFree
                  • String ID: JPEG loading error$Out of memory
                  • API String ID: 1528777671-2461771124
                  • Opcode ID: 8dc9c9ef393ad9e8c204487a5298b40f24f59f1f629575dd23fe86cc9351c0c9
                  • Instruction ID: 8eaf8d8559904c3207f84b8c0904e3eb3be3d2014a7846011980498e8f89cda2
                  • Opcode Fuzzy Hash: 8dc9c9ef393ad9e8c204487a5298b40f24f59f1f629575dd23fe86cc9351c0c9
                  • Instruction Fuzzy Hash: 65716C72B04B1489EB60DF25E8883993774F785B88F4441A5DF4E27B68DF39CA99CB04
                  Function 68B5B340 Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 108stringCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: memcpy$memsetstrlen
                  • String ID: $png_set_sPLT: invalid sPLT$sPLT out of memory$too many sPLT chunks
                  • API String ID: 2350177629-1700405190
                  • Opcode ID: 85923cc8d4983728257bde1e5c9379d6dffb4b51070dc28c340ec3eeca8095eb
                  • Instruction ID: e6ab7397ec539fd729493d05f8bd43d1faccf8ce08a422b0f04964f42bd95871
                  • Opcode Fuzzy Hash: 85923cc8d4983728257bde1e5c9379d6dffb4b51070dc28c340ec3eeca8095eb
                  • Instruction Fuzzy Hash: EA3191BA7017C142EB2ACF26E59476A6761FB46BD8F848525CF6807308DF39C5A5C341
                  Function 6789577B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: signal
                  • String ID: CCG
                  • API String ID: 1946981877-1584390748
                  • Opcode ID: 56d8fa4756d6cea9dd1d17c5167775315ac85dccb38f5df70656fd00e2b3d159
                  • Instruction ID: 83c22144c5c68ea4110f23598f741c9e01260f47345ff5dfdd2cf75bd24a176b
                  • Opcode Fuzzy Hash: 56d8fa4756d6cea9dd1d17c5167775315ac85dccb38f5df70656fd00e2b3d159
                  • Instruction Fuzzy Hash: FD31A23074530889FF19696D88A032BD1159BBE36BF118D3B8A2DA73E5DA58CDC98313
                  Function 7100570B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270895464.0000000071001000.00000020.00000001.01000000.00000029.sdmp, Offset: 71000000, based on PE: true
                  • Associated: 00000016.00000002.2270880501.0000000071000000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270911307.0000000071007000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270926559.000000007100B000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270940910.000000007100C000.00000004.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270955038.000000007100F000.00000008.00000001.01000000.00000029.sdmpDownload File
                  Similarity
                  • API ID: signal
                  • String ID: CCG
                  • API String ID: 1946981877-1584390748
                  • Opcode ID: 3ceaada91fff453d8e40f700c068eefbca0c704eb91fce435b3671434d2a0d82
                  • Instruction ID: 3cbbce6f94ebf56e8fe03f49890345ebc14bf30d3fc4b1efe89afb7d3a3c3a3b
                  • Opcode Fuzzy Hash: 3ceaada91fff453d8e40f700c068eefbca0c704eb91fce435b3671434d2a0d82
                  • Instruction Fuzzy Hash: 7E31F62070964885FF2A0165949436D08F7AB8DF64F21CA6BCE4FA73E8D95CCBC94313
                  Function 6AEE6FCB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID: signal
                  • String ID: CCG
                  • API String ID: 1946981877-1584390748
                  • Opcode ID: a5dcfb8e7c044dbaf01410a4b6645728b8d3bf621cd8f43045d97e9e9dc282d9
                  • Instruction ID: 2fc7daf87edecbb644be731a49f8fdea1852c3c6b35c2feeaab8335e2a5237f5
                  • Opcode Fuzzy Hash: a5dcfb8e7c044dbaf01410a4b6645728b8d3bf621cd8f43045d97e9e9dc282d9
                  • Instruction Fuzzy Hash: EB31A01074A34265FF7445A948A03293102BB8B36CF378D6ACD19873D7FD59C8C34352
                  Function 62E92D1B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270152250.0000000062E81000.00000020.00000001.01000000.0000001D.sdmp, Offset: 62E80000, based on PE: true
                  • Associated: 00000016.00000002.2270136370.0000000062E80000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270171204.0000000062E95000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270187075.0000000062E9E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270203868.0000000062E9F000.00000004.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270219476.0000000062EA2000.00000008.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270233416.0000000062EA3000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  Similarity
                  • API ID: signal
                  • String ID: CCG
                  • API String ID: 1946981877-1584390748
                  • Opcode ID: ea5fdb0143b018d8f050132cebeb5491fe9ba209e7c184e33e2205ed144b43e9
                  • Instruction ID: 076da1c7bb28a28d61cf39990cb139d2637b1a7c037b94289ce86a087773d55f
                  • Opcode Fuzzy Hash: ea5fdb0143b018d8f050132cebeb5491fe9ba209e7c184e33e2205ed144b43e9
                  • Instruction Fuzzy Hash: C031A230F8534146FF1B91BD44F03A911099BAA32CF35DA3B8D6987F95CE5A8DC68202
                  Function 6A898A2B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: signal
                  • String ID: CCG
                  • API String ID: 1946981877-1584390748
                  • Opcode ID: f4287a2843efe9a0aa589ad29ba49dc5e07efecfaa42db232bf9812edf136769
                  • Instruction ID: db56a6797021e2136a885c7fbe97b62b84e35566a8655c2d94f8cb1eadd6ac29
                  • Opcode Fuzzy Hash: f4287a2843efe9a0aa589ad29ba49dc5e07efecfaa42db232bf9812edf136769
                  • Instruction Fuzzy Hash: 9E31A3E174D2074EFFB445ADC4A03692D419B8B368F1F8D2ACB29877E5DD5E84C18217
                  Function 68B63A0B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: signal
                  • String ID: CCG
                  • API String ID: 1946981877-1584390748
                  • Opcode ID: 2d739270c51c0844b6b74aecd2d0ee5aa4c3eb7fb75e4f6b644e4f6b1a372241
                  • Instruction ID: 24b05968ca230f094ca26c736dca3f1e76914b8f062cc7faae8b43667413d75d
                  • Opcode Fuzzy Hash: 2d739270c51c0844b6b74aecd2d0ee5aa4c3eb7fb75e4f6b644e4f6b1a372241
                  • Instruction Fuzzy Hash: 29317411799EC486FF244569889036E7052DB8E379FDD8B2ACA39C73E5C969C4C54313
                  Function 67888C50 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 100COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: AudioDevice$L_mallocOpenPause
                  • String ID: AIFF$VOC$WAVE
                  • API String ID: 3517885603-3786630623
                  • Opcode ID: 9fc9b6c3b6de26b504b90d7a1c751e2c9474f93f123331e8312fc8010e4b08af
                  • Instruction ID: 22c10d6026c79d9acc36e11c0d81c28b50bd4c474d15893a6ce7b8d34e7a051a
                  • Opcode Fuzzy Hash: 9fc9b6c3b6de26b504b90d7a1c751e2c9474f93f123331e8312fc8010e4b08af
                  • Instruction Fuzzy Hash: E1417F723696408AE380CF2CE85835E36A6FBA8758F804525E74D873A4EF7ACC54CF51
                  Function 6A896D60 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 96COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID:
                  • String ID: "$Out of memory$Premature end of data
                  • API String ID: 0-2349396823
                  • Opcode ID: b939ee0651e087ee3fd4185275485793a273ba14fa31584a42c772befd784004
                  • Instruction ID: 7f877eeabbc3e6b55d098f931083ca600b75dda6eac69ccd46e960ef0494cd42
                  • Opcode Fuzzy Hash: b939ee0651e087ee3fd4185275485793a273ba14fa31584a42c772befd784004
                  • Instruction Fuzzy Hash: 9131BE7130AB0099EF16DB49F8803A83B62A749B84F054939CE2E17725EF3ED565CB81
                  Function 678951FC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 87memoryCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • VirtualProtect failed with code 0x%x, xrefs: 67895201, 67895316
                  • Address %p has no image-section, xrefs: 6789525D
                  • VirtualQuery failed for %d bytes at address %p, xrefs: 678952BF
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Virtual$ErrorLastProtectQuery
                  • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
                  • API String ID: 637304234-2123141913
                  • Opcode ID: ca37ee65e1d898e54a7d199763755101853fbb598300176a9bb2441f62c489bf
                  • Instruction ID: 1818d6a22f2dc315d4ed9c6e11e81726117ec68addad889a55975ae406d30f45
                  • Opcode Fuzzy Hash: ca37ee65e1d898e54a7d199763755101853fbb598300176a9bb2441f62c489bf
                  • Instruction Fuzzy Hash: 8D31AF72345B418AEA048F5EFC447A837A2F7ADB9DF4485359E0C4B7A4EE79C895CB00
                  Function 7100518C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 87memoryCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • VirtualProtect failed with code 0x%x, xrefs: 71005191, 710052A6
                  • Address %p has no image-section, xrefs: 710051ED
                  • VirtualQuery failed for %d bytes at address %p, xrefs: 7100524F
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270895464.0000000071001000.00000020.00000001.01000000.00000029.sdmp, Offset: 71000000, based on PE: true
                  • Associated: 00000016.00000002.2270880501.0000000071000000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270911307.0000000071007000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270926559.000000007100B000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270940910.000000007100C000.00000004.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270955038.000000007100F000.00000008.00000001.01000000.00000029.sdmpDownload File
                  Similarity
                  • API ID: Virtual$ErrorLastProtectQuery
                  • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
                  • API String ID: 637304234-2123141913
                  • Opcode ID: 572db5f7a3d63d5387bd12e0229c161d0cefb28af3ea8e978aa0c4396d243d7b
                  • Instruction ID: d9da43d9f8f5037ce5ca10757e4c5d216d77e82c08795da012320a99deb23275
                  • Opcode Fuzzy Hash: 572db5f7a3d63d5387bd12e0229c161d0cefb28af3ea8e978aa0c4396d243d7b
                  • Instruction Fuzzy Hash: B631AC32706A0186FA04CF19E8847D837B2FB49F94F4881269E4D0B3A4DF7CD185C790
                  Function 6AEE6A4C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 87memoryCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • VirtualQuery failed for %d bytes at address %p, xrefs: 6AEE6B0F
                  • Address %p has no image-section, xrefs: 6AEE6AAD
                  • VirtualProtect failed with code 0x%x, xrefs: 6AEE6A51, 6AEE6B66
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID: Virtual$ErrorLastProtectQuery
                  • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
                  • API String ID: 637304234-2123141913
                  • Opcode ID: dd0cc6833cfbd05275d6382c2f9758a5194472229ef9f83884e35e4e12523c7e
                  • Instruction ID: 2edb43f7bbe5b0877ffba1d8020e7633722edc7273a25af4c1481147b38dc172
                  • Opcode Fuzzy Hash: dd0cc6833cfbd05275d6382c2f9758a5194472229ef9f83884e35e4e12523c7e
                  • Instruction Fuzzy Hash: EE31F5723016408AEB009F55E8647683772FB46B98F59823ADE4D4B361EF3DD451CB42
                  Function 62E9279C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 87memoryCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • VirtualQuery failed for %d bytes at address %p, xrefs: 62E9285F
                  • VirtualProtect failed with code 0x%x, xrefs: 62E927A1, 62E928B6
                  • Address %p has no image-section, xrefs: 62E927FD
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270152250.0000000062E81000.00000020.00000001.01000000.0000001D.sdmp, Offset: 62E80000, based on PE: true
                  • Associated: 00000016.00000002.2270136370.0000000062E80000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270171204.0000000062E95000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270187075.0000000062E9E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270203868.0000000062E9F000.00000004.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270219476.0000000062EA2000.00000008.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270233416.0000000062EA3000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  Similarity
                  • API ID: Virtual$ErrorLastProtectQuery
                  • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
                  • API String ID: 637304234-2123141913
                  • Opcode ID: 821918b5b530f73bdcd2470b47aceb3cba14cecf0e229865d835daf72bb3d81f
                  • Instruction ID: 3351cf8736089e5de21b59273d7c5207373b304d44b5ca7c5f13db12097b62cd
                  • Opcode Fuzzy Hash: 821918b5b530f73bdcd2470b47aceb3cba14cecf0e229865d835daf72bb3d81f
                  • Instruction Fuzzy Hash: 3B31AD7AF01A0086EF14DF21E8607592762F7A8B98F64813BED0C477A4DB3EC595C300
                  Function 6A8984AC Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 87memoryCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • VirtualQuery failed for %d bytes at address %p, xrefs: 6A89856F
                  • VirtualProtect failed with code 0x%x, xrefs: 6A8984B1, 6A8985C6
                  • Address %p has no image-section, xrefs: 6A89850D
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: Virtual$ErrorLastProtectQuery
                  • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
                  • API String ID: 637304234-2123141913
                  • Opcode ID: 6359650977bd0c43a566c675a4dedc9ab0665ea813f9e24ffb7bd9340923318b
                  • Instruction ID: 39bc31258958798235661170190bcb13891e5dedbede739771e3f826769d07d0
                  • Opcode Fuzzy Hash: 6359650977bd0c43a566c675a4dedc9ab0665ea813f9e24ffb7bd9340923318b
                  • Instruction Fuzzy Hash: FF310772305A02CAEB00AF29EC447593B72FB46B98F094526DE1D5BB64EF3DC465CB40
                  Function 68B6348C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 87memoryCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • VirtualProtect failed with code 0x%x, xrefs: 68B63491, 68B635A6
                  • Address %p has no image-section, xrefs: 68B634ED
                  • VirtualQuery failed for %d bytes at address %p, xrefs: 68B6354F
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: Virtual$ErrorLastProtectQuery
                  • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
                  • API String ID: 637304234-2123141913
                  • Opcode ID: f4d4a63b5d3e10d2785203f7b37035a22870c5f46a196193fdf8ba3f4c1aedb4
                  • Instruction ID: 8f5eb9ec7074a624b9ad483104a537a1f855c0dd3ef17f9573771ef55d913288
                  • Opcode Fuzzy Hash: f4d4a63b5d3e10d2785203f7b37035a22870c5f46a196193fdf8ba3f4c1aedb4
                  • Instruction Fuzzy Hash: AE31C176301B8286EB108F15E8807697772FB88BA9F898325DE0D073A4DF3DD495C740
                  Function 71002900 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 82COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270895464.0000000071001000.00000020.00000001.01000000.00000029.sdmp, Offset: 71000000, based on PE: true
                  • Associated: 00000016.00000002.2270880501.0000000071000000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270911307.0000000071007000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270926559.000000007100B000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270940910.000000007100C000.00000004.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270955038.000000007100F000.00000008.00000001.01000000.00000029.sdmpDownload File
                  Similarity
                  • API ID: Error$L_freeL_malloc
                  • String ID: Library not initialized$Passed a NULL pointer
                  • API String ID: 2258667193-710601900
                  • Opcode ID: e6f559667f5f3ff0bd525fee69ef2cb5c2918224c3b655d5ef33c1e2719e8502
                  • Instruction ID: ead0ad6ee02d59a7e2faa10eab083abdd0e86d9a73fd58ec201a6dbace16e42f
                  • Opcode Fuzzy Hash: e6f559667f5f3ff0bd525fee69ef2cb5c2918224c3b655d5ef33c1e2719e8502
                  • Instruction Fuzzy Hash: 01213A127086C045FE12C73559643B92AA11F15FE4F484353EE6A473D5DB1E814AD320
                  Function 6A897B20 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 77COMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 6A8979C0: SDL_memcmp.SDL2 ref: 6A897A06
                  • SDL_CreateRGBSurface.SDL2 ref: 6A897B8D
                  • SDL_FreeSurface.SDL2 ref: 6A897BF5
                  • SDL_SetError.SDL2 ref: 6A897C06
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: Surface$CreateErrorFreeL_memcmp
                  • String ID: Couldn't read image data$Out of memory$Unsupported image format
                  • API String ID: 2697226866-2656014471
                  • Opcode ID: c15b60431117054e367c33b9470e6c347ad03bff72e61a81a5ff7870a345f824
                  • Instruction ID: bd9c0a33beb9289e22bb75e383dd590e277a871066a8f314e56572d4711488f6
                  • Opcode Fuzzy Hash: c15b60431117054e367c33b9470e6c347ad03bff72e61a81a5ff7870a345f824
                  • Instruction Fuzzy Hash: 8A21AE723186448AEB119F2EE85475A7F61EB86BC8F494421DF4E5BB18EF3ED046CB40
                  Function 6A894AD0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 76COMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 6A893360: SDL_malloc.SDL2 ref: 6A8933A6
                    • Part of subcall function 6A893360: SDL_memset.SDL2 ref: 6A8933C2
                    • Part of subcall function 6A893360: SDL_malloc.SDL2 ref: 6A8933CC
                    • Part of subcall function 6A893360: SDL_memset.SDL2 ref: 6A8933EF
                    • Part of subcall function 6A893360: SDL_memset.SDL2 ref: 6A89341D
                  • SDL_free.SDL2 ref: 6A894B0A
                  • SDL_SetError.SDL2 ref: 6A894BD9
                    • Part of subcall function 6A893B20: SDL_malloc.SDL2 ref: 6A893B2A
                    • Part of subcall function 6A893B20: SDL_memset.SDL2 ref: 6A893B42
                  • SDL_CreateRGBSurface.SDL2 ref: 6A894B5B
                    • Part of subcall function 6A893BF0: SDL_memset.SDL2 ref: 6A893CEC
                  • SDL_SetError.SDL2 ref: 6A894BE9
                  Strings
                  • Couldn't parse SVG image, xrefs: 6A894BD0
                  • Couldn't create SVG rasterizer, xrefs: 6A894BE0
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: L_memset$L_malloc$Error$CreateL_freeSurface
                  • String ID: Couldn't create SVG rasterizer$Couldn't parse SVG image
                  • API String ID: 580233172-180284502
                  • Opcode ID: 5eab7d169931b4191bd110794a2d7afb652f0f9e26e4d223022f0db343fa291c
                  • Instruction ID: cdb35636f61166dee2ea56f082f1db92ebbc6ace210e2b8d331a13413b303a97
                  • Opcode Fuzzy Hash: 5eab7d169931b4191bd110794a2d7afb652f0f9e26e4d223022f0db343fa291c
                  • Instruction Fuzzy Hash: F621A07130D2144AEB15DB6EA55432A7A91EB89B98F054A38DE5D07F69DF3CD8018B40
                  Function 67886320 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • VOC with unknown data size, xrefs: 6788639A
                  • VOC sample rate codes differ, xrefs: 6788665A
                  • VOC Sample rate is zero?, xrefs: 6788663C
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: VOC Sample rate is zero?$VOC sample rate codes differ$VOC with unknown data size
                  • API String ID: 2619118453-4168826635
                  • Opcode ID: a9d70c1523b12c11cb22d8dc1015319d45a7f97648d3aeb323eabe0cc94c0cb4
                  • Instruction ID: 55caa3d364b3210abaad22afb6e24d0172445871062698f5b3129e9858b3e600
                  • Opcode Fuzzy Hash: a9d70c1523b12c11cb22d8dc1015319d45a7f97648d3aeb323eabe0cc94c0cb4
                  • Instruction Fuzzy Hash: D021C2723292408ADB10CF29E54479C27A5F369798F804C25DF6587AC1FB7ADAD6CB00
                  Function 67886567 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 72COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • VOC sample rate codes differ, xrefs: 6788665A
                  • VOC sample rate is zero, xrefs: 678866FD
                  • VOC decoder only interprets 8-bit data, xrefs: 67886675
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: VOC decoder only interprets 8-bit data$VOC sample rate codes differ$VOC sample rate is zero
                  • API String ID: 2619118453-3997171794
                  • Opcode ID: 0d3d52a0721dae876ccacbbbebd581f64af43689f44ce2ef7989e289c17118c9
                  • Instruction ID: dc2e3b5d4c913ace55515fa34d3058ce9b02d18945985d9718f276295bf7a079
                  • Opcode Fuzzy Hash: 0d3d52a0721dae876ccacbbbebd581f64af43689f44ce2ef7989e289c17118c9
                  • Instruction Fuzzy Hash: E421FC7232819086D720CF25E50475D67A1E3ADB98F804921DE5987AC6EF3ACDD5CB01
                  Function 67889730 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 70COMMON
                  Download Yara Rule
                  APIs
                  • SDL_snprintf.SDL2(?,?,?,?,?,?,?,?,?,?,?,?,67886CFA), ref: 6788979A
                  • SDL_GetHintBoolean.SDL2(?,?,?,?,?,?,?,?,?,?,?,?,67886CFA), ref: 678897A4
                  Strings
                  • SDL_MIXER_DISABLE_%s, xrefs: 67889754
                  • Couldn't load %s: %s, xrefs: 678897F6
                  • SDL_MIXER_DEBUG_MUSIC_INTERFACES, xrefs: 6788975B
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: BooleanHintL_snprintf
                  • String ID: Couldn't load %s: %s$SDL_MIXER_DEBUG_MUSIC_INTERFACES$SDL_MIXER_DISABLE_%s
                  • API String ID: 2839853463-1199014118
                  • Opcode ID: 2bda8daebfd7dcc6b39e38d433e299606b473b9369a5359a53db48a0ef291119
                  • Instruction ID: 998e2545843e8b81a8818630dcfa863a45737c748a8788634c15f4b3c5de361f
                  • Opcode Fuzzy Hash: 2bda8daebfd7dcc6b39e38d433e299606b473b9369a5359a53db48a0ef291119
                  • Instruction Fuzzy Hash: B811B137345606A5EB10DF2EBC0075A6361BB6C788F8888228F5E83240EF39CD46C700
                  Function 62E88E80 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 70COMMON
                  Download Yara Rule
                  APIs
                  • malloc.MSVCRT(?,?,?,?,?,?,?,62E892D5), ref: 62E88E90
                  • malloc.MSVCRT(?,?,?,?,?,?,?,62E892D5), ref: 62E88EC2
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270152250.0000000062E81000.00000020.00000001.01000000.0000001D.sdmp, Offset: 62E80000, based on PE: true
                  • Associated: 00000016.00000002.2270136370.0000000062E80000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270171204.0000000062E95000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270187075.0000000062E9E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270203868.0000000062E9F000.00000004.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270219476.0000000062EA2000.00000008.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270233416.0000000062EA3000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  Similarity
                  • API ID: malloc
                  • String ID: 1.2.11$X$out of memory
                  • API String ID: 2803490479-3117843206
                  • Opcode ID: 426f91da6e627d99b416274e9e995b5529c257d4131b6ac83730ea62e5a0ac7d
                  • Instruction ID: 24dcb26c5a46367f903b5f5ae8f79998304f09b7ceac66e12d5503b993265b8d
                  • Opcode Fuzzy Hash: 426f91da6e627d99b416274e9e995b5529c257d4131b6ac83730ea62e5a0ac7d
                  • Instruction Fuzzy Hash: 90215A72610B448AE740CF39E85035E37A1FB85B9CF649239EE9D9B358EB39C885C740
                  Function 678863B0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 69COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • VOC sample rate codes differ, xrefs: 6788665A
                  • VOC Sample rate is zero?, xrefs: 6788663C
                  • VOC decoder only interprets 8-bit data, xrefs: 67886675
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: VOC Sample rate is zero?$VOC decoder only interprets 8-bit data$VOC sample rate codes differ
                  • API String ID: 2619118453-2745385038
                  • Opcode ID: b4594fa46df76bf7b91ad9006eef8b71c49345d37be17c541356b83995433840
                  • Instruction ID: 8c52f7e05b677eef9fd907a134d7c3f2d9db861d6c643628765b79c48e189c46
                  • Opcode Fuzzy Hash: b4594fa46df76bf7b91ad9006eef8b71c49345d37be17c541356b83995433840
                  • Instruction Fuzzy Hash: 1321F6723282518ED311CF39D51435A67A1F3A979CF408A25CE59C7AC6FB7AC9D6CB00
                  Function 62E87E10 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 65stringCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270152250.0000000062E81000.00000020.00000001.01000000.0000001D.sdmp, Offset: 62E80000, based on PE: true
                  • Associated: 00000016.00000002.2270136370.0000000062E80000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270171204.0000000062E95000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270187075.0000000062E9E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270203868.0000000062E9F000.00000004.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270219476.0000000062EA2000.00000008.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270233416.0000000062EA3000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  Similarity
                  • API ID: strlen$freemalloc
                  • String ID: %s%s%s
                  • API String ID: 1282205974-3094730333
                  • Opcode ID: f4f726387b7d0ac42d814fdebca4e10d95658b86df557e99fafde7eecab516cb
                  • Instruction ID: ae60bdc93d0e6f12eafdde9974a5458c9715b49dcb657806d27e89cc35d9d47f
                  • Opcode Fuzzy Hash: f4f726387b7d0ac42d814fdebca4e10d95658b86df557e99fafde7eecab516cb
                  • Instruction Fuzzy Hash: 7D118437B42B1084DA119B25E92039D67549785BECF68933ADEBD1F7A4DB38CA86C340
                  Function 6788D040 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: AudioStream$ErrorFreeL_freeL_malloc
                  • String ID: op_head returned NULL
                  • API String ID: 253728251-3476523653
                  • Opcode ID: dd91b58203fc63869b80e4e70cf5b8c9af3ac70952b37ca70ae4afffd4dfdb7b
                  • Instruction ID: 305d5fe5da7fc7c435b76ae08edc57c94c1a79c1783becced1164547f0ba5098
                  • Opcode Fuzzy Hash: dd91b58203fc63869b80e4e70cf5b8c9af3ac70952b37ca70ae4afffd4dfdb7b
                  • Instruction Fuzzy Hash: B521AF3620675086EB189F38E55032977A1FB6CB68F244A26DB69877C4DB39CC91C750
                  Function 6A884BC0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 62COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: L_memcmp
                  • String ID: FORM$ILBM$PBM
                  • API String ID: 683559773-3886900123
                  • Opcode ID: df2037833af295d374c74a1e3c98cf11064c44ce9492854d086905bec4c8e9a1
                  • Instruction ID: d5c962dc4441c82c34cdace022f87fe37bbbbcb624ac2c03b12cb6e8d1858103
                  • Opcode Fuzzy Hash: df2037833af295d374c74a1e3c98cf11064c44ce9492854d086905bec4c8e9a1
                  • Instruction Fuzzy Hash: 8501A16370551049FB11963B9C14799461BABC5FE9F8A4421CE0D47B65EF3EC546C701
                  Function 68B464A0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 54COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: __iob_func$ExitProcess
                  • String ID: inconsistent chromaticities$libpng error: %s$undefined
                  • API String ID: 2347714395-3746788377
                  • Opcode ID: f5f52cad598ad0e0617d2f1d9c9cc47745bcba9bab0d269fb33afd8c2e1d978e
                  • Instruction ID: 849b21a7849996bbaa8aa803f16cbd2cd4ea816d1a1bb2d005e8276c1c8059fd
                  • Opcode Fuzzy Hash: f5f52cad598ad0e0617d2f1d9c9cc47745bcba9bab0d269fb33afd8c2e1d978e
                  • Instruction Fuzzy Hash: CC11A165702BC984FE19AB56A8667BC5721EF8AF84F89A5358E1D47318EF29D0438300
                  Function 6788A950 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50fileCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: BooleanFileFromHintL_getenv
                  • String ID: /usr/share/sounds/sf2/FluidR3_GM.sf2$SDL_FORCE_SOUNDFONTS$SDL_SOUNDFONTS
                  • API String ID: 284037638-3727766652
                  • Opcode ID: 82ebeea721a6568b7775328a27abec5c6d2ce48635a59df84b6d19279cd03874
                  • Instruction ID: 09533395064237b1c9636cd395f64e30a22f3b406be1999f7f0181af31ad3444
                  • Opcode Fuzzy Hash: 82ebeea721a6568b7775328a27abec5c6d2ce48635a59df84b6d19279cd03874
                  • Instruction Fuzzy Hash: D8015B2164E345A9FF468F298D4436926919BBDB44F8E187A8E2D063C0FB2DDC908312
                  Function 6A897D60 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 40COMMON
                  Download Yara Rule
                  APIs
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A881417), ref: 6A897DC1
                  • SDL_LoadFunction.SDL2(?,?,?,?,6A881417), ref: 6A897DE0
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: FunctionLoad
                  • String ID: WebPDecodeRGBAInto$WebPDecodeRGBInto$WebPGetFeaturesInternal$libwebp-7.dll
                  • API String ID: 3436893612-2211964907
                  • Opcode ID: 3cb5115fe44c7586d6bd5460632971ff8522f6c672999bfd922eed593b62225f
                  • Instruction ID: 700949055aa2072e8db274310d9e96be67d242dae97e234b0c91abc028eedca8
                  • Opcode Fuzzy Hash: 3cb5115fe44c7586d6bd5460632971ff8522f6c672999bfd922eed593b62225f
                  • Instruction Fuzzy Hash: 3C111E60315B028DFA02E72CEC843683BB2BB42344F410A16D55E6B7B5EF3FD4608B05
                  Function 6788D6F0 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 31COMMON
                  Download Yara Rule
                  APIs
                  • SDL_getenv.SDL2 ref: 67893B9C
                    • Part of subcall function 6788E2D0: malloc.MSVCRT(00000000,?,?,67893BB0), ref: 6788E2DF
                    • Part of subcall function 6788E2D0: strlen.MSVCRT ref: 6788E2EF
                    • Part of subcall function 6788E2D0: malloc.MSVCRT(00000000,?,?,67893BB0), ref: 6788E2FB
                    • Part of subcall function 6788E2D0: memcpy.MSVCRT ref: 6788E311
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: malloc$L_getenvmemcpystrlen
                  • String ID: /etc/timidity.cfg$/etc/timidity/freepats.cfg$C:\TIMIDITY$TIMIDITY_CFG$timidity.cfg
                  • API String ID: 3100911805-2663940341
                  • Opcode ID: 37acba29f81e67d55681c7f9cfc3d836de69371f5d11d31c7b13cac11eae8ba1
                  • Instruction ID: 7b40f220b834779bc97ec5f57b26f96d7d7347f75b5a1163ce93e7d03cb96977
                  • Opcode Fuzzy Hash: 37acba29f81e67d55681c7f9cfc3d836de69371f5d11d31c7b13cac11eae8ba1
                  • Instruction Fuzzy Hash: 6BF0F821798505E4FA10D77E9C657B9266A5FBD348F880C31AB0EC2970FF2DCD688A11
                  Function 6AEA2940 Relevance: 9.3, APIs: 1, Strings: 5, Instructions: 283COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID:
                  • String ID: CharStrings$FontDirectory$closefile$eexec$version
                  • API String ID: 0-630624111
                  • Opcode ID: 9317b64da8642724ca5e5b529bef2b8b736b1ec3f123f1eeca7340b56d1ca941
                  • Instruction ID: 30cb4ad04583ef20fcc01563fd3a0dfd803a98d413d8efa2e8ec4b5aab5ca59d
                  • Opcode Fuzzy Hash: 9317b64da8642724ca5e5b529bef2b8b736b1ec3f123f1eeca7340b56d1ca941
                  • Instruction Fuzzy Hash: B2A1F0327456408ADB158A27C41479A3B66FB26F8CFA6C0A6CF546F778DF39C586C340
                  Function 678878F0 Relevance: 9.2, APIs: 6, Instructions: 245COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: L_memsetTicks
                  • String ID:
                  • API String ID: 2193970592-0
                  • Opcode ID: 388a0f655d57a5b7b24000b5cc756aaeee63831d08770629af8fb572d3a24be4
                  • Instruction ID: 000a8eb4695723e1cc86afec93d84383445424b2aafb7c16d350917e8c6c9916
                  • Opcode Fuzzy Hash: 388a0f655d57a5b7b24000b5cc756aaeee63831d08770629af8fb572d3a24be4
                  • Instruction Fuzzy Hash: B091E2723156548AD708CF6AD988F1977BAF7A8BC8F018925DE095B714EB3ACC41CF40
                  Function 6A883270 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 468COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • EOF / read error on image data, xrefs: 6A8837C0
                  • error reading image, xrefs: 6A88399F
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: Error$CreateSurface
                  • String ID: EOF / read error on image data$error reading image
                  • API String ID: 339971185-1919586488
                  • Opcode ID: abb12912d3fb35b79512fc2860016a1d6518af93568077a7990293199f450e65
                  • Instruction ID: 251d9424b45da525dbc578d04be301a992bb8bb8593196a4e766201eb198f1ae
                  • Opcode Fuzzy Hash: abb12912d3fb35b79512fc2860016a1d6518af93568077a7990293199f450e65
                  • Instruction Fuzzy Hash: D502B6F230C6848AE721CA16D044B1AFB66F795F88F0689A5CF494B746DF7DC846CB01
                  Function 6A88B540 Relevance: 9.2, APIs: 6, Instructions: 183COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: L_sqrtfL_strcmp$L_mallocL_memcpy
                  • String ID:
                  • API String ID: 167676509-0
                  • Opcode ID: 920bc181a020456a60b9034a72e3d4329bdcfb44e7c34aba006ffb8e03eebb9d
                  • Instruction ID: 1fc3d134ad952ff23b923c0830608fa36a15a886955e3ebc7f6883f7ef62bd84
                  • Opcode Fuzzy Hash: 920bc181a020456a60b9034a72e3d4329bdcfb44e7c34aba006ffb8e03eebb9d
                  • Instruction Fuzzy Hash: 62710A22A19BC885E616CB3B85497D9F764FFAA788F09D712EE4422672DF34E052C700
                  Function 67881047 Relevance: 9.1, APIs: 6, Instructions: 121sleepCOMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Sleep_amsg_exit_initterm
                  • String ID:
                  • API String ID: 1554918350-0
                  • Opcode ID: de3ef46f5d0526093895f8d1d8598e2e7902d14d3eab5558c91ec5a5829c8ed9
                  • Instruction ID: 136cbe022da6d074e34b9a904d1dcaba377b73f907d6c0a38d7cd70613f2c908
                  • Opcode Fuzzy Hash: de3ef46f5d0526093895f8d1d8598e2e7902d14d3eab5558c91ec5a5829c8ed9
                  • Instruction Fuzzy Hash: 72418635B59648C9EB018F1EEC5432927A6FBACB88F048829DE2D87354EF39CC51C741
                  Function 71001047 Relevance: 9.1, APIs: 6, Instructions: 121sleepCOMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270895464.0000000071001000.00000020.00000001.01000000.00000029.sdmp, Offset: 71000000, based on PE: true
                  • Associated: 00000016.00000002.2270880501.0000000071000000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270911307.0000000071007000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270926559.000000007100B000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270940910.000000007100C000.00000004.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270955038.000000007100F000.00000008.00000001.01000000.00000029.sdmpDownload File
                  Similarity
                  • API ID: Sleep_amsg_exit_initterm
                  • String ID:
                  • API String ID: 1554918350-0
                  • Opcode ID: 445c216947a368f33be29486e5a6d20d1ab5526697c64585411566461a8e28b7
                  • Instruction ID: 6fb75fefa4eeb9890f8fcac5dc577694e2b16abd241cc2d3d30280c7f29511e5
                  • Opcode Fuzzy Hash: 445c216947a368f33be29486e5a6d20d1ab5526697c64585411566461a8e28b7
                  • Instruction Fuzzy Hash: 9B414D31715A8585FB0ADB1AE8547A923B2BB8CF84F448425EE4E8B394EFBCD481C351
                  Function 6AE81047 Relevance: 9.1, APIs: 6, Instructions: 121sleepCOMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID: Sleep_amsg_exit_initterm
                  • String ID:
                  • API String ID: 1554918350-0
                  • Opcode ID: a48b0ac4e3b0f652546f7e7fbb189fe9efaf83ac2a3e027d08e9ca579f29616e
                  • Instruction ID: f452edec55299cebd9637f2f97c683763d198c0ca594f34493bc1d0ca288cccf
                  • Opcode Fuzzy Hash: a48b0ac4e3b0f652546f7e7fbb189fe9efaf83ac2a3e027d08e9ca579f29616e
                  • Instruction Fuzzy Hash: 83418971306A8485FB419FD6EC6831923A2FB49B88F688436CE1D5B356DF7DC451C722
                  Function 62E81047 Relevance: 9.1, APIs: 6, Instructions: 121sleepCOMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270152250.0000000062E81000.00000020.00000001.01000000.0000001D.sdmp, Offset: 62E80000, based on PE: true
                  • Associated: 00000016.00000002.2270136370.0000000062E80000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270171204.0000000062E95000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270187075.0000000062E9E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270203868.0000000062E9F000.00000004.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270219476.0000000062EA2000.00000008.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270233416.0000000062EA3000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  Similarity
                  • API ID: Sleep_amsg_exit_initterm
                  • String ID:
                  • API String ID: 1554918350-0
                  • Opcode ID: 979ba3d7248e26354d330906b5ec429826d21977a22013ac4a554375e50a5a33
                  • Instruction ID: 947d1609e53718353eee2f09ccb33c72466d4d875ee487bc112e70c922fbd185
                  • Opcode Fuzzy Hash: 979ba3d7248e26354d330906b5ec429826d21977a22013ac4a554375e50a5a33
                  • Instruction Fuzzy Hash: 6C415135B15A84C5EB01DB66EC6036923A6B789B8CF24C436DDAD9B354EF3EC491C311
                  Function 6A881047 Relevance: 9.1, APIs: 6, Instructions: 121sleepCOMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: Sleep_amsg_exit_initterm
                  • String ID:
                  • API String ID: 1554918350-0
                  • Opcode ID: aefe90d447d1a430a3e711adecea06113502fa4d95afc6a2681f9cd273f3b125
                  • Instruction ID: e6f370ca1adb8e211753cf37e94a0bc31f5bfaa489d96f69f598f8741b634e4c
                  • Opcode Fuzzy Hash: aefe90d447d1a430a3e711adecea06113502fa4d95afc6a2681f9cd273f3b125
                  • Instruction Fuzzy Hash: 9141B766719A44CDFB019F2EED5031673A2FB49B84F048825CEAD9B765EF39C441C721
                  Function 68B41047 Relevance: 9.1, APIs: 6, Instructions: 121sleepCOMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: Sleep_amsg_exit_initterm
                  • String ID:
                  • API String ID: 1554918350-0
                  • Opcode ID: 9abdc310c03a82d2f1645d3de778516c18db347d7753c4bee5681c217e9b87df
                  • Instruction ID: b05af996e2e02169f22fe2aaea0c16d1317a6562e16d27522185eafb9848de53
                  • Opcode Fuzzy Hash: 9abdc310c03a82d2f1645d3de778516c18db347d7753c4bee5681c217e9b87df
                  • Instruction Fuzzy Hash: 38417225A51AC0C5EB01CB16EC5531E23A2FB89B88F98D525DE2D4B358FF7AC4A2C311
                  Function 68B5ABD0 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 99stringCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • Insufficient memory to process iCCP chunk, xrefs: 68B5AC76
                  • Invalid iCCP compression method, xrefs: 68B5AD30
                  • Insufficient memory to process iCCP profile, xrefs: 68B5AD0C
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: memcpy$strlen
                  • String ID: Insufficient memory to process iCCP chunk$Insufficient memory to process iCCP profile$Invalid iCCP compression method
                  • API String ID: 2619041689-1022264010
                  • Opcode ID: f319541158de111cdf9121e9f2f9ab740b3a15cceea98714dea4cdf247ec3ca6
                  • Instruction ID: 2d81e37d23d35069cfa03966a937fbf022fa73007dc0d9663bcc2fcbfac5183b
                  • Opcode Fuzzy Hash: f319541158de111cdf9121e9f2f9ab740b3a15cceea98714dea4cdf247ec3ca6
                  • Instruction Fuzzy Hash: A831356A3012D044EF15CF22BE1076EAA55FB49FDCFC891258E692BB58EF38C096D710
                  Function 6788D520 Relevance: 9.1, APIs: 6, Instructions: 79COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error$AudioL_callocL_mallocL_memcpyStream
                  • String ID:
                  • API String ID: 1592866586-0
                  • Opcode ID: 6ac1886d875157055b69ae02b90b06157fec6b1db2fcbec6124f77baa6e91028
                  • Instruction ID: 130a45ddbfd7bc8273b4c85258e3477a84d9b4bb34407e5e44c9b997db9c9612
                  • Opcode Fuzzy Hash: 6ac1886d875157055b69ae02b90b06157fec6b1db2fcbec6124f77baa6e91028
                  • Instruction Fuzzy Hash: 80212D32219B9445DB59CF2D501422E7A91E79DF48F18493AAF9E47784EF3CCC408B60
                  Function 68B62050 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 59stringCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: memcpystrlen
                  • String ID: Can't write sCAL (buffer too small)$LACs
                  • API String ID: 3412268980-1090296474
                  • Opcode ID: 2da0ab0bf11a028d7cecb51963a1457792a011ee05d7d970134a967615a81503
                  • Instruction ID: ff52f8db4b9538ed9a811b366b375a966acfbd084e2f75b891752c404541cefd
                  • Opcode Fuzzy Hash: 2da0ab0bf11a028d7cecb51963a1457792a011ee05d7d970134a967615a81503
                  • Instruction Fuzzy Hash: 8001BC5B34569550AA12DB57AD004BF9615A7AAFFCFC98126AE0D1B308DA38C6C7C300
                  Function 6AE8D314 Relevance: 9.0, APIs: 7, Instructions: 255COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID: memset$memcpy
                  • String ID:
                  • API String ID: 368790112-0
                  • Opcode ID: 40f664e5c36b4c535b9d7c0b8bf83ed04c23a9d322f8f749811203c6e093a1f5
                  • Instruction ID: 53a7f0e312ca8f3f14295728c634a98f1097cf3e86776dbd49a516bd91df79fc
                  • Opcode Fuzzy Hash: 40f664e5c36b4c535b9d7c0b8bf83ed04c23a9d322f8f749811203c6e093a1f5
                  • Instruction Fuzzy Hash: E5A1B0BBA18A9487C710CF29E08060EBBA1F785B98F658116EF8D57B18DF39D845CB40
                  Function 69A2BF30 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 212memoryCOMMON
                  Download Yara Rule
                  APIs
                  • VirtualQuery.KERNEL32(?,?,?,?,?,?,69A32014,?,?,?,?,69A01306), ref: 69A2C0E0
                  • VirtualProtect.KERNEL32(?,?,?,?,?,?,69A32014,?,?,?,?,69A01306), ref: 69A2C102
                  Strings
                  • Unknown pseudo relocation protocol version %d., xrefs: 69A2C22D
                  • Unknown pseudo relocation bit size %d., xrefs: 69A2C1C6
                  • VirtualQuery failed for %d bytes at address %p, xrefs: 69A2BF18, 69A2C216
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270515173.0000000069A01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 69A00000, based on PE: true
                  • Associated: 00000016.00000002.2270499163.0000000069A00000.00000002.00000001.01000000.0000001E.sdmpDownload File
                  • Associated: 00000016.00000002.2270543058.0000000069A33000.00000002.00000001.01000000.0000001E.sdmpDownload File
                  • Associated: 00000016.00000002.2270561128.0000000069A3E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                  • Associated: 00000016.00000002.2270576553.0000000069A40000.00000004.00000001.01000000.0000001E.sdmpDownload File
                  • Associated: 00000016.00000002.2270591630.0000000069A43000.00000002.00000001.01000000.0000001E.sdmpDownload File
                  Similarity
                  • API ID: Virtual$ProtectQuery
                  • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$ VirtualQuery failed for %d bytes at address %p
                  • API String ID: 1027372294-974437099
                  • Opcode ID: a662a1d0f95f4ba8cab1eb7169a05eab56dd9e0edf0559db364085501566e345
                  • Instruction ID: bf41d4d05c832917a284ddead9ef8cf5ff2f3c3a72199efdf56756c576377f5e
                  • Opcode Fuzzy Hash: a662a1d0f95f4ba8cab1eb7169a05eab56dd9e0edf0559db364085501566e345
                  • Instruction Fuzzy Hash: 3971C076B10A6496EF00CF66EA41B8973F6B706FA8F4C8206DD1C47B54DB39D491C781
                  Function 6A882F40 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 186COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: circular table entry BIG ERROR$invalid LWZ data
                  • API String ID: 2619118453-176812799
                  • Opcode ID: eb9ed9f7c9ba116f1e54b8472a4e2cfe9a000440cbdf2534154eb317d2bdd871
                  • Instruction ID: 6b13b8d26030209e0527b4d8500842a769c7f9020110e86033c9037ba68b9bae
                  • Opcode Fuzzy Hash: eb9ed9f7c9ba116f1e54b8472a4e2cfe9a000440cbdf2534154eb317d2bdd871
                  • Instruction Fuzzy Hash: 67719DF66496808AE740CF34E5843ECB7A1F785B8CF198539DF484B648EF349486CB24
                  Function 71002070 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 143COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270895464.0000000071001000.00000020.00000001.01000000.00000029.sdmp, Offset: 71000000, based on PE: true
                  • Associated: 00000016.00000002.2270880501.0000000071000000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270911307.0000000071007000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270926559.000000007100B000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270940910.000000007100C000.00000004.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270955038.000000007100F000.00000008.00000001.01000000.00000029.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: Couldn't find glyph$Library not initialized$Passed a NULL pointer
                  • API String ID: 2619118453-1487259708
                  • Opcode ID: 214fb998a13e4166d3833ad808f4db0d9620032e7e43b7c26f133aa83a3248da
                  • Instruction ID: 013c7c1e2772b45211b8b66c97128345727d5a677b22d21571fea02d03c99f7f
                  • Opcode Fuzzy Hash: 214fb998a13e4166d3833ad808f4db0d9620032e7e43b7c26f133aa83a3248da
                  • Instruction Fuzzy Hash: 5B51A2363096858AE721DF29E884B5B77B6F788B54F504125EB4E83B94EF7CC489CB40
                  Function 62E88FA0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133stringCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • internal error: deflate stream corrupt, xrefs: 62E89155
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270152250.0000000062E81000.00000020.00000001.01000000.0000001D.sdmp, Offset: 62E80000, based on PE: true
                  • Associated: 00000016.00000002.2270136370.0000000062E80000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270171204.0000000062E95000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270187075.0000000062E9E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270203868.0000000062E9F000.00000004.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270219476.0000000062EA2000.00000008.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270233416.0000000062EA3000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  Similarity
                  • API ID: _errno_writestrerror
                  • String ID: internal error: deflate stream corrupt
                  • API String ID: 3682106801-3609297558
                  • Opcode ID: bb8720d85b55933c085cafbc4548f9cb141e0b2ce8a29054898ed8f61f491936
                  • Instruction ID: ac363b4b10ec9667d5cdc17c26a8c450aa735f4437c8afb9bcc2dabffd83a02a
                  • Opcode Fuzzy Hash: bb8720d85b55933c085cafbc4548f9cb141e0b2ce8a29054898ed8f61f491936
                  • Instruction Fuzzy Hash: D441B272B05A4486C7048E7AD86075A33A2F705BACF74D23ACEAD8B354DF39C882C751
                  Function 678881C0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 125COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • Tried to play a chunk with a bad frame, xrefs: 67888368
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: AudioDevice$LockUnlock
                  • String ID: Tried to play a chunk with a bad frame
                  • API String ID: 1204176060-492037178
                  • Opcode ID: 79d31a2d381226da795ce1b4bbf43b6a29c20f2de241cab1f043ff0153de14d9
                  • Instruction ID: 67854ebfb5347fa67c30d5e0b53e65340f6a7861ad57e3214db824b19f586292
                  • Opcode Fuzzy Hash: 79d31a2d381226da795ce1b4bbf43b6a29c20f2de241cab1f043ff0153de14d9
                  • Instruction Fuzzy Hash: C041CEB2768B098FE7489F5DD88471836A6FB7D758F444A29DB1887350EB36CCA1CB40
                  Function 6788CB50 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON
                  Download Yara Rule
                  APIs
                  • SDL_AudioStreamGet.SDL2 ref: 6788CB65
                    • Part of subcall function 6788C540: SDL_memcpy.SDL2 ref: 6788C591
                    • Part of subcall function 6788C540: SDL_free.SDL2 ref: 6788C5A2
                    • Part of subcall function 6788C540: SDL_FreeAudioStream.SDL2 ref: 6788C5BE
                    • Part of subcall function 6788C540: SDL_NewAudioStream.SDL2 ref: 6788C5F5
                    • Part of subcall function 6788C540: SDL_malloc.SDL2 ref: 6788C619
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: AudioStream$FreeL_freeL_mallocL_memcpy
                  • String ID: ov_pcm_seek$ov_read
                  • API String ID: 3719101117-1696883351
                  • Opcode ID: 9c03b28f94b5a77d3dbd86de00eecf0b2d0a1a1ec19d135f31ac3529f440d4ca
                  • Instruction ID: c1d059ef15b7e0148719462ec0db755c66191a5fd79e4dd0d12a6b8776b19afc
                  • Opcode Fuzzy Hash: 9c03b28f94b5a77d3dbd86de00eecf0b2d0a1a1ec19d135f31ac3529f440d4ca
                  • Instruction Fuzzy Hash: F34160337446848AD702CF39A84435937A6A7A9BBCF585771AF598B389EF34C9808B50
                  Function 62E89180 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106stringCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • internal error: deflate stream corrupt, xrefs: 62E892E5
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270152250.0000000062E81000.00000020.00000001.01000000.0000001D.sdmp, Offset: 62E80000, based on PE: true
                  • Associated: 00000016.00000002.2270136370.0000000062E80000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270171204.0000000062E95000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270187075.0000000062E9E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270203868.0000000062E9F000.00000004.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270219476.0000000062EA2000.00000008.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270233416.0000000062EA3000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  Similarity
                  • API ID: _write$_errnostrerror
                  • String ID: internal error: deflate stream corrupt
                  • API String ID: 2119721117-3609297558
                  • Opcode ID: 513e57e04726ad414df4d27bd28734df8279481ef2c1ece0bfc4714d37a32271
                  • Instruction ID: 14dc56d6ac5a6ab4693b1c9447c91f242dc3ab9d56bb08d172571701b343307f
                  • Opcode Fuzzy Hash: 513e57e04726ad414df4d27bd28734df8279481ef2c1ece0bfc4714d37a32271
                  • Instruction Fuzzy Hash: 883193B6B0474486D7008EBAE46075933A1F745BACF64D239DE9C8B788EF38C892C751
                  Function 6AEDA770 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID: inflate$Init2_
                  • String ID: 1.2.11
                  • API String ID: 2804985353-4284987526
                  • Opcode ID: 5e0dd3df5d169d22fdb81769f0772927f99c3cd5ca25d053fa7caccbede78864
                  • Instruction ID: f44952ff67179591875f3756c6492b1ad1a1769e2644597b41a43569c4dd3ae9
                  • Opcode Fuzzy Hash: 5e0dd3df5d169d22fdb81769f0772927f99c3cd5ca25d053fa7caccbede78864
                  • Instruction Fuzzy Hash: 05218337759A8046EA11A738B80434E62A1F7867B8F650325DE7997BE8DF3DC643CB00
                  Function 6A883A70 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 62COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: L_memcmpL_strncmp
                  • String ID: 87a$89a$GIF
                  • API String ID: 3790170554-3171888087
                  • Opcode ID: 786c234d2c640575862914d796f3ae72899d8a6c9e6527d5936bfa5667d2c006
                  • Instruction ID: 915045a74dd2d28d64bc9f9a8e5b63d34a14733223b12a80a90d854c7c5f5779
                  • Opcode Fuzzy Hash: 786c234d2c640575862914d796f3ae72899d8a6c9e6527d5936bfa5667d2c006
                  • Instruction Fuzzy Hash: CA01496270951059FB11973FDC147999615ABC6FD8F890430DD0D47BA0EF2ECA47C700
                  Function 71004C30 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 60COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270895464.0000000071001000.00000020.00000001.01000000.00000029.sdmp, Offset: 71000000, based on PE: true
                  • Associated: 00000016.00000002.2270880501.0000000071000000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270911307.0000000071007000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270926559.000000007100B000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270940910.000000007100C000.00000004.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270955038.000000007100F000.00000008.00000001.01000000.00000029.sdmpDownload File
                  Similarity
                  • API ID: Error$Get_Kerning
                  • String ID: Couldn't find glyph$Couldn't get glyph kerning
                  • API String ID: 1296689526-3212460707
                  • Opcode ID: 95047612d361c0843b9c72fb867fc52e7ac93e08ecc54bee396d408f2c75a520
                  • Instruction ID: 77d448625d888fbd3e157e579227c957cd4c29742387a016321bea3b4ce8636d
                  • Opcode Fuzzy Hash: 95047612d361c0843b9c72fb867fc52e7ac93e08ecc54bee396d408f2c75a520
                  • Instruction Fuzzy Hash: 8511277270450581FB519B3AFC44BA566E1B384FD4F404362EA8EC73E4EB7CC5828380
                  Function 68B464D0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 45COMMON
                  Download Yara Rule
                  APIs
                  • __iob_func.MSVCRT ref: 68B464F2
                  • __iob_func.MSVCRT ref: 68B46507
                    • Part of subcall function 68B464A0: ExitProcess.KERNEL32 ref: 68B464C5
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: __iob_func$ExitProcess
                  • String ID: inconsistent chromaticities$libpng error: %s$undefined
                  • API String ID: 2347714395-3746788377
                  • Opcode ID: 261a2390a9179af457cf431d5071caaa404188e672d12f3ac48cd395e3a25787
                  • Instruction ID: 2d006db836a273f5f65404b222d2ab1b75d54037927355e1944cc68627c56265
                  • Opcode Fuzzy Hash: 261a2390a9179af457cf431d5071caaa404188e672d12f3ac48cd395e3a25787
                  • Instruction Fuzzy Hash: 87018451701BD990FD04AB66AD567F85B21EF8ABC4F88A1319E1D47358EF25D143C300
                  Function 678875A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error$L_malloc
                  • String ID: Audio device hasn't been opened$Out of memory
                  • API String ID: 1434575867-1723620761
                  • Opcode ID: 87e9189a0ae03b214c2dfdee1364017301a1b588a4f6612bc570a7ae64604e76
                  • Instruction ID: 32dbf333fdde6a77198e01387fd331eb90a234a25bcb2aac0307c32ed444dd2b
                  • Opcode Fuzzy Hash: 87e9189a0ae03b214c2dfdee1364017301a1b588a4f6612bc570a7ae64604e76
                  • Instruction Fuzzy Hash: 70F0F03330930185FB058B9DB8443691A60A7AC7A4F8846349E28873D0DF38CCC2CB40
                  Function 6A88D7C0 Relevance: 7.7, APIs: 5, Instructions: 188COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: L_sqrtf$L_mallocL_memcpyL_memset
                  • String ID:
                  • API String ID: 1075676323-0
                  • Opcode ID: eef8e2b76d49f67a1b5dfe51c5a5ae83eef37edb873d13f76998aeff0cfebcc5
                  • Instruction ID: 53d96954123cdff85ab57902f728aa2cf95ebb8c2801abbf537c5d63330c96a7
                  • Opcode Fuzzy Hash: eef8e2b76d49f67a1b5dfe51c5a5ae83eef37edb873d13f76998aeff0cfebcc5
                  • Instruction Fuzzy Hash: 1D81B3726087C48AD715CF3A94813A9BBA1FB9AB84F19C726DE44177A6DF39D084CB10
                  Function 68B61DD0 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 154stringCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: strlen
                  • String ID: LACp$Unrecognized equation type for pCAL chunk$pCAL: invalid keyword
                  • API String ID: 39653677-3947872664
                  • Opcode ID: df8f26c7665d048761ab940c939165f42aba72820d58604928e8653db7a68d3d
                  • Instruction ID: 922d83e9f1c76af142114091581be0997fca1099d3dabe9701adc906421d6685
                  • Opcode Fuzzy Hash: df8f26c7665d048761ab940c939165f42aba72820d58604928e8653db7a68d3d
                  • Instruction Fuzzy Hash: 7151D3767096D086DA15CB16E5403AEB762F78ABE4FC49011DEA957B18DF78C187CB00
                  Function 710015E0 Relevance: 7.6, APIs: 5, Instructions: 121COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270895464.0000000071001000.00000020.00000001.01000000.00000029.sdmp, Offset: 71000000, based on PE: true
                  • Associated: 00000016.00000002.2270880501.0000000071000000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270911307.0000000071007000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270926559.000000007100B000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270940910.000000007100C000.00000004.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270955038.000000007100F000.00000008.00000001.01000000.00000029.sdmpDownload File
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 2912a74ee31c139a37c31855a677aa8e2c6377c2571cb01173e973aa768e63da
                  • Instruction ID: ccfb47a546c9ac83a6e35535877bade0cb9547380b7fa274e198bcc08e57ab7d
                  • Opcode Fuzzy Hash: 2912a74ee31c139a37c31855a677aa8e2c6377c2571cb01173e973aa768e63da
                  • Instruction Fuzzy Hash: 6F416273A006508BD398CF35E99066D7BE5F788F49718911ADB47DBB48E778E481CB40
                  Function 6A88B8E0 Relevance: 7.6, APIs: 5, Instructions: 118COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: L_strtoll$L_pow
                  • String ID:
                  • API String ID: 4075880751-0
                  • Opcode ID: fd76e3cbfff1d36851442168a4fb022d794e9f73c7409211c650ffbfb9459fb5
                  • Instruction ID: a7ebe98fc6324459c58077211b3f3b847e943f03dad0e34f09dc35b80f2ce575
                  • Opcode Fuzzy Hash: fd76e3cbfff1d36851442168a4fb022d794e9f73c7409211c650ffbfb9459fb5
                  • Instruction Fuzzy Hash: 5E414C9164CDD84CC2228B3D94143BEB7679B87BD8F48C702EA952B65BDF2EC1838700
                  Function 68B57AE0 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 108stringCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: strlen
                  • String ID: Insufficient memory to process text chunk$missing IHDR$no space in chunk cache$out of memory
                  • API String ID: 39653677-500919771
                  • Opcode ID: 878fdbcca236259248c3d1f519aeae66263d4970618340ce4666320276678d16
                  • Instruction ID: 4476d3586a56618f8bf9b2956cbd2c230088b2241dfc6d52b0524303ea2ef59e
                  • Opcode Fuzzy Hash: 878fdbcca236259248c3d1f519aeae66263d4970618340ce4666320276678d16
                  • Instruction Fuzzy Hash: B1310676744AC185EB218F25BC203BD7660E786BD8FC89130CE5947794EBBDC1A2C705
                  Function 67895550 Relevance: 7.6, APIs: 5, Instructions: 87COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: signal
                  • String ID:
                  • API String ID: 1946981877-0
                  • Opcode ID: 9775365307e0118ff03bd4050b5e80e5dc741ffeb4d041e51129d29428b68580
                  • Instruction ID: 8e8c60db2672cde8a4571555ae1be23542de78fc264b12b6a23b1a43e85eed9a
                  • Opcode Fuzzy Hash: 9775365307e0118ff03bd4050b5e80e5dc741ffeb4d041e51129d29428b68580
                  • Instruction Fuzzy Hash: 712100747483044AFB970DAD81A032A13469BBE36BF114C3ADB1ACB3D6D99D9CC94653
                  Function 710054E0 Relevance: 7.6, APIs: 5, Instructions: 87COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270895464.0000000071001000.00000020.00000001.01000000.00000029.sdmp, Offset: 71000000, based on PE: true
                  • Associated: 00000016.00000002.2270880501.0000000071000000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270911307.0000000071007000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270926559.000000007100B000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270940910.000000007100C000.00000004.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270955038.000000007100F000.00000008.00000001.01000000.00000029.sdmpDownload File
                  Similarity
                  • API ID: signal
                  • String ID:
                  • API String ID: 1946981877-0
                  • Opcode ID: 2be6bf7216fe8c07bd7098c4d3f4ff198b466fb4c9d55e2a424e060f80157507
                  • Instruction ID: ceb5cedb5ea5c3a971cb272c9be41fc91b08cac99bb8afce79fb02d9b5262b28
                  • Opcode Fuzzy Hash: 2be6bf7216fe8c07bd7098c4d3f4ff198b466fb4c9d55e2a424e060f80157507
                  • Instruction Fuzzy Hash: 1521B120B15A014AFB1A01A0A9A432E24F79B8DF16F558C7ACB4BC7395CF9F8CC94217
                  Function 6AEE6DA0 Relevance: 7.6, APIs: 5, Instructions: 87COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID: signal
                  • String ID:
                  • API String ID: 1946981877-0
                  • Opcode ID: e31f82d53d48134e88560b20ba7e65d1a6f801ec6149864ae5cecdfb5912ffd1
                  • Instruction ID: 2f9dd5ac021f23fb79ef59ef6dcb28fdb3b722a9a54226db603a84a2aac8cb92
                  • Opcode Fuzzy Hash: e31f82d53d48134e88560b20ba7e65d1a6f801ec6149864ae5cecdfb5912ffd1
                  • Instruction Fuzzy Hash: 7F2181207452024AFB6891E8C1A03293102BB9A31CF36483AEB19C73F3DE5ECBC64253
                  Function 62E92AF0 Relevance: 7.6, APIs: 5, Instructions: 87COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270152250.0000000062E81000.00000020.00000001.01000000.0000001D.sdmp, Offset: 62E80000, based on PE: true
                  • Associated: 00000016.00000002.2270136370.0000000062E80000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270171204.0000000062E95000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270187075.0000000062E9E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270203868.0000000062E9F000.00000004.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270219476.0000000062EA2000.00000008.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270233416.0000000062EA3000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  Similarity
                  • API ID: signal
                  • String ID:
                  • API String ID: 1946981877-0
                  • Opcode ID: b5b8be01eccf86187537139b9746edfbee8b17a60ab705d52b0675b56f5dd5b4
                  • Instruction ID: 77d6b9b83bd5968c65cc6448bc758dcebf5d134e6d2bd153e77664c560fe6929
                  • Opcode Fuzzy Hash: b5b8be01eccf86187537139b9746edfbee8b17a60ab705d52b0675b56f5dd5b4
                  • Instruction Fuzzy Hash: 06216F30F497054AFF0499B488B03E9119297EA31CF31DC3B8E298BB95ED9D89C6C242
                  Function 6A898800 Relevance: 7.6, APIs: 5, Instructions: 87COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: signal
                  • String ID:
                  • API String ID: 1946981877-0
                  • Opcode ID: 7bf111fd3d23d6116e7886c319ebfaf2bb9ab37770fce22b4591253a3ce4da4d
                  • Instruction ID: 837f4c248ccf83397d10a3a74dae7f6b36eeec676bd2559d6dee60707e5398ff
                  • Opcode Fuzzy Hash: 7bf111fd3d23d6116e7886c319ebfaf2bb9ab37770fce22b4591253a3ce4da4d
                  • Instruction Fuzzy Hash: DC21A22175D1174AFB6401FC84D07292C029B8F378F124C3ACA69C77D2CE5E89D59227
                  Function 68B637E0 Relevance: 7.6, APIs: 5, Instructions: 87COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: signal
                  • String ID:
                  • API String ID: 1946981877-0
                  • Opcode ID: 4c6a24172c8cfe244b519c78accbb8463b4d5c34468f68006b8cd20f11a2b9ea
                  • Instruction ID: 4643837475f09819dc9c26997a6edce96da1725b999f78b3b6a0c6aa5d6fc3a2
                  • Opcode Fuzzy Hash: 4c6a24172c8cfe244b519c78accbb8463b4d5c34468f68006b8cd20f11a2b9ea
                  • Instruction Fuzzy Hash: 14216654BA86C1C6FB1405B845D036E2252E78E338FD15836CB7B873D3C95EC8C94712
                  Function 6788D650 Relevance: 7.6, APIs: 6, Instructions: 67COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: free
                  • String ID:
                  • API String ID: 1294909896-0
                  • Opcode ID: 00e6044b2e2a10a2df453ba1af1da58cf9f8ccfa1fcd2443ba37f0655776bbb1
                  • Instruction ID: 6e42fadd2c78256bcd3bc7b1a58df4a92e956400074e4f92d114b64469374fae
                  • Opcode Fuzzy Hash: 00e6044b2e2a10a2df453ba1af1da58cf9f8ccfa1fcd2443ba37f0655776bbb1
                  • Instruction Fuzzy Hash: C2116D36B46548E4EE859F1EE8103AB2324BBFCB8DF544822DE2D0B605EB258C958781
                  Function 69A2C300 Relevance: 7.6, APIs: 5, Instructions: 54timethreadCOMMON
                  Download Yara Rule
                  APIs
                  • GetSystemTimeAsFileTime.KERNEL32 ref: 69A2C345
                  • GetCurrentProcessId.KERNEL32 ref: 69A2C350
                  • GetCurrentThreadId.KERNEL32 ref: 69A2C358
                  • GetTickCount.KERNEL32 ref: 69A2C360
                  • QueryPerformanceCounter.KERNEL32 ref: 69A2C36D
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270515173.0000000069A01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 69A00000, based on PE: true
                  • Associated: 00000016.00000002.2270499163.0000000069A00000.00000002.00000001.01000000.0000001E.sdmpDownload File
                  • Associated: 00000016.00000002.2270543058.0000000069A33000.00000002.00000001.01000000.0000001E.sdmpDownload File
                  • Associated: 00000016.00000002.2270561128.0000000069A3E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                  • Associated: 00000016.00000002.2270576553.0000000069A40000.00000004.00000001.01000000.0000001E.sdmpDownload File
                  • Associated: 00000016.00000002.2270591630.0000000069A43000.00000002.00000001.01000000.0000001E.sdmpDownload File
                  Similarity
                  • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
                  • String ID:
                  • API String ID: 1445889803-0
                  • Opcode ID: 8d12fb69d5f82855772b112cd59907971c6757f62902cca37db2ab4b18e74298
                  • Instruction ID: d86c55ab002c5b34dd5973c1806b953986da9bb5ecc22d3c4c0f50b749ae52df
                  • Opcode Fuzzy Hash: 8d12fb69d5f82855772b112cd59907971c6757f62902cca37db2ab4b18e74298
                  • Instruction Fuzzy Hash: 4411A377316B1181FF408BA5F908315A2E6B745BE1F085231DE5D46BE4DB3CC899C341
                  Function 67894F60 Relevance: 7.5, APIs: 5, Instructions: 47timethreadCOMMON
                  Download Yara Rule
                  APIs
                  • GetSystemTimeAsFileTime.KERNEL32 ref: 67894F9A
                  • GetCurrentProcessId.KERNEL32 ref: 67894FA5
                  • GetCurrentThreadId.KERNEL32 ref: 67894FAE
                  • GetTickCount.KERNEL32 ref: 67894FB6
                  • QueryPerformanceCounter.KERNEL32 ref: 67894FC3
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
                  • String ID:
                  • API String ID: 1445889803-0
                  • Opcode ID: 77523f7cdf7f4c6b7bf80d80b82fd5363d1bc57e7bfc67db59c49928c3a776f5
                  • Instruction ID: 57210a6af2f543cb76f890cc569b3674aa1be5df1924b16191a66a8239fe32e9
                  • Opcode Fuzzy Hash: 77523f7cdf7f4c6b7bf80d80b82fd5363d1bc57e7bfc67db59c49928c3a776f5
                  • Instruction Fuzzy Hash: 5411652578EB044AEB608B65E908715B3A1F7487A4F005631DD9D83BA4EF3DCD9AC300
                  Function 71004EF0 Relevance: 7.5, APIs: 5, Instructions: 47timethreadCOMMON
                  Download Yara Rule
                  APIs
                  • GetSystemTimeAsFileTime.KERNEL32 ref: 71004F2A
                  • GetCurrentProcessId.KERNEL32 ref: 71004F35
                  • GetCurrentThreadId.KERNEL32 ref: 71004F3E
                  • GetTickCount.KERNEL32 ref: 71004F46
                  • QueryPerformanceCounter.KERNEL32 ref: 71004F53
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270895464.0000000071001000.00000020.00000001.01000000.00000029.sdmp, Offset: 71000000, based on PE: true
                  • Associated: 00000016.00000002.2270880501.0000000071000000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270911307.0000000071007000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270926559.000000007100B000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270940910.000000007100C000.00000004.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270955038.000000007100F000.00000008.00000001.01000000.00000029.sdmpDownload File
                  Similarity
                  • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
                  • String ID:
                  • API String ID: 1445889803-0
                  • Opcode ID: f8c823323a9f74887256d00e04fa281bdf92320556c644276058c18297439740
                  • Instruction ID: e885b3834b143e894ff446b8c8b1327ec382e4081826ee8eeb96402719f79869
                  • Opcode Fuzzy Hash: f8c823323a9f74887256d00e04fa281bdf92320556c644276058c18297439740
                  • Instruction Fuzzy Hash: 8011A535B69A1046F7208B64FA04355B3B1F70C7A0F005235DE8D43BE4EBBCE5858340
                  Function 6AEE67B0 Relevance: 7.5, APIs: 5, Instructions: 47timethreadCOMMON
                  Download Yara Rule
                  APIs
                  • GetSystemTimeAsFileTime.KERNEL32 ref: 6AEE67EA
                  • GetCurrentProcessId.KERNEL32 ref: 6AEE67F5
                  • GetCurrentThreadId.KERNEL32 ref: 6AEE67FE
                  • GetTickCount.KERNEL32 ref: 6AEE6806
                  • QueryPerformanceCounter.KERNEL32 ref: 6AEE6813
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
                  • String ID:
                  • API String ID: 1445889803-0
                  • Opcode ID: 09eba522517958a6702270a5b066acbe916ddcbffd9db6f3826815e33d2ac352
                  • Instruction ID: 48e1adcf4f0505729518aa91d86be4e12ce4ee4a50ddb14a172b8a66f79027fe
                  • Opcode Fuzzy Hash: 09eba522517958a6702270a5b066acbe916ddcbffd9db6f3826815e33d2ac352
                  • Instruction Fuzzy Hash: BA11A136755B5482FB60ABA1FC143097361B70A7E4F001230DD9C63BA4EB3ECA998B01
                  Function 62E92500 Relevance: 7.5, APIs: 5, Instructions: 47timethreadCOMMON
                  Download Yara Rule
                  APIs
                  • GetSystemTimeAsFileTime.KERNEL32 ref: 62E9253A
                  • GetCurrentProcessId.KERNEL32 ref: 62E92545
                  • GetCurrentThreadId.KERNEL32 ref: 62E9254E
                  • GetTickCount.KERNEL32 ref: 62E92556
                  • QueryPerformanceCounter.KERNEL32 ref: 62E92563
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270152250.0000000062E81000.00000020.00000001.01000000.0000001D.sdmp, Offset: 62E80000, based on PE: true
                  • Associated: 00000016.00000002.2270136370.0000000062E80000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270171204.0000000062E95000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270187075.0000000062E9E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270203868.0000000062E9F000.00000004.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270219476.0000000062EA2000.00000008.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270233416.0000000062EA3000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  Similarity
                  • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
                  • String ID:
                  • API String ID: 1445889803-0
                  • Opcode ID: 8a3aa39af34bd83d498457eb518cf7d702a0c5c3c1e17ffd097b0c30963d610f
                  • Instruction ID: 12fdd94fb870d1c5170227d2c197b2d3127d8602a99b24bc8e823bb6fb0cf98a
                  • Opcode Fuzzy Hash: 8a3aa39af34bd83d498457eb518cf7d702a0c5c3c1e17ffd097b0c30963d610f
                  • Instruction Fuzzy Hash: D411612AB56F0582EB208B65F914315B3A1B7497E4F005632DD9C43BA4EB3EC5A68740
                  Function 6A898210 Relevance: 7.5, APIs: 5, Instructions: 47timethreadCOMMON
                  Download Yara Rule
                  APIs
                  • GetSystemTimeAsFileTime.KERNEL32 ref: 6A89824A
                  • GetCurrentProcessId.KERNEL32 ref: 6A898255
                  • GetCurrentThreadId.KERNEL32 ref: 6A89825E
                  • GetTickCount.KERNEL32 ref: 6A898266
                  • QueryPerformanceCounter.KERNEL32 ref: 6A898273
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
                  • String ID:
                  • API String ID: 1445889803-0
                  • Opcode ID: 9ba7bc9d5efdff23214e18699b10a8d5f36952b68fdd70b697bbebf1538dcaf3
                  • Instruction ID: ed780af50786c7c838dcc2c1c728a6501de3a1625c6e9a2a9fa07ccb0ecc8916
                  • Opcode Fuzzy Hash: 9ba7bc9d5efdff23214e18699b10a8d5f36952b68fdd70b697bbebf1538dcaf3
                  • Instruction Fuzzy Hash: BE11A126B49F0589E720AB65FC04316B361B74ABA0F001631DE9D53BB4EF3DC4A6CB00
                  Function 68B631F0 Relevance: 7.5, APIs: 5, Instructions: 47timethreadCOMMON
                  Download Yara Rule
                  APIs
                  • GetSystemTimeAsFileTime.KERNEL32 ref: 68B6322A
                  • GetCurrentProcessId.KERNEL32 ref: 68B63235
                  • GetCurrentThreadId.KERNEL32 ref: 68B6323E
                  • GetTickCount.KERNEL32 ref: 68B63246
                  • QueryPerformanceCounter.KERNEL32 ref: 68B63253
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
                  • String ID:
                  • API String ID: 1445889803-0
                  • Opcode ID: a3fcf9b90f246c367884131b8f89611c637b44de11fc88f356f7035588f22eaa
                  • Instruction ID: 280997841fa55dcd48dae1d201d486c465913e0b53f574dc4cb1cb030e017363
                  • Opcode Fuzzy Hash: a3fcf9b90f246c367884131b8f89611c637b44de11fc88f356f7035588f22eaa
                  • Instruction Fuzzy Hash: 46113926799B0482EB108B65B914319B361B78CBB0F40A730ED9D47BA4EF3DC59AC704
                  Function 6A894D0A Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 161COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: ColorCreateErrorL_freeL_mallocSurface
                  • String ID: $Unsupported TGA format
                  • API String ID: 397438371-1473474455
                  • Opcode ID: 8e940bd7e2ff65a171c44a5798ada230c7ed6f76a91957fdec0b38c880765d55
                  • Instruction ID: 2ca73c8b11b5a1807cf6133a78c565400bb0c7386afe4427009879706cb7b295
                  • Opcode Fuzzy Hash: 8e940bd7e2ff65a171c44a5798ada230c7ed6f76a91957fdec0b38c880765d55
                  • Instruction Fuzzy Hash: 626179B220C7C48AE720CB2EE44475BBBA1F7C5B98F044519DAD987B99DB7EC145CB00
                  Function 67884520 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 156COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • Unsupported audio channels, xrefs: 678845AC
                  • Unsupported audio format, xrefs: 67884790
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: Unsupported audio channels$Unsupported audio format
                  • API String ID: 2619118453-2523043535
                  • Opcode ID: 35230a948a6ff69b0dd1359ec1e7a57451ceae530f83895ad7a4fc04d407d9ea
                  • Instruction ID: 19f1d2c88b36393ec7fa99a8c325f9ce845e91e30aa1692002f57c7e8a8a7f21
                  • Opcode Fuzzy Hash: 35230a948a6ff69b0dd1359ec1e7a57451ceae530f83895ad7a4fc04d407d9ea
                  • Instruction Fuzzy Hash: F451C433A846495CF601DF54EAA435C225FF3FA318FE08B22D81E82974EB7ADD54C652
                  Function 6788D3D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86COMMON
                  Download Yara Rule
                  APIs
                  • SDL_AudioStreamGet.SDL2 ref: 6788D3E1
                  • SDL_AudioStreamPut.SDL2 ref: 6788D495
                    • Part of subcall function 6788D040: SDL_free.SDL2 ref: 6788D089
                    • Part of subcall function 6788D040: SDL_FreeAudioStream.SDL2 ref: 6788D09F
                    • Part of subcall function 6788D040: SDL_NewAudioStream.SDL2 ref: 6788D0D5
                    • Part of subcall function 6788D040: SDL_malloc.SDL2 ref: 6788D0F3
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: AudioStream$FreeL_freeL_malloc
                  • String ID: op_read
                  • API String ID: 3247158500-3907004626
                  • Opcode ID: 601a519c63b347aa13d2c3f94a2e0324144b152ca1e779d29205d805e1dd7dab
                  • Instruction ID: 920aaee19fac745a6aa45b2440e39bfa74f28e13c658b49c68034937db3fa574
                  • Opcode Fuzzy Hash: 601a519c63b347aa13d2c3f94a2e0324144b152ca1e779d29205d805e1dd7dab
                  • Instruction Fuzzy Hash: E92184737146418BE7208F7AF48065A73A0E76C7A8B544722DF6A87B94DB38E8458B10
                  Function 6A88B010 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: L_mallocL_strchr
                  • String ID: {$}
                  • API String ID: 3622037958-2025435780
                  • Opcode ID: 26fef2f964d5110dc6ea26c586d7b876b2a96b627ab5ee713a3573a4eff5c493
                  • Instruction ID: c51c6f57c88fc902259b24ffc406cb5a396f648ea0e970cd2a06c8807383c79b
                  • Opcode Fuzzy Hash: 26fef2f964d5110dc6ea26c586d7b876b2a96b627ab5ee713a3573a4eff5c493
                  • Instruction Fuzzy Hash: 2F21DBA2F4D69444F7204A369A5C79E66A57785FECF098C16CDB80BB97EE2D8185C300
                  Function 67884940 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: L_malloc
                  • String ID: Out of memory
                  • API String ID: 3629575833-696950042
                  • Opcode ID: d5a550c8e5f6dbbab8f7c40d25c54d5ebd9af62ca8ee5a6b3bc7150a5e59c592
                  • Instruction ID: 2cf23ef5cfead902ecedb0e5d0510edac5180c25b53e5c1c3f9523c3eb9595f5
                  • Opcode Fuzzy Hash: d5a550c8e5f6dbbab8f7c40d25c54d5ebd9af62ca8ee5a6b3bc7150a5e59c592
                  • Instruction Fuzzy Hash: 27217673706B0484EF558F4DF8947642369ABFCB98F4109299B5D1B320EF399DA5C710
                  Function 6A891363 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 70COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: L_strchr
                  • String ID: 0123456789+-.eE$l
                  • API String ID: 3621864484-3575014764
                  • Opcode ID: 5f9af25d9157c0ec9ba25ef6dc83d0a922cec51e1ba296205060a8eafbddf215
                  • Instruction ID: ecdce0abbd8f2097d89b5d97340383b0ec63d4e30b0abc7cf84fb871e3b3d3ba
                  • Opcode Fuzzy Hash: 5f9af25d9157c0ec9ba25ef6dc83d0a922cec51e1ba296205060a8eafbddf215
                  • Instruction Fuzzy Hash: 78214821B0C7C808FB22C63E444A3FA5E615FAB7C9F494F26CD9956AB7CF29D0608610
                  Function 67885A60 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • Unsupported audio format, xrefs: 67885A99
                  • Trying to reverse stereo on a non-stereo stream, xrefs: 67885AF0
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: Trying to reverse stereo on a non-stereo stream$Unsupported audio format
                  • API String ID: 2619118453-498337454
                  • Opcode ID: 219c4e90bb61088668908e48949ad6ececa74b07e5eedc56c0e5665423881f2a
                  • Instruction ID: d6a9f9911034f52492fc72fb73bd3d3d131d193a8906fa6d71d0219787e3ccfa
                  • Opcode Fuzzy Hash: 219c4e90bb61088668908e48949ad6ececa74b07e5eedc56c0e5665423881f2a
                  • Instruction Fuzzy Hash: 9301D673B5D21445CB616B2CFCC03D92351A3B8328FC54525DD4F4A5A5DA34CED6CA02
                  Function 68B4E4B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • png_image_begin_read_from_file: invalid argument, xrefs: 68B4E550
                  • png_image_begin_read_from_file: incorrect PNG_IMAGE_VERSION, xrefs: 68B4E4C5
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: fclose
                  • String ID: png_image_begin_read_from_file: incorrect PNG_IMAGE_VERSION$png_image_begin_read_from_file: invalid argument
                  • API String ID: 3125558077-2564769089
                  • Opcode ID: 357ec44719c5c978ca5c56d65dc4d4d2b1e553e6da0790cb3c75dd08014cc405
                  • Instruction ID: b29b023341ffcaf113b767d629e2cd2ce660fb88d6bcaf8c32e796a8f35d4599
                  • Opcode Fuzzy Hash: 357ec44719c5c978ca5c56d65dc4d4d2b1e553e6da0790cb3c75dd08014cc405
                  • Instruction Fuzzy Hash: 40019BA138669481EE09DB1AE85236D2251EB49BE4FC49930CE1D4B718FF29D5D7D300
                  Function 69A31C45 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39libraryloaderCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270515173.0000000069A01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 69A00000, based on PE: true
                  • Associated: 00000016.00000002.2270499163.0000000069A00000.00000002.00000001.01000000.0000001E.sdmpDownload File
                  • Associated: 00000016.00000002.2270543058.0000000069A33000.00000002.00000001.01000000.0000001E.sdmpDownload File
                  • Associated: 00000016.00000002.2270561128.0000000069A3E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                  • Associated: 00000016.00000002.2270576553.0000000069A40000.00000004.00000001.01000000.0000001E.sdmpDownload File
                  • Associated: 00000016.00000002.2270591630.0000000069A43000.00000002.00000001.01000000.0000001E.sdmpDownload File
                  Similarity
                  • API ID: AddressProc
                  • String ID: ___lc_codepage_func$__lc_codepage
                  • API String ID: 190572456-752505557
                  • Opcode ID: 827cc47cf549dab2dccac46420efcfb8d6b12bc1f260d32e44b473e4c2860c09
                  • Instruction ID: 2d410720cb0511f1487b7a34738df44ad07e3e32a4817575ff117eb2338c3894
                  • Opcode Fuzzy Hash: 827cc47cf549dab2dccac46420efcfb8d6b12bc1f260d32e44b473e4c2860c09
                  • Instruction Fuzzy Hash: 1F016D76643B1095E9069B65BD803A427EEB708790F4956358D0C87710EF39C4B6C391
                  Function 678962E7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • Unknown error, xrefs: 67896304
                  • _matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 67896396
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: __iob_funcfprintf
                  • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
                  • API String ID: 620453056-3474627141
                  • Opcode ID: a2516d74c1e43a6468f0e7dd6345a5a07e3ce1519145aa6f4c0ee3eaed41a65e
                  • Instruction ID: e33c9b6ab7cb85fcc256228e8e403325eb2e89d2e66b8d2fd6b45e9c8522741f
                  • Opcode Fuzzy Hash: a2516d74c1e43a6468f0e7dd6345a5a07e3ce1519145aa6f4c0ee3eaed41a65e
                  • Instruction Fuzzy Hash: D3114C22908F88C6D6118F1CE4413EAB770FFAA759F605616EB8827624EF3AC556CB40
                  Function 68B68427 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • Unknown error, xrefs: 68B68444
                  • _matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 68B684D6
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: __iob_funcfprintf
                  • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
                  • API String ID: 620453056-3474627141
                  • Opcode ID: 25d2a470da6e7cf74ac3093933d6d54b1e4c1306b25606832153b77206f3553e
                  • Instruction ID: f5dce435e90e626b4b39c008b4298c9167dfc973854ed1e41f822a8710fcb780
                  • Opcode Fuzzy Hash: 25d2a470da6e7cf74ac3093933d6d54b1e4c1306b25606832153b77206f3553e
                  • Instruction Fuzzy Hash: C2110D66444E8492D6118F1CE4413AEB771FF9A759FA09706EB8867624EF3AC196C700
                  Function 6788A330 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • Position not implemented for music type, xrefs: 6788A3A0
                  • Music isn't playing, xrefs: 6788A3AE
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: Music isn't playing$Position not implemented for music type
                  • API String ID: 2619118453-3148022138
                  • Opcode ID: 882d0a9b163b2f5cdee3ed31bf598906a21608245b4d12efcbdf5ef2606aeaf2
                  • Instruction ID: f7efeebe928518f15bc242c584426b3e47482dcde939329a7e144a5f20841f99
                  • Opcode Fuzzy Hash: 882d0a9b163b2f5cdee3ed31bf598906a21608245b4d12efcbdf5ef2606aeaf2
                  • Instruction Fuzzy Hash: 34015A21749F8885EB118B2CD8853696361EBB9B98F445A11EE2C433F0DF29CCA68701
                  Function 6789632D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • _matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 67896396
                  • Overflow range error (OVERFLOW), xrefs: 6789632D
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: __iob_funcfprintf
                  • String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
                  • API String ID: 620453056-4064033741
                  • Opcode ID: a9ba6567978fcfaddee002b20ad84f02a1583db808122c8f01a49e0dc82286f9
                  • Instruction ID: 098b095b30722c65fa645766d392be86c563c3a4bff6c756c18369d35b9ffb41
                  • Opcode Fuzzy Hash: a9ba6567978fcfaddee002b20ad84f02a1583db808122c8f01a49e0dc82286f9
                  • Instruction Fuzzy Hash: 23F0F626508F88C2C211CF1CA4002AAB774FBAE789F605702EBC827924DF39C556DB40
                  Function 67896324 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • Argument singularity (SIGN), xrefs: 67896324
                  • _matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 67896396
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: __iob_funcfprintf
                  • String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
                  • API String ID: 620453056-2468659920
                  • Opcode ID: ba93968ec2c37df87724678201b7c5c2caf2d11b71fb85adb37a9dc9cc34e95d
                  • Instruction ID: 843f00960313cf381608a8b335530ee0bee8dcea9bc555e9edd7c9366288a820
                  • Opcode Fuzzy Hash: ba93968ec2c37df87724678201b7c5c2caf2d11b71fb85adb37a9dc9cc34e95d
                  • Instruction Fuzzy Hash: F2F01926408F88C2C211CF1CE4002AEB770FBAE789F605712EBC827928EF39C556DB40
                  Function 6789633F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • _matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 67896396
                  • Total loss of significance (TLOSS), xrefs: 6789633F
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: __iob_funcfprintf
                  • String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
                  • API String ID: 620453056-4273532761
                  • Opcode ID: a3e723435dbb4941385ae8af2f3714fdc268e836e2a583608a1c477311b23758
                  • Instruction ID: 2f0d0635fd2c98af99edb09a6e87894e9aa5b5e33d1bb6e60d4d1d3f55e6b083
                  • Opcode Fuzzy Hash: a3e723435dbb4941385ae8af2f3714fdc268e836e2a583608a1c477311b23758
                  • Instruction Fuzzy Hash: 7FF0F626408F88C2C211CF1CA4002AAB770FBAE789F605702EBC827924DF39C556DB40
                  Function 67896336 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • Partial loss of significance (PLOSS), xrefs: 67896336
                  • _matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 67896396
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: __iob_funcfprintf
                  • String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
                  • API String ID: 620453056-4283191376
                  • Opcode ID: f09297feafd06c8d46ba5572e4d866c520ecda172507176dd544e23870496537
                  • Instruction ID: ea2e578b24faf6f7114b8c196c3912e927b941fe4d83f75d3979a45eb19e82da
                  • Opcode Fuzzy Hash: f09297feafd06c8d46ba5572e4d866c520ecda172507176dd544e23870496537
                  • Instruction Fuzzy Hash: A5F0F626408F88C2C211CF1CA4002ABB770FBAE789F605706EBC82B924DF39C556DB40
                  Function 67896348 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • _matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 67896396
                  • The result is too small to be represented (UNDERFLOW), xrefs: 67896348
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: __iob_funcfprintf
                  • String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
                  • API String ID: 620453056-2187435201
                  • Opcode ID: e370a80e0cbbc3c42564e29ef96f30e74c924f671de3be400e4782be29109723
                  • Instruction ID: 2e1e3c59cbae46b51695abc552143c952beef61974e27c9448a7ce9f157f2a4c
                  • Opcode Fuzzy Hash: e370a80e0cbbc3c42564e29ef96f30e74c924f671de3be400e4782be29109723
                  • Instruction Fuzzy Hash: 74F01926408F88C2C211CF1CE4002AEB770FBAE789F605702EBC827924DF39C556DB40
                  Function 68B68488 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • The result is too small to be represented (UNDERFLOW), xrefs: 68B68488
                  • _matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 68B684D6
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: __iob_funcfprintf
                  • String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
                  • API String ID: 620453056-2187435201
                  • Opcode ID: ab20f2bdb481af2faedf8ef74ed859756ae98079021a9e41750d98a543a71183
                  • Instruction ID: ab228739794164f8e4c27ac0fe8ded5a4d964aa8767fe42a898af70dc2a04f6e
                  • Opcode Fuzzy Hash: ab20f2bdb481af2faedf8ef74ed859756ae98079021a9e41750d98a543a71183
                  • Instruction Fuzzy Hash: A8F0C966444F8882C611CF1CE4402AEB371FB9F799FA09706EBC82A524DF39C596CB40
                  Function 68B68476 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • Partial loss of significance (PLOSS), xrefs: 68B68476
                  • _matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 68B684D6
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: __iob_funcfprintf
                  • String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
                  • API String ID: 620453056-4283191376
                  • Opcode ID: fd5424582e5476410c6192260c23fe4413942e4ee0b6872e9f069ec595c0fe17
                  • Instruction ID: fd216f871e75242befe3b106bd07cd0854545b49887b37db0abff180a9ab22bc
                  • Opcode Fuzzy Hash: fd5424582e5476410c6192260c23fe4413942e4ee0b6872e9f069ec595c0fe17
                  • Instruction Fuzzy Hash: 22F0C966444F8882C611CF5CE4402AFB771FB9F799FA09706EBC82A624DF39C596CB40
                  Function 68B6847F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • Total loss of significance (TLOSS), xrefs: 68B6847F
                  • _matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 68B684D6
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: __iob_funcfprintf
                  • String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
                  • API String ID: 620453056-4273532761
                  • Opcode ID: c4861f8213a153aa488869b7bd8d0878a98ba1324deb7aa0bf0305184013ffc3
                  • Instruction ID: 3cdec0e0f5be6e644b52e57ad7f9243f4d09e28dc87b99c65785efe93c0d3aa8
                  • Opcode Fuzzy Hash: c4861f8213a153aa488869b7bd8d0878a98ba1324deb7aa0bf0305184013ffc3
                  • Instruction Fuzzy Hash: 1EF0B666444F8882C6118F18E4402AEB371FF9B799FA09706EBC82A524DF39C5968B40
                  Function 68B68464 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • _matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 68B684D6
                  • Argument singularity (SIGN), xrefs: 68B68464
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: __iob_funcfprintf
                  • String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
                  • API String ID: 620453056-2468659920
                  • Opcode ID: fa2a0ec3556b48b19046120f549cf11b9cc9f70e19892f26e84d7f086f866e1b
                  • Instruction ID: 1b1afe4627ed1f445ab8304f5e0cecab6bf59ed0ac9e3483fc277b992179556c
                  • Opcode Fuzzy Hash: fa2a0ec3556b48b19046120f549cf11b9cc9f70e19892f26e84d7f086f866e1b
                  • Instruction Fuzzy Hash: 86F0C966444F8882C611CF1CE4402AEB371FB9F799FA49706EBC82A524DF39C596CB40
                  Function 68B6846D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • _matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 68B684D6
                  • Overflow range error (OVERFLOW), xrefs: 68B6846D
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: __iob_funcfprintf
                  • String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
                  • API String ID: 620453056-4064033741
                  • Opcode ID: 02f5e64cf00197f3f36526e4a961d09e598c05ba0772004276fdcc4e37d5f9d3
                  • Instruction ID: f5fd69595dd6918ca50d5b4970d216f28737701c7310f330b9ab3594dfcd47b9
                  • Opcode Fuzzy Hash: 02f5e64cf00197f3f36526e4a961d09e598c05ba0772004276fdcc4e37d5f9d3
                  • Instruction Fuzzy Hash: 40F0C966444F8882C611CF5CE4402AFB771FB9F799FA09706EBC82A524DF39C596CB40
                  Function 67896351 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • Argument domain error (DOMAIN), xrefs: 67896351
                  • _matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 67896396
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: __iob_funcfprintf
                  • String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
                  • API String ID: 620453056-2713391170
                  • Opcode ID: fedaad7704f0577014167e8a89761ab58e5074bc1b9f3b0540275088c3cd7b01
                  • Instruction ID: cadf1c99da8ec5cd5f3b2e53394da0fbe608f91e0bdc35e954fe900afad5d73f
                  • Opcode Fuzzy Hash: fedaad7704f0577014167e8a89761ab58e5074bc1b9f3b0540275088c3cd7b01
                  • Instruction Fuzzy Hash: A3F0C966404F88C6C211CF5CE4402AEB771FBAE789F605706EBC82B924DF39C556CB40
                  Function 6788A8F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • Insufficient memory to set SoundFonts, xrefs: 6788A940
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: L_freeL_strdup
                  • String ID: Insufficient memory to set SoundFonts
                  • API String ID: 1928877218-3168415467
                  • Opcode ID: c5c0dcc768109b176a23065475d8ee8276e6ec6bee4ccbb39ced0fbd622fbfd6
                  • Instruction ID: 77b263b0b71891b68749b594901c1ff4cb53912deaac682cd6a6c02838bdcd3b
                  • Opcode Fuzzy Hash: c5c0dcc768109b176a23065475d8ee8276e6ec6bee4ccbb39ced0fbd622fbfd6
                  • Instruction Fuzzy Hash: ECE01A7129E70688FE498B6DAC1837412595BBC709F5918345B7E4B3D0FF2D8CA08B92
                  Function 68B68491 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • Argument domain error (DOMAIN), xrefs: 68B68491
                  • _matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 68B684D6
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: __iob_funcfprintf
                  • String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
                  • API String ID: 620453056-2713391170
                  • Opcode ID: e4537c17f4564852d0f389495b42c27ae985910549233a23678561c1335dfd6b
                  • Instruction ID: c118dc6530fcdc108198a41e5f60858e882d8945ea82fee7e7cc9f2b0f655789
                  • Opcode Fuzzy Hash: e4537c17f4564852d0f389495b42c27ae985910549233a23678561c1335dfd6b
                  • Instruction Fuzzy Hash: 07F0EC66404F8882C611CF18E4403AFB771FB9E799F609306EBC82B524EF39C156CB00
                  Function 6AEE2200 Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 445COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID: memset
                  • String ID: $0$@
                  • API String ID: 2221118986-2347541974
                  • Opcode ID: 8475a85a1f58ff19ef4a28feff64ab5cfa8cbfd8cb5e71ab0be8a991297aa425
                  • Instruction ID: 11810560d2d37fbd528671b166a5078138b58201fc39290516852ce9c26ad4c0
                  • Opcode Fuzzy Hash: 8475a85a1f58ff19ef4a28feff64ab5cfa8cbfd8cb5e71ab0be8a991297aa425
                  • Instruction Fuzzy Hash: 1A327472208BC18AD730CB19F49879AB7A5F389748F658129CAD847B59DF7EC194CB80
                  Function 6AE89820 Relevance: 6.4, APIs: 5, Instructions: 100COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID: memcpy
                  • String ID:
                  • API String ID: 3510742995-0
                  • Opcode ID: 076659068b921494f47966b9f5bbdfdbfdf663e2ffa3db7fef0c8120561e7760
                  • Instruction ID: 7d5b1f4cca2c0ea707d25c252d4c9d173d5fcac3645957021644a3be10386f1e
                  • Opcode Fuzzy Hash: 076659068b921494f47966b9f5bbdfdbfdf663e2ffa3db7fef0c8120561e7760
                  • Instruction Fuzzy Hash: 9F41E2A6A11A4592DB05CF3AE48024D37A8FB08FDCF65612ACF4D57729EF30C5A5C380
                  Function 67893FE0 Relevance: 6.3, APIs: 5, Instructions: 32COMMON
                  Download Yara Rule
                  APIs
                  • free.MSVCRT(?,?,?,6788D4F6), ref: 67894008
                  • free.MSVCRT(?,?,?,6788D4F6), ref: 67894019
                  • free.MSVCRT(?,?,?,6788D4F6), ref: 6789402E
                  • free.MSVCRT(?,?,?,6788D4F6), ref: 6789403A
                  • free.MSVCRT(?,?,?,6788D4F6), ref: 67894046
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: free
                  • String ID:
                  • API String ID: 1294909896-0
                  • Opcode ID: ba7a74ffb207099017ac0001e7998548f1963d0bebd629f85c7303bb23c1e2d3
                  • Instruction ID: 87c748b3ea80b69c97f81426e3fca667e24399e883dc9d93c2a42314deebe570
                  • Opcode Fuzzy Hash: ba7a74ffb207099017ac0001e7998548f1963d0bebd629f85c7303bb23c1e2d3
                  • Instruction Fuzzy Hash: 29F03A22B02549E2EE599B6ED9502AE5320FFECBD9F044931DF6E07616EF20D86187C1
                  Function 68B59670 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 272COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: memset
                  • String ID: @$Row has too many bytes to allocate in memory$TADI
                  • API String ID: 2221118986-155842077
                  • Opcode ID: 39865e5d3d7d1e831ec31a996459f46f6c04586cb561bbdd9b1194a87443ee48
                  • Instruction ID: e15f49d2e08090df52563cfd8accae93bc91802b3d1efe2cd3302d60c40af99b
                  • Opcode Fuzzy Hash: 39865e5d3d7d1e831ec31a996459f46f6c04586cb561bbdd9b1194a87443ee48
                  • Instruction Fuzzy Hash: 4AA125F27156C481DB558F24E4543D936A2E386B88F88C236CF694B7DDEF398092C362
                  Function 6AEBE8E0 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 239stringCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID: strlenstrncmp
                  • String ID: FDB
                  • API String ID: 1310274236-4188417005
                  • Opcode ID: d2cfb41ada14656208f9cd3d91013c7e890d476195f14a4671f216be1012fa05
                  • Instruction ID: d96859175f9ae5e99b5593b7358a380ff675b10d81bfe3288e5aacd1306017cf
                  • Opcode Fuzzy Hash: d2cfb41ada14656208f9cd3d91013c7e890d476195f14a4671f216be1012fa05
                  • Instruction Fuzzy Hash: D2914772204AD049E755CF29D51C7AE7BE4F78678CF2585A5DB9A8B304EF39C246C700
                  Function 6A88C2D0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: L_fabs
                  • String ID:
                  • API String ID: 3129217989-0
                  • Opcode ID: 60409f04b335a0b46e3eb24c05c1b7e970ed2baa53736af22c90b016d3c3afe8
                  • Instruction ID: 07399d362cb037f42bc18f493a71140ea7a14c753a998fbd1d7ff57dd609e755
                  • Opcode Fuzzy Hash: 60409f04b335a0b46e3eb24c05c1b7e970ed2baa53736af22c90b016d3c3afe8
                  • Instruction Fuzzy Hash: AFA1C6A3D14FCC8DD223AB3A9453366E768BF672C4F05D713A94636927EF15A0938601
                  Function 6AECDB20 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 210COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID: memset
                  • String ID: gfff$gfff$4j
                  • API String ID: 2221118986-2796758874
                  • Opcode ID: 4f6dd5c432646b4a6f271362c94d2a6a104b1aa15cec820bdd0d58715d312af7
                  • Instruction ID: 0226ecf4bf7ec4cc48fd6d78ceb2f63341c79dac9673d295cb7f5f185c54c5b6
                  • Opcode Fuzzy Hash: 4f6dd5c432646b4a6f271362c94d2a6a104b1aa15cec820bdd0d58715d312af7
                  • Instruction Fuzzy Hash: BD7136767446808AD754CF26D984B9A7BA5F784BC8F198129EF1E87B18EF3AC441CB01
                  Function 6AECE510 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 210COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID: memset
                  • String ID: gfff$gfff$4j
                  • API String ID: 2221118986-2796758874
                  • Opcode ID: 04e3f5b189d6beded9643905f3bb816963becc624947130f284612481aa86f73
                  • Instruction ID: 508306501a46999a7c883d9a71d3540fdc91227de3b86548d001df0874dd9489
                  • Opcode Fuzzy Hash: 04e3f5b189d6beded9643905f3bb816963becc624947130f284612481aa86f73
                  • Instruction Fuzzy Hash: 19712273304A908AD758CF26DA4879A7BA5F785F8CF198129DE1E87B58EF39C441CB01
                  Function 6A88ACE0 Relevance: 6.2, APIs: 4, Instructions: 198COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: L_strchr
                  • String ID:
                  • API String ID: 3621864484-0
                  • Opcode ID: fb0cb48309d5c0137e064fe069db30011955b5e91b9a18d8172c7fc6f7b95a43
                  • Instruction ID: ec00ff874bcc8374c2c8d6253e886dec74e43441ba1b4633f77076080acca9d9
                  • Opcode Fuzzy Hash: fb0cb48309d5c0137e064fe069db30011955b5e91b9a18d8172c7fc6f7b95a43
                  • Instruction Fuzzy Hash: 7D6138E220E69459E7619F15E0843AAFB67A786B89F4B8C15DEA4073C9DF3FD109C300
                  Function 6AE89100 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 188stringCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID: strcmp
                  • String ID: ltuo$ltuo$ltuo
                  • API String ID: 1004003707-2015238449
                  • Opcode ID: 3068ba8f0e4f674c01f1ea3e405c0a94f8d3bbdd3d4c10e5f8c43447d1cf8e2c
                  • Instruction ID: a4dae71e18570e64d2379533995d5e3a963becbda6f56af50704ddccd4a80d8c
                  • Opcode Fuzzy Hash: 3068ba8f0e4f674c01f1ea3e405c0a94f8d3bbdd3d4c10e5f8c43447d1cf8e2c
                  • Instruction Fuzzy Hash: 44619AB2B08A44CADB64CF6AF54470E77A4FB89BC8B2A812ADE5D47754DF38D442C740
                  Function 6A88C740 Relevance: 6.1, APIs: 4, Instructions: 117COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: L_malloc$L_freeL_memset
                  • String ID:
                  • API String ID: 95709884-0
                  • Opcode ID: 9bb75cd69b4649d5df06180bf7fda220f23af80ea6665efc9e65fc7f4a54812b
                  • Instruction ID: 661813bacd23b2603cadcc31f3f926696c97bab45c731a669037f4196de4bd07
                  • Opcode Fuzzy Hash: 9bb75cd69b4649d5df06180bf7fda220f23af80ea6665efc9e65fc7f4a54812b
                  • Instruction Fuzzy Hash: 5541D1B3A09B489AC755CF3BD444048B7A0F749B48708CB21DF492726AEF39F5A5CB50
                  Function 62E884E0 Relevance: 6.1, APIs: 4, Instructions: 111COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270152250.0000000062E81000.00000020.00000001.01000000.0000001D.sdmp, Offset: 62E80000, based on PE: true
                  • Associated: 00000016.00000002.2270136370.0000000062E80000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270171204.0000000062E95000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270187075.0000000062E9E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270203868.0000000062E9F000.00000004.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270219476.0000000062EA2000.00000008.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270233416.0000000062EA3000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  Similarity
                  • API ID: memcpy
                  • String ID:
                  • API String ID: 3510742995-0
                  • Opcode ID: a337c00ac799266e22fe686dab2b4152c3710cdccdf83cfbccf123c34a2a4068
                  • Instruction ID: fb929c2d6d7345470e3b66cd6c738da383a571e57ac5f61e83507c9824db6ae7
                  • Opcode Fuzzy Hash: a337c00ac799266e22fe686dab2b4152c3710cdccdf83cfbccf123c34a2a4068
                  • Instruction Fuzzy Hash: 5131F0327412588BD710DF3A982471A3392B745FECF64D2349E9C8B788EB79C841C780
                  Function 6A88F890 Relevance: 6.1, APIs: 4, Instructions: 105COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: L_strchr$L_memcpy
                  • String ID:
                  • API String ID: 706615553-0
                  • Opcode ID: 320728481b80009f0d635c850436278b6bde39ea47911473fbcda625518d489b
                  • Instruction ID: 1e36bfd44f0e09e2040278ed272ee5f3e2aec98667863ca515c316691cf32367
                  • Opcode Fuzzy Hash: 320728481b80009f0d635c850436278b6bde39ea47911473fbcda625518d489b
                  • Instruction Fuzzy Hash: DC310692B0C1D474E7205A29ED443A96622BF66BC8F894C36CE6917B0ADF6CCE46C301
                  Function 68B5B4E0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 96COMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 68B47CA0: memset.MSVCRT ref: 68B47D1E
                  • memcpy.MSVCRT ref: 68B5B5F3
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: memcpymemset
                  • String ID: $too many unknown chunks$unknown chunk: out of memory
                  • API String ID: 1297977491-3591672001
                  • Opcode ID: 0fbf749477f7be2c5caaac9d4ffdab8d3d890d2ea6422d4f86a4dcf85c6ea64f
                  • Instruction ID: da16477f390e320aecd43f6934fad4e722e27b7f37164d5f753b075f1c6b6a40
                  • Opcode Fuzzy Hash: 0fbf749477f7be2c5caaac9d4ffdab8d3d890d2ea6422d4f86a4dcf85c6ea64f
                  • Instruction Fuzzy Hash: B531C7B77117C486EB1ACF26F5507AAB660F715BD8F888415CF680B304EB39D1A1C341
                  Function 62E875D0 Relevance: 6.1, APIs: 4, Instructions: 84COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270152250.0000000062E81000.00000020.00000001.01000000.0000001D.sdmp, Offset: 62E80000, based on PE: true
                  • Associated: 00000016.00000002.2270136370.0000000062E80000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270171204.0000000062E95000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270187075.0000000062E9E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270203868.0000000062E9F000.00000004.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270219476.0000000062EA2000.00000008.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270233416.0000000062EA3000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  Similarity
                  • API ID: mallocwcstombs$_wopenfree
                  • String ID:
                  • API String ID: 3371363923-0
                  • Opcode ID: acaedb836dcd87c03c5d300b9f1c62c912b6c3be86caadd35d237abdd47c7eac
                  • Instruction ID: d981803cedc404b084451862e68dad655a5112e4c3027c1ca2c1c08a9e8d3cce
                  • Opcode Fuzzy Hash: acaedb836dcd87c03c5d300b9f1c62c912b6c3be86caadd35d237abdd47c7eac
                  • Instruction Fuzzy Hash: 8621B17A7456008AEB048F38D57036D3791E781BADF248239DA7D4A7D8EB3DC686C740
                  Function 68B67C70 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: ByteCharMultiWide_errno
                  • String ID:
                  • API String ID: 2851234143-0
                  • Opcode ID: af90285456e9544e1648710b168d2e51d20db60fd1b2f3cc9fb967ba3c5e475c
                  • Instruction ID: 627f7e815105c33d08a8f6d2191d6ea7c41dd37d2f917c458ae025380bec88ad
                  • Opcode Fuzzy Hash: af90285456e9544e1648710b168d2e51d20db60fd1b2f3cc9fb967ba3c5e475c
                  • Instruction Fuzzy Hash: E131B6B22187C087E3304F29E41036A7A71F7C5BE4F948315EAA147BA9DFBDC5868B44
                  Function 6AEA7E00 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 79stringCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID: strstr
                  • String ID: /FSType$def
                  • API String ID: 1392478783-2283888011
                  • Opcode ID: b5c65b57b62f4c5321f8b6ec52e7d1c2a8b8e2ccf03055ac03012462588d75e8
                  • Instruction ID: 1f0044b850d7bee471df54cbe94c9a8b0e8766017925c91f7a87c59587a2a3ad
                  • Opcode Fuzzy Hash: b5c65b57b62f4c5321f8b6ec52e7d1c2a8b8e2ccf03055ac03012462588d75e8
                  • Instruction Fuzzy Hash: 4D21AD7270169189EB15CF25D84079973A2AB88B8CF69C035DF498BB0DFF38C682C750
                  Function 6AEA7240 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 72stringCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID: strcmp
                  • String ID: glyph-dict$postscript-cmaps$sfnt
                  • API String ID: 1004003707-3377515705
                  • Opcode ID: 1757c38277439497c816e6cc85a56ad48753ebb538b6e9f33c524167d28d24a7
                  • Instruction ID: d8e325673e439a209ad5dcf7c85b575085c757fd2a6a9fc621db96a8c3a1c20b
                  • Opcode Fuzzy Hash: 1757c38277439497c816e6cc85a56ad48753ebb538b6e9f33c524167d28d24a7
                  • Instruction Fuzzy Hash: 1421C56230264099EF15DF5AD8543993761E748BD8F594439DF0D8FB08EF24C486C310
                  Function 6A8932C0 Relevance: 6.1, APIs: 4, Instructions: 51COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: L_free
                  • String ID:
                  • API String ID: 527510906-0
                  • Opcode ID: dd82e302a5c805ffb6bf47d32f08bf19c134cac49507f01338b5c11571184318
                  • Instruction ID: d76bd83cd69e6ef3970637b393f3e4b42563fecc1c377c92d6cc0ba0376ed577
                  • Opcode Fuzzy Hash: dd82e302a5c805ffb6bf47d32f08bf19c134cac49507f01338b5c11571184318
                  • Instruction Fuzzy Hash: 9801D82274D4A045AE165EBEA55826DAF11E745FD9B0C0935CE9D4AA1DEF04CC83C304
                  Function 6AE88640 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 41stringCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID: memcpystrlen
                  • String ID: /..named$fork/rsr
                  • API String ID: 3412268980-2714166321
                  • Opcode ID: 72ef830587ba0c15ad447af0c78fe2ba9fb46351f6e00cba626ffe932c1ad844
                  • Instruction ID: 4af46cb94ad432365d272f6894549393ed2c8493431c0f8d2f7f677760adc413
                  • Opcode Fuzzy Hash: 72ef830587ba0c15ad447af0c78fe2ba9fb46351f6e00cba626ffe932c1ad844
                  • Instruction Fuzzy Hash: F0F08C73B0079589CF218E66EC5078A6365BB99FC8F198229DE4C9B309EA38C6118380
                  Function 6788A740 Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                  Download Yara Rule
                  APIs
                  • SDL_free.SDL2(?,?,00000000,?,67888BCA), ref: 6788A75A
                  • SDL_strlen.SDL2(?,?,00000000,?,67888BCA), ref: 6788A772
                  • SDL_malloc.SDL2(?,?,00000000,?,67888BCA), ref: 6788A77E
                  • SDL_memcpy.SDL2(?,?,00000000,?,67888BCA), ref: 6788A798
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: L_freeL_mallocL_memcpyL_strlen
                  • String ID:
                  • API String ID: 1042673672-0
                  • Opcode ID: 9fc2437cfc0a93737641d0ac74912a1360f8280e97b52d5115076b5c6df53d42
                  • Instruction ID: bac092fff7f87f43075f764b6782adc615e0401e5afd10bc712b3cde6f3e6761
                  • Opcode Fuzzy Hash: 9fc2437cfc0a93737641d0ac74912a1360f8280e97b52d5115076b5c6df53d42
                  • Instruction Fuzzy Hash: B2F0822174A71444ED09AB2E781C3A902585F7DB98F884D344F1E1B3C0DF2D8EE38B02
                  Function 6AEE6350 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 172stringCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID: qsortstrcmp
                  • String ID: Delta
                  • API String ID: 3066588732-1468191197
                  • Opcode ID: a3666f96cb4e552dec486e87b3ee9963c6369e294a5c47514f57f243a62cb366
                  • Instruction ID: b0b280429ba9d8457ef44708244b06ba739868a83d3abf915244963e4876274f
                  • Opcode Fuzzy Hash: a3666f96cb4e552dec486e87b3ee9963c6369e294a5c47514f57f243a62cb366
                  • Instruction Fuzzy Hash: A561AD72B08B908AD720CF16F84474AB7A1F789B98F604129EF9947B58EF3DC4468B40
                  Function 6789533C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147memoryCOMMON
                  Download Yara Rule
                  APIs
                  • VirtualProtect.KERNEL32(?,?,?,67897544,?,67881236), ref: 6789553F
                  Strings
                  • Unknown pseudo relocation bit size %d., xrefs: 6789542D
                  • Unknown pseudo relocation protocol version %d., xrefs: 6789541C
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: ProtectVirtual
                  • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                  • API String ID: 544645111-395989641
                  • Opcode ID: 6354935c1c0db1b58c4611ac92660fe567dab7cfe6187ba25fa63dc82d1270b4
                  • Instruction ID: aec4bd169f3e2cc1f7edf5cc87593f8be7dfb87d66cee540f861ed664227bda2
                  • Opcode Fuzzy Hash: 6354935c1c0db1b58c4611ac92660fe567dab7cfe6187ba25fa63dc82d1270b4
                  • Instruction Fuzzy Hash: FC51C1B2B48704DAEB108F2DD98079C3762A769B5AF248921DE1D07BD8CB39CDD1CB01
                  Function 710052CC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147memoryCOMMON
                  Download Yara Rule
                  APIs
                  • VirtualProtect.KERNEL32(?,?,?,71006014,?,71001236), ref: 710054CF
                  Strings
                  • Unknown pseudo relocation bit size %d., xrefs: 710053BD
                  • Unknown pseudo relocation protocol version %d., xrefs: 710053AC
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270895464.0000000071001000.00000020.00000001.01000000.00000029.sdmp, Offset: 71000000, based on PE: true
                  • Associated: 00000016.00000002.2270880501.0000000071000000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270911307.0000000071007000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270926559.000000007100B000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270940910.000000007100C000.00000004.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270955038.000000007100F000.00000008.00000001.01000000.00000029.sdmpDownload File
                  Similarity
                  • API ID: ProtectVirtual
                  • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                  • API String ID: 544645111-395989641
                  • Opcode ID: 3f717396d409eb14173891a91030c077aa7e91d8e787bf1b1caebd77a9c212df
                  • Instruction ID: 2176e9c25ebebc939290d21ce7a8de804f22e0340885baf18fef5e39fab86d0d
                  • Opcode Fuzzy Hash: 3f717396d409eb14173891a91030c077aa7e91d8e787bf1b1caebd77a9c212df
                  • Instruction Fuzzy Hash: ED51B932B04600CAFB12CB25D9807DC3BB2A744FAAF058142DE4A0B798DBBCD684C751
                  Function 6AEE6B8C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147memoryCOMMON
                  Download Yara Rule
                  APIs
                  • VirtualProtect.KERNEL32(?,?,?,6AEE8014,?,6AE81236), ref: 6AEE6D8F
                  Strings
                  • Unknown pseudo relocation protocol version %d., xrefs: 6AEE6C6C
                  • Unknown pseudo relocation bit size %d., xrefs: 6AEE6C7D
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID: ProtectVirtual
                  • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                  • API String ID: 544645111-395989641
                  • Opcode ID: 713c6a0143b62c0c12a0ce9424f939849ec094ac708b1b733216eb53599091fc
                  • Instruction ID: 7c799f8bbe8c98e3bac7bd4361526504d7e60100193c122783680276372590d8
                  • Opcode Fuzzy Hash: 713c6a0143b62c0c12a0ce9424f939849ec094ac708b1b733216eb53599091fc
                  • Instruction Fuzzy Hash: 00510232B00A00DAEB10AF65DA507583771F742B98FA58126CF1897799CF3AD591CB02
                  Function 62E928DC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147memoryCOMMON
                  Download Yara Rule
                  APIs
                  • VirtualProtect.KERNEL32(?,?,?,62E94014,?,62E81236), ref: 62E92ADF
                  Strings
                  • Unknown pseudo relocation bit size %d., xrefs: 62E929CD
                  • Unknown pseudo relocation protocol version %d., xrefs: 62E929BC
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270152250.0000000062E81000.00000020.00000001.01000000.0000001D.sdmp, Offset: 62E80000, based on PE: true
                  • Associated: 00000016.00000002.2270136370.0000000062E80000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270171204.0000000062E95000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270187075.0000000062E9E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270203868.0000000062E9F000.00000004.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270219476.0000000062EA2000.00000008.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270233416.0000000062EA3000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  Similarity
                  • API ID: ProtectVirtual
                  • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                  • API String ID: 544645111-395989641
                  • Opcode ID: c3495047c7dfe079f32da02cf2d028827685b64a26c80edbd98098e224428411
                  • Instruction ID: 5cb24638ff72fef4265eb8695a7421e65453c7b3108b1d1ec00a18fc4bdfcacb
                  • Opcode Fuzzy Hash: c3495047c7dfe079f32da02cf2d028827685b64a26c80edbd98098e224428411
                  • Instruction Fuzzy Hash: C7518E76F04A10DAFF208B35DAA07483762A765B98F24C137CD1817B98DB7EC592C715
                  Function 6A8985EC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147memoryCOMMON
                  Download Yara Rule
                  APIs
                  • VirtualProtect.KERNEL32(?,?,?,6A89A0B4,?,6A881236), ref: 6A8987EF
                  Strings
                  • Unknown pseudo relocation protocol version %d., xrefs: 6A8986CC
                  • Unknown pseudo relocation bit size %d., xrefs: 6A8986DD
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: ProtectVirtual
                  • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                  • API String ID: 544645111-395989641
                  • Opcode ID: 35c29a2d2de497a3b8c790e57487ebc376da39a9c88f5596252c9d16e519fb89
                  • Instruction ID: 389e50b1a7f160af606c68d4ff47f60ccc221c5226a15437b7210475d8c0878d
                  • Opcode Fuzzy Hash: 35c29a2d2de497a3b8c790e57487ebc376da39a9c88f5596252c9d16e519fb89
                  • Instruction Fuzzy Hash: 4C51C172B18605AEEB109B6DDA4475C7BB2F742BA8F048906CE181BB98CF39C191CB15
                  Function 68B635CC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147memoryCOMMON
                  Download Yara Rule
                  APIs
                  • VirtualProtect.KERNEL32(?,?,?,68B69014,?,68B41236), ref: 68B637CF
                  Strings
                  • Unknown pseudo relocation protocol version %d., xrefs: 68B636AC
                  • Unknown pseudo relocation bit size %d., xrefs: 68B636BD
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: ProtectVirtual
                  • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                  • API String ID: 544645111-395989641
                  • Opcode ID: 52541f448f8e70d59169335badf693dbec858a414cd41d7d14ddb2c852117ed6
                  • Instruction ID: c6c8e74ec0643f1ceb71e9ded4aa5845c3614982c5c0d5740c84a2d079cfbce9
                  • Opcode Fuzzy Hash: 52541f448f8e70d59169335badf693dbec858a414cd41d7d14ddb2c852117ed6
                  • Instruction Fuzzy Hash: 42510FB6B04680C5EB108F25DA84BAC7B62F749BB8F949616CE28077D8DB39D5D1C700
                  Function 6A884190 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 126COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: ErrorFreeSurface
                  • String ID: Passed NULL dst
                  • API String ID: 1352399069-1945758805
                  • Opcode ID: d3cd88a7b6652d7ce62f69f4dfa93a451297a8071ec8cee8306adaf36a9636a0
                  • Instruction ID: 1a2fe2b21837e7fb3165877d147a0afe81e36031c85b944c8b5113bd1d8ddb17
                  • Opcode Fuzzy Hash: d3cd88a7b6652d7ce62f69f4dfa93a451297a8071ec8cee8306adaf36a9636a0
                  • Instruction Fuzzy Hash: 3C51E976718B848AEB60DB15F84479E33A9FBCAB80F844522DE9A03B54EF3DC140CB00
                  Function 6A8955F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: Surface$CreateFree
                  • String ID: SDL_image
                  • API String ID: 2262801471-2104357735
                  • Opcode ID: 24e9da84d80af77a6f8245d38bd2be4c31bc06e0f6fcdfed14ff086d6cd0d3c5
                  • Instruction ID: b5ae165bdb15042fb38cf5bb92149717de6d8e466d231a6d0ece2638a202d3e8
                  • Opcode Fuzzy Hash: 24e9da84d80af77a6f8245d38bd2be4c31bc06e0f6fcdfed14ff086d6cd0d3c5
                  • Instruction Fuzzy Hash: B241B136304B419AEB159F59F8043AAB765FB86BD9F840121EE8E07B28DF7DC159CB40
                  Function 68B54900 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: Validateinflate
                  • String ID: using zstream$1.2.11
                  • API String ID: 3564174286-1952693148
                  • Opcode ID: 5f342850d467f3e1c5575d8b8a08cfc1f0438b3c3ddac78acbe0b0429c9a9663
                  • Instruction ID: 7cb39288d23e25abba77efc49294eaffb3927c7acbe5faba78ce059e82f68d85
                  • Opcode Fuzzy Hash: 5f342850d467f3e1c5575d8b8a08cfc1f0438b3c3ddac78acbe0b0429c9a9663
                  • Instruction Fuzzy Hash: 0C31BFB27082C08AE752CF35D5053EE33A5E789B98F984134CE988B648DB38C6968741
                  Function 69A2BD00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 79COMMON
                  Download Yara Rule
                  APIs
                  • VirtualQuery.KERNEL32(?,?,?,?,69A37AA8,69A37AB0,69A32014,?,69A00000,?,?,69A2C144), ref: 69A2BDE7
                  Strings
                  • Address %p has no image-section, xrefs: 69A2BD09
                  • VirtualQuery failed for %d bytes at address %p, xrefs: 69A2BF18
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270515173.0000000069A01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 69A00000, based on PE: true
                  • Associated: 00000016.00000002.2270499163.0000000069A00000.00000002.00000001.01000000.0000001E.sdmpDownload File
                  • Associated: 00000016.00000002.2270543058.0000000069A33000.00000002.00000001.01000000.0000001E.sdmpDownload File
                  • Associated: 00000016.00000002.2270561128.0000000069A3E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                  • Associated: 00000016.00000002.2270576553.0000000069A40000.00000004.00000001.01000000.0000001E.sdmpDownload File
                  • Associated: 00000016.00000002.2270591630.0000000069A43000.00000002.00000001.01000000.0000001E.sdmpDownload File
                  Similarity
                  • API ID: QueryVirtual
                  • String ID: VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
                  • API String ID: 1804819252-157664173
                  • Opcode ID: e809df7cbb83854b1756410a5618c71d5b2017f3a54ccd60689240e252629f6b
                  • Instruction ID: b90ecaeb7e353b374b253ca9d5767d8a5f278886cf7e881a35dea2af17e8f20e
                  • Opcode Fuzzy Hash: e809df7cbb83854b1756410a5618c71d5b2017f3a54ccd60689240e252629f6b
                  • Instruction Fuzzy Hash: 9B11D372B11154A6FA018B47FD40FA6A7EAB74AFE8F4C8221EE184B754DA34C8C3C740
                  Function 6A894C00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: Error reading TGA data$Unsupported TGA format
                  • API String ID: 2619118453-2830856749
                  • Opcode ID: 5c2576d294d559586751f0a6045a9b41083fb71f1a6e9c15aab3fb70c0b74dd6
                  • Instruction ID: 6549abdbfeb13141902bea4f106d9af6aba366a1e0a00288b5f80f5e662b6dae
                  • Opcode Fuzzy Hash: 5c2576d294d559586751f0a6045a9b41083fb71f1a6e9c15aab3fb70c0b74dd6
                  • Instruction Fuzzy Hash: AD11B4623096D498EB35871BF810B9BBB21F746789F448511CED907A95CF3DD15AC701
                  Function 678951A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57memoryCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • VirtualProtect failed with code 0x%x, xrefs: 67895201
                  • Mingw-w64 runtime failure:, xrefs: 678951C6
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Virtual$ErrorLastProtectQuery__iob_func
                  • String ID: VirtualProtect failed with code 0x%x$Mingw-w64 runtime failure:
                  • API String ID: 2722011080-2237286610
                  • Opcode ID: 37d782be01c6032ef5832dd449a759f6b25071b88f51308b81c426528031d8bd
                  • Instruction ID: ec876679522f2b0033f63c30b55221116ee53702e4c3ee6384d688bde8165184
                  • Opcode Fuzzy Hash: 37d782be01c6032ef5832dd449a759f6b25071b88f51308b81c426528031d8bd
                  • Instruction Fuzzy Hash: EE11C672315B44D5DA009B5EF88019DBB66E7ADBE4F444436AF8C07B24EF38C895CB40
                  Function 71005130 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57memoryCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • VirtualProtect failed with code 0x%x, xrefs: 71005191
                  • Mingw-w64 runtime failure:, xrefs: 71005156
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270895464.0000000071001000.00000020.00000001.01000000.00000029.sdmp, Offset: 71000000, based on PE: true
                  • Associated: 00000016.00000002.2270880501.0000000071000000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270911307.0000000071007000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270926559.000000007100B000.00000002.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270940910.000000007100C000.00000004.00000001.01000000.00000029.sdmpDownload File
                  • Associated: 00000016.00000002.2270955038.000000007100F000.00000008.00000001.01000000.00000029.sdmpDownload File
                  Similarity
                  • API ID: Virtual$ErrorLastProtectQuery__iob_func
                  • String ID: VirtualProtect failed with code 0x%x$Mingw-w64 runtime failure:
                  • API String ID: 2722011080-2237286610
                  • Opcode ID: 5c98934966cb0312c5185f0a3c680582b5bee6418759ef5a9b5b5314dd1bd286
                  • Instruction ID: 761a66fcdffde40ce1e5c88e26adeca9ab250d9046edaef1db41ab91c973c798
                  • Opcode Fuzzy Hash: 5c98934966cb0312c5185f0a3c680582b5bee6418759ef5a9b5b5314dd1bd286
                  • Instruction Fuzzy Hash: 1611C272709B8485E604DB56F8802DDBB76F799FE0F948026AE8C07754DF38C495C740
                  Function 6AEE69F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57memoryCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • Mingw-w64 runtime failure:, xrefs: 6AEE6A16
                  • VirtualProtect failed with code 0x%x, xrefs: 6AEE6A51
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270757548.000000006AE81000.00000020.00000001.01000000.0000002A.sdmp, Offset: 6AE80000, based on PE: true
                  • Associated: 00000016.00000002.2270742275.000000006AE80000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270795367.000000006AEE9000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270820106.000000006AF10000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270835475.000000006AF12000.00000004.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270850152.000000006AF15000.00000008.00000001.01000000.0000002A.sdmpDownload File
                  • Associated: 00000016.00000002.2270865659.000000006AF16000.00000002.00000001.01000000.0000002A.sdmpDownload File
                  Similarity
                  • API ID: Virtual$ErrorLastProtectQuery__iob_func
                  • String ID: VirtualProtect failed with code 0x%x$Mingw-w64 runtime failure:
                  • API String ID: 2722011080-2237286610
                  • Opcode ID: 173a77478d22648da26a8423de63b6befafb763a36966e3954ac65c3c2256fa9
                  • Instruction ID: 953fbe6f2541637ac61f710cf8653b94318a51cadbad8c2d2fd84e8082fbfa17
                  • Opcode Fuzzy Hash: 173a77478d22648da26a8423de63b6befafb763a36966e3954ac65c3c2256fa9
                  • Instruction Fuzzy Hash: 30112972705B4485D700DB41F89459DBB66F795BE4FA9803AEE8C0B716EF38D095C740
                  Function 62E92740 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57memoryCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • VirtualProtect failed with code 0x%x, xrefs: 62E927A1
                  • Mingw-w64 runtime failure:, xrefs: 62E92766
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270152250.0000000062E81000.00000020.00000001.01000000.0000001D.sdmp, Offset: 62E80000, based on PE: true
                  • Associated: 00000016.00000002.2270136370.0000000062E80000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270171204.0000000062E95000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270187075.0000000062E9E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270203868.0000000062E9F000.00000004.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270219476.0000000062EA2000.00000008.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270233416.0000000062EA3000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  Similarity
                  • API ID: Virtual$ErrorLastProtectQuery__iob_func
                  • String ID: VirtualProtect failed with code 0x%x$Mingw-w64 runtime failure:
                  • API String ID: 2722011080-2237286610
                  • Opcode ID: 01b1cdbaab5e193e9de57201c6b8783b69b4827079ad6b67029d69570931d15b
                  • Instruction ID: 1bd23c85004054c2b101f3de88615ef7effb59088a525bf695aeab99a1ea9c59
                  • Opcode Fuzzy Hash: 01b1cdbaab5e193e9de57201c6b8783b69b4827079ad6b67029d69570931d15b
                  • Instruction Fuzzy Hash: 4811E376B01B4095DB00DB51F8501D9BB62E7A5BE4F64903BAE8C0BB24DE39C895C710
                  Function 6A898450 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57memoryCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • VirtualProtect failed with code 0x%x, xrefs: 6A8984B1
                  • Mingw-w64 runtime failure:, xrefs: 6A898476
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270625183.000000006A881000.00000020.00000001.01000000.0000001C.sdmp, Offset: 6A880000, based on PE: true
                  • Associated: 00000016.00000002.2270608745.000000006A880000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270645510.000000006A89A000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270660801.000000006A89B000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270677570.000000006A8A1000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270692956.000000006A8A2000.00000004.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270708151.000000006A8A5000.00000008.00000001.01000000.0000001C.sdmpDownload File
                  • Associated: 00000016.00000002.2270726802.000000006A8A6000.00000002.00000001.01000000.0000001C.sdmpDownload File
                  Similarity
                  • API ID: Virtual$ErrorLastProtectQuery__iob_func
                  • String ID: VirtualProtect failed with code 0x%x$Mingw-w64 runtime failure:
                  • API String ID: 2722011080-2237286610
                  • Opcode ID: f097c4224bcae27adab7321dfb7ed736a0c4c58a71e3fbc5f4e2538cd94c4e4d
                  • Instruction ID: 69d4f753df60fe6b9560e891ff7ef0ba319afb71b9cc478c23e3399f98de114c
                  • Opcode Fuzzy Hash: f097c4224bcae27adab7321dfb7ed736a0c4c58a71e3fbc5f4e2538cd94c4e4d
                  • Instruction Fuzzy Hash: 98110672309B8499D600DB5DF84459EBF65F785BE4F454125EE8D0BF24DE38C495CB40
                  Function 68B63430 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57memoryCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • Mingw-w64 runtime failure:, xrefs: 68B63456
                  • VirtualProtect failed with code 0x%x, xrefs: 68B63491
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: Virtual$ErrorLastProtectQuery__iob_func
                  • String ID: VirtualProtect failed with code 0x%x$Mingw-w64 runtime failure:
                  • API String ID: 2722011080-2237286610
                  • Opcode ID: bc273985ea17e8773afac1df000e8f80af6eee9cd548786a03a8435392ceea85
                  • Instruction ID: 06e97178df19df9b9d14bb5587d8a7320542661610e7ede14ef4ef7bded2a0ae
                  • Opcode Fuzzy Hash: bc273985ea17e8773afac1df000e8f80af6eee9cd548786a03a8435392ceea85
                  • Instruction Fuzzy Hash: D311E976355BC485D600DB55F8801AEBB62EB99BF4F848125EE8C0B714DF38D4D5C740
                  Function 69A2CE30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56libraryCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270515173.0000000069A01000.00000020.00000001.01000000.0000001E.sdmp, Offset: 69A00000, based on PE: true
                  • Associated: 00000016.00000002.2270499163.0000000069A00000.00000002.00000001.01000000.0000001E.sdmpDownload File
                  • Associated: 00000016.00000002.2270543058.0000000069A33000.00000002.00000001.01000000.0000001E.sdmpDownload File
                  • Associated: 00000016.00000002.2270561128.0000000069A3E000.00000002.00000001.01000000.0000001E.sdmpDownload File
                  • Associated: 00000016.00000002.2270576553.0000000069A40000.00000004.00000001.01000000.0000001E.sdmpDownload File
                  • Associated: 00000016.00000002.2270591630.0000000069A43000.00000002.00000001.01000000.0000001E.sdmpDownload File
                  Similarity
                  • API ID: HandleLibraryLoadModule
                  • String ID: msvcrt.dll
                  • API String ID: 4133054770-370904613
                  • Opcode ID: f459d27db8e6efe1c7844a1e835a05d0e9841e6da157e2e4d282edfe53fec619
                  • Instruction ID: bb706e6c41056a32005b21e05093957d5acc07965179b95df6986ad765ae8778
                  • Opcode Fuzzy Hash: f459d27db8e6efe1c7844a1e835a05d0e9841e6da157e2e4d282edfe53fec619
                  • Instruction Fuzzy Hash: 3A11C8315099B044EF0507759C523283BFB6B87B25F4CC29696640E3E1FB3DC6D88741
                  Function 67894150 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON
                  Download Yara Rule
                  APIs
                  • calloc.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6789416F
                  • SDL_SetError.SDL2(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 678941A7
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Errorcalloc
                  • String ID: Out of memory
                  • API String ID: 3197949918-696950042
                  • Opcode ID: aa69fad54045674099c75bacc57d0c2abe99cca85c0344797eb37f1d7225e421
                  • Instruction ID: cd37c929b46c17886f67e2206c033adad8bf8a562ac2bbf8e8afcf5a713830d5
                  • Opcode Fuzzy Hash: aa69fad54045674099c75bacc57d0c2abe99cca85c0344797eb37f1d7225e421
                  • Instruction Fuzzy Hash: 4FF0A71375A28489FB074B5E78156AA5E4197ED7F5F8DC4744F0D07791E4389CC2C360
                  Function 678869F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: ErrorL_free
                  • String ID: Internal error
                  • API String ID: 1023296891-1721229332
                  • Opcode ID: 6107bc1527ff00dea9a4b6f5ca43d521de1806e2edaba447962afa03af7c6824
                  • Instruction ID: f344eed9f6d3dd37517504861a1bd108bd2599bca9c49476cfb4d4eb8d3d552a
                  • Opcode Fuzzy Hash: 6107bc1527ff00dea9a4b6f5ca43d521de1806e2edaba447962afa03af7c6824
                  • Instruction Fuzzy Hash: 0AF0907375665085EE0A4F2A98407A81221AB6CBD4F0CC8349E1D4F345FF25CC828300
                  Function 68B47750 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: atof
                  • String ID: sCAL height$sCAL width
                  • API String ID: 3079814387-3400658034
                  • Opcode ID: 88f90000d976cdb850a61cc3ad84960f1efb6231084ad3f4cb6a073302638ffd
                  • Instruction ID: 0f17d934e8d51df70731ce957a18c021ccee2e412578ae6f7f94a4b12e850667
                  • Opcode Fuzzy Hash: 88f90000d976cdb850a61cc3ad84960f1efb6231084ad3f4cb6a073302638ffd
                  • Instruction Fuzzy Hash: 5601DFBA2056C484CB14CF79A1113ADBBB0FB99794F846122EE5943718EF78C0B28704
                  Function 68B45F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270413053.0000000068B41000.00000020.00000001.01000000.0000001B.sdmp, Offset: 68B40000, based on PE: true
                  • Associated: 00000016.00000002.2270399603.0000000068B40000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270435745.0000000068B6A000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270452865.0000000068B76000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270467424.0000000068B78000.00000004.00000001.01000000.0000001B.sdmpDownload File
                  • Associated: 00000016.00000002.2270484036.0000000068B7B000.00000002.00000001.01000000.0000001B.sdmpDownload File
                  Similarity
                  • API ID: __iob_func
                  • String ID: libpng warning: %s
                  • API String ID: 686374508-1776161082
                  • Opcode ID: cfdcbb8c769cf46d9b36b144de83567128cf16da8c8153cae8927a65eb1e1283
                  • Instruction ID: dfa6fa05fdf201e0eba0ea257d74d65c79c5b98be2a861442303cde86cbb51e4
                  • Opcode Fuzzy Hash: cfdcbb8c769cf46d9b36b144de83567128cf16da8c8153cae8927a65eb1e1283
                  • Instruction Fuzzy Hash: EDD0C261641A9991D912B719FC903CC2721FB48784FC8A112DD0C47244AE21C2A7C304
                  Function 6788C390 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OV_EVERSION
                  • API String ID: 2619118453-288362475
                  • Opcode ID: 0539b0ecad27ab424b0f7f04e94924e49e323b45580c22992a95b71a2c64b11c
                  • Instruction ID: 04c109673013996cd7500bd2da2f714861eaa3c551a16f1c595c51796e52240f
                  • Opcode Fuzzy Hash: 0539b0ecad27ab424b0f7f04e94924e49e323b45580c22992a95b71a2c64b11c
                  • Instruction Fuzzy Hash: 89C08CA174D50A98C800976CC80439862031738328F801312522C020E0BA29CDA98701
                  Function 6788C3B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OV_EBADHEADER
                  • API String ID: 2619118453-1413932590
                  • Opcode ID: 6a8163f0ce77656e32cbdb46074e9bf2330f8217c454b62cc8165a270331bc53
                  • Instruction ID: e7d4f04868eddb1956fcacae398753fe6f0de8a4c7f43802b11e1a6951f1343a
                  • Opcode Fuzzy Hash: 6a8163f0ce77656e32cbdb46074e9bf2330f8217c454b62cc8165a270331bc53
                  • Instruction Fuzzy Hash: CAC08CA174950A94C800976CC8043A4A3021735328F801712422C021E0BA29CD698700
                  Function 6788C3D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OV_ENOTVORBIS
                  • API String ID: 2619118453-785980373
                  • Opcode ID: 9b9bde4579815ec33e384b133dbe15dc58f5ef4eda95631aa44180daa814cb69
                  • Instruction ID: e969be975708f9cfb69145cd989bf121158c71439619256acc60d3e9935ca402
                  • Opcode Fuzzy Hash: 9b9bde4579815ec33e384b133dbe15dc58f5ef4eda95631aa44180daa814cb69
                  • Instruction Fuzzy Hash: 49C08CA174950A94C800A76CC80839462021738328F800353422C020E0BE29CDA98700
                  Function 6788C3F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OV_EINVAL
                  • API String ID: 2619118453-905753436
                  • Opcode ID: 0e8ed533a817e8ea32f4b545ce1e6037ce9f4990ffa269243feecaa5459f9cb2
                  • Instruction ID: 8a8d5b384bf8f0143811ada98ef802e15bffe7ab1cf32ee852853be8a265a26b
                  • Opcode Fuzzy Hash: 0e8ed533a817e8ea32f4b545ce1e6037ce9f4990ffa269243feecaa5459f9cb2
                  • Instruction Fuzzy Hash: B1C08CA174950A98C800976CC814394621217343A8F800323922C420E0BA29CE698700
                  Function 6788C315 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OV_ENOSEEK
                  • API String ID: 2619118453-2425646166
                  • Opcode ID: a6288b07c0c5498fc3f4f41241640384e02545c3e0b531cb7e18e4493ae091c2
                  • Instruction ID: 15d507ed642df053d19a0bf58e91a6b732f7807d6fbd53edcd34c91e4d81cad5
                  • Opcode Fuzzy Hash: a6288b07c0c5498fc3f4f41241640384e02545c3e0b531cb7e18e4493ae091c2
                  • Instruction Fuzzy Hash: DFC08CB174954A98D800976CC80439462021738328F800312422C021E0BA2ACD698700
                  Function 6788C330 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OV_EBADLINK
                  • API String ID: 2619118453-2543523077
                  • Opcode ID: e4401822aba6d6555052197863a6f538bd8a63ddd8f85bd52654a500f109563d
                  • Instruction ID: 01bf707ad94a8f48aba39dc4794a87ef1091f3146fbd32132cea5f7c7f335cce
                  • Opcode Fuzzy Hash: e4401822aba6d6555052197863a6f538bd8a63ddd8f85bd52654a500f109563d
                  • Instruction Fuzzy Hash: 75C08CA174950A94C900976CC80439463021734328F840312422D020E0FA29CDA98700
                  Function 6788C350 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OV_EBADPACKET
                  • API String ID: 2619118453-108391067
                  • Opcode ID: 5bc89c6efd86294a7e68b23d68fcf616c41dcdedcbc1f29fc0540a32209779c4
                  • Instruction ID: eafa2ba01613975139ad9ad734c69f901748c764e9cdc4062a13b4bc82ef6ebc
                  • Opcode Fuzzy Hash: 5bc89c6efd86294a7e68b23d68fcf616c41dcdedcbc1f29fc0540a32209779c4
                  • Instruction Fuzzy Hash: 64C08CA174990A98D800976CC80439462025734328F840312422C020E0BA29CD6A8700
                  Function 6788C370 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OV_ENOTAUDIO
                  • API String ID: 2619118453-2636413789
                  • Opcode ID: c0ce5f34909195e50800270ad7bc6c92afc8c28d59e3e94a56583eb7e793769d
                  • Instruction ID: e5a59d892ae29892738044a71007536e289b051927ae0e20754895c43a9166ce
                  • Opcode Fuzzy Hash: c0ce5f34909195e50800270ad7bc6c92afc8c28d59e3e94a56583eb7e793769d
                  • Instruction Fuzzy Hash: 6AC08CA178950A98C800A76CC80439462022B34328FC01312522C024E0FE2ACD698700
                  Function 6788CE80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OP_EVERSION
                  • API String ID: 2619118453-472809388
                  • Opcode ID: f2ffa931720d7f1b1ccac92c3f34377aad2770351be090fa2f9cff228a86b29a
                  • Instruction ID: 6a94f71353f5f6855e392e6b2eab021b81772b33f2d678b6514706cd9cbbe9e7
                  • Opcode Fuzzy Hash: f2ffa931720d7f1b1ccac92c3f34377aad2770351be090fa2f9cff228a86b29a
                  • Instruction Fuzzy Hash: 82C08CA0A8D50899CC009BAD8C083D8220117A9328FC00352423C020E49A298DA98600
                  Function 6788CEA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OP_EBADHEADER
                  • API String ID: 2619118453-3145417678
                  • Opcode ID: 5759e6d1ab49eb1e78d3174dc17e493cf9895adb141589047525c1696c362898
                  • Instruction ID: 894178162794aaa9eafe4c8b7bb582b52939d2bc05f285d841eac4375821a86a
                  • Opcode Fuzzy Hash: 5759e6d1ab49eb1e78d3174dc17e493cf9895adb141589047525c1696c362898
                  • Instruction Fuzzy Hash: 1BC08CA0B8950899C810976C8C083D8220117A5328F800392423C020E4AA298D698600
                  Function 6788CEC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OP_ENOTFORMAT
                  • API String ID: 2619118453-2681463864
                  • Opcode ID: 856b9ab20677bb75cf836b8c130f261d4f48d692f443e5824a84d5dfd7472ba2
                  • Instruction ID: 4b929a5b14c6c8286c59823a8d6e6780e705999b86cfae7c1175d27ffb73b22c
                  • Opcode Fuzzy Hash: 856b9ab20677bb75cf836b8c130f261d4f48d692f443e5824a84d5dfd7472ba2
                  • Instruction Fuzzy Hash: B7C02BB0B8D50899CC009BADCC0C3E8330117A532CFC003A3433C034E5DE29CDA98700
                  Function 6788CE00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OP_ENOSEEK
                  • API String ID: 2619118453-3817739740
                  • Opcode ID: 2d9ef5812a69eff5739219b87002377f5dec35bf35e0dc9fc9a5c7d693cf3f0e
                  • Instruction ID: 9223a45a6d224bf5712db1dde61c3aee259dea5c630ee6321356a631a05e7070
                  • Opcode Fuzzy Hash: 2d9ef5812a69eff5739219b87002377f5dec35bf35e0dc9fc9a5c7d693cf3f0e
                  • Instruction Fuzzy Hash: E8C08CA0B8D54899C900976C8C083E8230117A9328F840352423C020E49A298D698601
                  Function 6788CE20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OP_EBADLINK
                  • API String ID: 2619118453-2592433474
                  • Opcode ID: ed355338573c58299eb0bfc31127515b6b4b0778af3b2ddf57c6b62bb19fc550
                  • Instruction ID: f633b5907ef856964e48162bee8dba7432f0b16493dd2ee05f805d1301a905ad
                  • Opcode Fuzzy Hash: ed355338573c58299eb0bfc31127515b6b4b0778af3b2ddf57c6b62bb19fc550
                  • Instruction Fuzzy Hash: 63C08CA0A8960899D800976C8C083D8230117A5769F800352423C020E4DA298DA98600
                  Function 6788CE40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OP_EBADPACKET
                  • API String ID: 2619118453-3913830267
                  • Opcode ID: 88b0648ea6ec8ecf2553adbce2d9b11e2e5e291f811f58b101916a7f931bc4c8
                  • Instruction ID: c3a445c484879f77721e0d408f171fd406a73052829f2438d288011250b9eeef
                  • Opcode Fuzzy Hash: 88b0648ea6ec8ecf2553adbce2d9b11e2e5e291f811f58b101916a7f931bc4c8
                  • Instruction Fuzzy Hash: D3C02BB0BCD50899CC00976CCC083D8330117A632CFC40353433C430E4DE2ACD6A8700
                  Function 6788CE60 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OP_ENOTAUDIO
                  • API String ID: 2619118453-1972482334
                  • Opcode ID: 5ce00389a6db5bb93bd043c9db8e9b123b17149cf84089aba5306f422da679f1
                  • Instruction ID: 9c45a5abadf28f6f8d561c7a93394a85d358b31f17810df6f4075e39a8d9f57a
                  • Opcode Fuzzy Hash: 5ce00389a6db5bb93bd043c9db8e9b123b17149cf84089aba5306f422da679f1
                  • Instruction Fuzzy Hash: 14C08CA0A895089AC8009B6C8C083D8220117A9328FC00353423C420E49E298D698600
                  Function 6788CDE5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OP_EBADTIMESTAMP
                  • API String ID: 2619118453-4235948511
                  • Opcode ID: 852aa98c2b4444a2aec78de1cc9e985d80a841d5d167526064fe33f612dffebf
                  • Instruction ID: 124a86500cb5c938b5ea99378675b39897126b4944a96f422ae8b43f789db4ce
                  • Opcode Fuzzy Hash: 852aa98c2b4444a2aec78de1cc9e985d80a841d5d167526064fe33f612dffebf
                  • Instruction Fuzzy Hash: 05C02BB4B8D60899CC00976CCC083E8330117A932CFC40353433C034E5DE29CD699701
                  Function 6788C2F5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 7COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OV_FALSE
                  • API String ID: 2619118453-3187368015
                  • Opcode ID: 0025d775af0f245f43b82125064230993bfe542028c8b34afdb77ab6d91233f1
                  • Instruction ID: db98543709701b4173e3ae9e53a72fd6bdb3fe7dd20fe0106fdde7d3f5c55489
                  • Opcode Fuzzy Hash: 0025d775af0f245f43b82125064230993bfe542028c8b34afdb77ab6d91233f1
                  • Instruction Fuzzy Hash: 04C09B6174554659DD005B5DDC543D86313677576CFC01312523D571E4FF29CD698740
                  Function 6788CDC5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 7COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OP_FALSE
                  • API String ID: 2619118453-3727381877
                  • Opcode ID: 4459b3891044efff7216edc50a19efff4073d7629ae72bb975adba75aec72253
                  • Instruction ID: 30d958e9d3f17f0cc360fba7c493d02534e6738a5c4d8152225a46f36ce93d0c
                  • Opcode Fuzzy Hash: 4459b3891044efff7216edc50a19efff4073d7629ae72bb975adba75aec72253
                  • Instruction Fuzzy Hash: 0AC02B6074840448CC00439CCC043DC33016795328FC00352423C070E0EE29CD2AC700
                  Function 6788CF80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 5COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OP_EOF
                  • API String ID: 2619118453-1834885626
                  • Opcode ID: f1bc892d6ab9566c56da584db3f5fe535aad2c9525b26e0f2f4ff7974815e62e
                  • Instruction ID: 29fa5cd825d7f2b1a6bb212b79cfd638f016d10456381bd2086593491c4f2659
                  • Opcode Fuzzy Hash: f1bc892d6ab9566c56da584db3f5fe535aad2c9525b26e0f2f4ff7974815e62e
                  • Instruction Fuzzy Hash: 65B092A02CD649A8D900978CD8083E87316A7A534DF410663462C034699E2A8D59C641
                  Function 6788CF00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 5COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OP_EIMPL
                  • API String ID: 2619118453-252479002
                  • Opcode ID: 2759c091d064db65b36270b83b780e270be9e8d1025c16b039b14d4986d1f805
                  • Instruction ID: 3c988be5619de8f21843c6bdeb59bb1782555165b4c627ca7fd754b4bbcc54c4
                  • Opcode Fuzzy Hash: 2759c091d064db65b36270b83b780e270be9e8d1025c16b039b14d4986d1f805
                  • Instruction Fuzzy Hash: F9B092A028D64AA8D900978CD8583E9731257A634DF810663462C0206D9E2A8D598601
                  Function 6788CF20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 5COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OP_EFAULT
                  • API String ID: 2619118453-2367972638
                  • Opcode ID: 3bf808c95fd9ced5b10f2fc7aa739c5e3b043479066b40c8ba900900bae1f157
                  • Instruction ID: cc25af08ab537a28cc278ec71cddf9ab7b9d5fa7a37749cd38fd3e4c1b81ecb7
                  • Opcode Fuzzy Hash: 3bf808c95fd9ced5b10f2fc7aa739c5e3b043479066b40c8ba900900bae1f157
                  • Instruction Fuzzy Hash: 2DB092A028D649A8E90097CCE8483E8731257A534DF410763462D02079DE2A8D998601
                  Function 6788CF40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 5COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OP_EREAD
                  • API String ID: 2619118453-3674582046
                  • Opcode ID: 0995acab453240bdcbead8e98b72f41319e4706d6e6f2bacf2042bd08ead2db7
                  • Instruction ID: a2e06cbca4277df795cd5238be24a6194bf8bec7dd204618052525e45eb3a62f
                  • Opcode Fuzzy Hash: 0995acab453240bdcbead8e98b72f41319e4706d6e6f2bacf2042bd08ead2db7
                  • Instruction Fuzzy Hash: 89B092A028D649A8D900978CD8083E8731657A534DF410663462C028699E2A8D598601
                  Function 6788CF60 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 5COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OP_HOLE
                  • API String ID: 2619118453-2167680998
                  • Opcode ID: bef67e3b0b865b399dfc62e847a619c836b44cc65e320aa7beac9146517399f7
                  • Instruction ID: 16b93bad9036cd9462e8f315b2ccda7f59fdfcb58782014479206339ebaba603
                  • Opcode Fuzzy Hash: bef67e3b0b865b399dfc62e847a619c836b44cc65e320aa7beac9146517399f7
                  • Instruction Fuzzy Hash: ABB092A028DA49A8D900978CD8083E8731A57A574DF410663472C124699E2A8D59C601
                  Function 6788CEE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 5COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OP_EINVAL
                  • API String ID: 2619118453-4086545115
                  • Opcode ID: 8923087f74b8947cc372ce9ee7fc3f28a04d27c17c207cd181c5bb78bcf18db5
                  • Instruction ID: 54f0d85cc1ee97cfb1d34df08e5cd04651deb946857e14c084ea540dc3620aaf
                  • Opcode Fuzzy Hash: 8923087f74b8947cc372ce9ee7fc3f28a04d27c17c207cd181c5bb78bcf18db5
                  • Instruction Fuzzy Hash: 23B092A028D64AECD900978CD8583E8771267A534DF410663862C0206D9E2ACE598601
                  Function 6788C490 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 5COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OV_EOF
                  • API String ID: 2619118453-3793671258
                  • Opcode ID: d12bd5375ef0d3c8c1bfebd2512d090e8f685bdaaf8edbbcb390a2ab8059a2d7
                  • Instruction ID: 8304717a5a3fd1f258dd48733c2a5b83408a58f7ad1fdbc70cd53c90673a985f
                  • Opcode Fuzzy Hash: d12bd5375ef0d3c8c1bfebd2512d090e8f685bdaaf8edbbcb390a2ab8059a2d7
                  • Instruction Fuzzy Hash: F2B012B238D64BA8DD009B8CD8083E8A313A77434CF401B23421D43068FF3ACD59C741
                  Function 6788C410 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 5COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OV_EIMPL
                  • API String ID: 2619118453-1826403104
                  • Opcode ID: 6a7cc2cef3b123b186f87533ed0d80bc81e783427ecb00e125c73dac5ad32fc6
                  • Instruction ID: 4bef15b61b5214cb0bc4a819752fc25ad9cb082f1a7608d0d89b0530e8843c65
                  • Opcode Fuzzy Hash: 6a7cc2cef3b123b186f87533ed0d80bc81e783427ecb00e125c73dac5ad32fc6
                  • Instruction Fuzzy Hash: 46B092A128D64AA8DD009B8CD8083E5A31357343CDF401623420D03064BE3ACD598701
                  Function 6788C430 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 5COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OV_EFAULT
                  • API String ID: 2619118453-1263234201
                  • Opcode ID: 6be5e86e0f2dd06f7fdca40db81a87b8b4674a9e897038523fa785e4589be2d0
                  • Instruction ID: 5f3c2751261da17b2dff4e68543b34da251fc543f233fc97b3f2a399b71020e9
                  • Opcode Fuzzy Hash: 6be5e86e0f2dd06f7fdca40db81a87b8b4674a9e897038523fa785e4589be2d0
                  • Instruction Fuzzy Hash: B2B092A128D64AA8D9019B8CE8083E4A313573834CF401623420D020A4FE3ACD998701
                  Function 6788C450 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 5COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OV_EREAD
                  • API String ID: 2619118453-3101006116
                  • Opcode ID: ec51f72b239ef191b7d502a47d1bbfd6897f8eee529872cf9e03b2368265eded
                  • Instruction ID: b58e25adb3ff3840af2a7dfeceaf508f3b176a9332789ece32d06ebb96c47d9f
                  • Opcode Fuzzy Hash: ec51f72b239ef191b7d502a47d1bbfd6897f8eee529872cf9e03b2368265eded
                  • Instruction Fuzzy Hash: 52B092A238E64AA8D9009B8CD8083E8A313973434CF401663420D02464BF2ACD598701
                  Function 6788C470 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 5COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: Error
                  • String ID: %s: %s$OV_HOLE
                  • API String ID: 2619118453-1466813691
                  • Opcode ID: d23fc1aa05fb9d2a0a1346e97f41d089591e563eb2bf8aca2596da62dc791f20
                  • Instruction ID: efed3ee658a32cff91e00e8ba99953b918e73c265595f8cf7f86e5b75551170e
                  • Opcode Fuzzy Hash: d23fc1aa05fb9d2a0a1346e97f41d089591e563eb2bf8aca2596da62dc791f20
                  • Instruction Fuzzy Hash: 7DB012B138D64BA8DE009B8CD8083E4A313573474CF401723420E53068FF3ACD59C701
                  Function 62E86800 Relevance: 5.2, APIs: 4, Instructions: 157COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270152250.0000000062E81000.00000020.00000001.01000000.0000001D.sdmp, Offset: 62E80000, based on PE: true
                  • Associated: 00000016.00000002.2270136370.0000000062E80000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270171204.0000000062E95000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270187075.0000000062E9E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270203868.0000000062E9F000.00000004.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270219476.0000000062EA2000.00000008.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270233416.0000000062EA3000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  Similarity
                  • API ID: memcpy
                  • String ID:
                  • API String ID: 3510742995-0
                  • Opcode ID: 130099a78ee0fecf6d296afed50ace754c1680d3e88b642ac823db01844b318c
                  • Instruction ID: ed16107f7f30df2ac5e4e78e33b3d314f267dfe68f024f351e3a687456108d85
                  • Opcode Fuzzy Hash: 130099a78ee0fecf6d296afed50ace754c1680d3e88b642ac823db01844b318c
                  • Instruction Fuzzy Hash: DA614A76621B8186DB14CF79D49479C33A4F749B9CF249229EEAD47B88EF39C590C340
                  Function 62E8C030 Relevance: 5.1, APIs: 4, Instructions: 110COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270152250.0000000062E81000.00000020.00000001.01000000.0000001D.sdmp, Offset: 62E80000, based on PE: true
                  • Associated: 00000016.00000002.2270136370.0000000062E80000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270171204.0000000062E95000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270187075.0000000062E9E000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270203868.0000000062E9F000.00000004.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270219476.0000000062EA2000.00000008.00000001.01000000.0000001D.sdmpDownload File
                  • Associated: 00000016.00000002.2270233416.0000000062EA3000.00000002.00000001.01000000.0000001D.sdmpDownload File
                  Similarity
                  • API ID: memcpy
                  • String ID:
                  • API String ID: 3510742995-0
                  • Opcode ID: 6d53d60ec8cd33ff9329483f60a3b602d16f8de6332c9b67aafb22e787506dfa
                  • Instruction ID: ab4893c58d16fcc5b85300e24c1fc575191ef115dd242e0281bed6db0e91b093
                  • Opcode Fuzzy Hash: 6d53d60ec8cd33ff9329483f60a3b602d16f8de6332c9b67aafb22e787506dfa
                  • Instruction Fuzzy Hash: 6D31C273B125208BC789CE36E89065D66A6F785FACF24A13ADE0957748DA79C8C1CB40
                  Function 6788E2D0 Relevance: 5.0, APIs: 4, Instructions: 36stringCOMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000016.00000002.2270263475.0000000067881000.00000020.00000001.01000000.0000002C.sdmp, Offset: 67880000, based on PE: true
                  • Associated: 00000016.00000002.2270248888.0000000067880000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270283033.0000000067897000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.0000000067898000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270297707.000000006789E000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270328697.00000000678A1000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270342800.00000000678A2000.00000004.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A3000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270356511.00000000678A6000.00000008.00000001.01000000.0000002C.sdmpDownload File
                  • Associated: 00000016.00000002.2270384643.00000000678A7000.00000002.00000001.01000000.0000002C.sdmpDownload File
                  Similarity
                  • API ID: malloc$memcpystrlen
                  • String ID:
                  • API String ID: 3553820921-0
                  • Opcode ID: a5be6efb7cc2ac789c82e889f605508009748b9ee1e325c42c1cc36d2ea640c5
                  • Instruction ID: 5eb876bba288808a92be269fcd383eb895404dd12151220b6ae9875ea473008e
                  • Opcode Fuzzy Hash: a5be6efb7cc2ac789c82e889f605508009748b9ee1e325c42c1cc36d2ea640c5
                  • Instruction Fuzzy Hash: 03F0E22234670580FE0A8B9EB91026C5291AB6EFE4F4848349F1C0B354FF3CCC938741