Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1483332
MD5:	d0fcc1d2ad23b05b53eefe1137594ddb
SHA1:	21b7f4bcae07c8c229035ef7f5b53be2a7febc54
SHA256:	367699d2c1f464b4c508846de8e1a760df77756492a2503c49a9086a374b5ef0
Tags:	exe
Infos:

Detection

Python Stealer, Amadey, Monster Stealer, RedLine, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Sigma detected: Capture Wi-Fi password

Yara detected Amadeys stealer DLL

Yara detected Monster Stealer

Yara detected Powershell download and execute

Yara detected RedLine Stealer

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Allocates memory in foreign processes

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Detected generic credential text file

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Gathers network related connection and port information

Hides threads from debuggers

High number of junk calls founds (likely related to sandbox DOS / API hammering)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

PE file contains section with special chars

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Searches for specific processes (likely to inject)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Suspicious File Creation In Uncommon AppData Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Tries to steal communication platform credentials (via file / registry access)

Uses attrib.exe to hide files

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

Yara detected Generic Python Stealer

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Console CodePage Lookup Via CHCP

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 6456 cmdline: "C:\Users\user\Desktop\file.exe" MD5: D0FCC1D2AD23B05B53EEFE1137594DDB)

cmd.exe (PID: 2616 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingIDBGHDGHCG.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RoamingIDBGHDGHCG.exe (PID: 6768 cmdline: "C:\Users\user\AppData\RoamingIDBGHDGHCG.exe" MD5: DFA220EFB513FE8F746AB0B1CD410F08)

explorti.exe (PID: 1960 cmdline: "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe" MD5: DFA220EFB513FE8F746AB0B1CD410F08)

cmd.exe (PID: 5752 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userGCAFCAFHJJ.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

userGCAFCAFHJJ.exe (PID: 2676 cmdline: "C:\Users\userGCAFCAFHJJ.exe" MD5: AC2D65E997C85BE5D4D2807C12BAB4E8)

axplong.exe (PID: 7548 cmdline: "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" MD5: AC2D65E997C85BE5D4D2807C12BAB4E8)

WerFault.exe (PID: 7204 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6456 -s 2260 MD5: C31336C1EFC2CCB44B4326EA793040F2)

explorti.exe (PID: 7212 cmdline: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe MD5: DFA220EFB513FE8F746AB0B1CD410F08)

axplong.exe (PID: 7888 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: AC2D65E997C85BE5D4D2807C12BAB4E8)

build.exe (PID: 3032 cmdline: "C:\Users\user\AppData\Local\Temp\1000001001\build.exe" MD5: C8CF26425A6CE325035E6DA8DFB16C4E)

stub.exe (PID: 1524 cmdline: "C:\Users\user\AppData\Local\Temp\1000001001\build.exe" MD5: 1CF17408048317FC82265ED6A1C7893D)

cmd.exe (PID: 6984 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6516 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 6568 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 1856 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6208 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 6716 cmdline: C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

attrib.exe (PID: 7672 cmdline: attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)

cmd.exe (PID: 5024 cmdline: C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('%error_message%', 0, 'System Error', 0+16);close()"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5028 cmdline: C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 7600 cmdline: taskkill /F /IM chrome.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cmd.exe (PID: 2892 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 5620 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 6008 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5584 cmdline: powershell.exe Get-Clipboard MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 6780 cmdline: C:\Windows\system32\cmd.exe /c "chcp" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 5860 cmdline: chcp MD5: 33395C4732A49065EA72590B14B64F32)

cmd.exe (PID: 7224 cmdline: C:\Windows\system32\cmd.exe /c "chcp" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 4500 cmdline: chcp MD5: 33395C4732A49065EA72590B14B64F32)

cmd.exe (PID: 7784 cmdline: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

systeminfo.exe (PID: 7156 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)

WmiPrvSE.exe (PID: 1852 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

HOSTNAME.EXE (PID: 2172 cmdline: hostname MD5: 33AFAA43B84BDEAB12E02F9DBD2B2EE0)

WMIC.exe (PID: 6628 cmdline: wmic logicaldisk get caption,description,providername MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

cmd.exe (PID: 5664 cmdline: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5316 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 1400 cmdline: netsh wlan show profiles MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

crypted.exe (PID: 3356 cmdline: "C:\Users\user\AppData\Local\Temp\1000002001\crypted.exe" MD5: 371D606AA2FCD2945D84A13E598DA55F)

RegAsm.exe (PID: 7304 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

5447jsX.exe (PID: 5796 cmdline: "C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe" MD5: 5DD9C1FFC4A95D8F1636CE53A5D99997)

conhost.exe (PID: 5228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

RegAsm.exe (PID: 7616 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

crypteda.exe (PID: 6824 cmdline: "C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe" MD5: 04E90B2CF273EFB3F6895CFCEF1E59BA)

conhost.exe (PID: 6460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

explorti.exe (PID: 7896 cmdline: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe MD5: DFA220EFB513FE8F746AB0B1CD410F08)

97a671ae5d.exe (PID: 7188 cmdline: "C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe" MD5: D0FCC1D2AD23B05B53EEFE1137594DDB)

WerFault.exe (PID: 7056 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7188 -s 1040 MD5: C31336C1EFC2CCB44B4326EA793040F2)

342db65350.exe (PID: 5516 cmdline: "C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe" MD5: D5F5B683A3CC5C05E5B2CD1204CA5517)

97a671ae5d.exe (PID: 7332 cmdline: "C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe" MD5: D0FCC1D2AD23B05B53EEFE1137594DDB)

WerFault.exe (PID: 6324 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7332 -s 1320 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://85.28.47.70/744f169d372be841.php"}

Threatname: Amadey

{"C2 url": ["http://185.215.113.16/Jo89Ku7d/index.php"]}

Threatname: RedLine

{"C2 url": "20.52.165.210:39030", "Bot Id": "LiveTraffic", "Message": "error", "Authorization Header": "143feb5082f9936e624c1e27545e7d19"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\25072023[1].exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\1000009001\25072023.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\buildred[1].exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\1000027001\buildred.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\system_info.txt	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author	Strings
0000000D.00000002.2288695597.0000000000D51000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000003.2321675490.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000008.00000002.2316104817.0000000000361000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000013.00000003.2649838006.0000000005520000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000023.00000002.2992462261.00000000031F5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000023.00000002.2992462261.00000000031F5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000024.00000002.2850300180.00000000026D0000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1408:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000F.00000002.2362139356.0000000000281000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000024.00000002.2850361286.00000000026EE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000002.2744587061.00000000025B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000021.00000002.2793593184.00000000006FC000.00000004.00000001.01000000.00000032.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2443328439.00000000025ED000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1590:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000013.00000002.3262529236.0000000000D51000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000023.00000002.2956394415.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2443697846.00000000040E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000005.00000003.2203716913.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000024.00000002.2851004349.00000000040D0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000014.00000002.2744921977.00000000025FD000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x15c8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000012.00000003.2646169494.00000000051A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000014.00000002.2744968028.0000000002617000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000002F.00000002.3029002681.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002F.00000002.3029002681.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000019.00000000.2782464290.00007FF725AE6000.00000002.00000001.01000000.00000013.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
00000019.00000000.2782464290.00007FF725AE6000.00000002.00000001.01000000.00000013.sdmp	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
00000019.00000000.2782464290.00007FF725AE6000.00000002.00000001.01000000.00000013.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000003.2225111532.0000000004B40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000012.00000002.3262997504.0000000000281000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000002.3043239757.000002606E460000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000003.2248436376.0000000005540000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000002.2282786078.0000000000D51000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000003.2242115500.00000000050D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2443375443.0000000002607000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000005.00000002.2245471234.00000000002E1000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000002.3102011990.00007FF725AE6000.00000002.00000001.01000000.00000013.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
00000019.00000002.3102011990.00007FF725AE6000.00000002.00000001.01000000.00000013.sdmp	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
00000019.00000002.3102011990.00007FF725AE6000.00000002.00000001.01000000.00000013.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6456	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6456	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6456	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6456	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 97a671ae5d.exe PID: 7188	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 97a671ae5d.exe PID: 7188	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 342db65350.exe PID: 5516	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: build.exe PID: 3032	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
Process Memory Space: build.exe PID: 3032	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
Process Memory Space: build.exe PID: 3032	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: stub.exe PID: 1524	JoeSecurity_MonsterStealer	Yara detected Monster Stealer	Joe Security
Process Memory Space: stub.exe PID: 1524	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 46 entries

Unpacked PEs

Source	Rule	Description	Author
33.2.crypted.exe.6fcbc0.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
33.2.crypted.exe.6fcbc0.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
33.2.crypted.exe.660000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
9.2.explorti.exe.d50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
8.2.userGCAFCAFHJJ.exe.360000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
18.2.axplong.exe.280000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
19.2.explorti.exe.d50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
35.2.RegAsm.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
15.2.axplong.exe.280000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
5.2.RoamingIDBGHDGHCG.exe.2e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
13.2.explorti.exe.d50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe, ProcessId: 7896, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\97a671ae5d.exe

Sigma detected: Suspicious File Creation In Uncommon AppData Folder

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\file.exe, ProcessId: 6456, TargetFilename: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe

Sigma detected: Console CodePage Lookup Via CHCP

Source: Process started

Author: _pete_0, TheDFIRReport: Data: Command: chcp, CommandLine: chcp, CommandLine|base64offset|contains: r), Image: C:\Windows\System32\chcp.com, NewProcessName: C:\Windows\System32\chcp.com, OriginalFileName: C:\Windows\System32\chcp.com, ParentCommandLine: C:\Windows\system32\cmd.exe /c "chcp", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6780, ParentProcessName: cmd.exe, ProcessCommandLine: chcp, ProcessId: 5860, ProcessName: chcp.com

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe, ProcessId: 7896, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\97a671ae5d.exe

Sigma detected: PowerShell Get-Clipboard Cmdlet Via CLI

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", CommandLine: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1000001001\build.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe, ParentProcessId: 1524, ParentProcessName: stub.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", ProcessId: 6008, ProcessName: cmd.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe Get-Clipboard, CommandLine: powershell.exe Get-Clipboard, CommandLine|base64offset|contains: ~Xn, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6008, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe Get-Clipboard, ProcessId: 5584, ProcessName: powershell.exe

Sigma detected: Suspicious Execution of Hostname

Source: Process started

Author: frack113: Data: Command: hostname, CommandLine: hostname, CommandLine|base64offset|contains: -, Image: C:\Windows\System32\HOSTNAME.EXE, NewProcessName: C:\Windows\System32\HOSTNAME.EXE, OriginalFileName: C:\Windows\System32\HOSTNAME.EXE, ParentCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7784, ParentProcessName: cmd.exe, ProcessCommandLine: hostname, ProcessId: 2172, ProcessName: HOSTNAME.EXE

Sigma detected: Suspicious Network Command

Source: Process started

Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io': Data: Command: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", CommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1000001001\build.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe, ParentProcessId: 1524, ParentProcessName: stub.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & n

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles", CommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1000001001\build.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe, ParentProcessId: 1524, ParentProcessName: stub.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles", ProcessId: 5664, ProcessName: cmd.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://85.28.47.31/8405906461a5200c/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Vi9leo/index.php0_	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/ows	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.php	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/ro2s	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/Local	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/8405906461a5200c/softokn3.dllAw	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/Jo89Ku7d/index.php4z	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/8405906461a5200c/softokn3.dll	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/nss3.dll	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/stealc/random.exencodedcgN	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/inc/25072023.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#3.	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/inc/buildred.exeL	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/inc/gawdth.exelF~n#	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/5499d72b3i	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/msvcp140.dllR	Avira URL Cloud: Label: malware
Source: http://185.215.113.19/fac00b58987e8fcf7b8c730804042ba5ce902415453	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/inc/5447jsX.exed	Avira URL Cloud: Label: phishing
Source: http://85.28.47.31/5499d72b3a3e55be.php=U	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/8405906461a5200c/nss3.dllll	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/inc/crypted.exeo	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#U.	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.php32	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/inc/gawdth.exe	Avira URL Cloud: Label: malware
Source: http://85.28.47.31/pr	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/inc/pered.exe	Avira URL Cloud: Label: phishing
Source: http://185.215.113.19/Vi9leo/index.php17001	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpTemp	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\userGCAFCAFHJJ.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\crypteda[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1317026
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1312596
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 0000002F.00000002.3029002681.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://85.28.47.70/744f169d372be841.php"}
Source: 33.2.crypted.exe.6fcbc0.1.unpack	Malware Configuration Extractor: RedLine {"C2 url": "20.52.165.210:39030", "Bot Id": "LiveTraffic", "Message": "error", "Authorization Header": "143feb5082f9936e624c1e27545e7d19"}
Source: axplong.exe.7888.18.memstrmin	Malware Configuration Extractor: Amadey {"C2 url": ["http://185.215.113.16/Jo89Ku7d/index.php"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\build[1].exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\buildred[1].exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\crypteda[1].exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\gawdth[1].exe	ReversingLabs: Detection: 62%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\2020[1].exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\25072023[1].exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\5447jsX[1].exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\crypted[1].exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\1000002001\crypted.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\1000009001\25072023.exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Temp\1000012001\2020.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\1000014001\gawdth.exe	ReversingLabs: Detection: 62%
Source: C:\Users\user\AppData\Local\Temp\1000027001\buildred.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	ReversingLabs: Detection: 79%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\2[1].exe	Joe Sandbox ML: detected
Source: C:\Users\userGCAFCAFHJJ.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\crypteda[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\build[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\pered[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409BB0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_00409BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00418940 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	0_2_00418940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040C660 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcat,lstrcat,PK11_FreeSlot,lstrcat,	0_2_0040C660
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00407280 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00407280
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409B10 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00409B10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C5B6C80

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Unpacked PE file: 20.2.97a671ae5d.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Unpacked PE file: 36.2.97a671ae5d.exe.400000.0.unpack

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: k1k2k3X9_62_PENTANOMIALp.otherp.onBasisp.tpBasisp.ppBasismX9_62_CHARACTERISTIC_TWOp.primep.char_twofieldTypeX9_62_FIELDIDabX9_62_CURVEfieldIDcurvebaseordercofactorECPARAMETERSvalue.named_curvevalue.parametersvalue.implicitlyCAECPKPARAMETERSprivateKeyparameterspublicKeyEC_PRIVATEKEYec_asn1_group2fieldidcrypto\ec\ec_asn1.cec_asn1_group2curveEC_GROUP_get_ecparametersEC_GROUP_get_ecpkparametersEC_GROUP_new_from_ecparametersEC_GROUP_new_from_ecpkparametersi2d_ECPKParametersd2i_ECPrivateKeyi2d_ECPrivateKeyi2d_ECParametersd2i_ECParameterso2i_ECPublicKeyi2o_ECPublicKeyossl_ec_group_new_excrypto\ec\ec_lib.cEC_GROUP_copyEC_GROUP_set_generatorEC_GROUP_set_curveEC_GROUP_get_curveEC_GROUP_get_degreeEC_GROUP_check_discriminantEC_POINT_newEC_POINT_copyEC_POINT_set_to_infinityEC_POINT_set_Jprojective_coordinates_GFpEC_POINT_set_affine_coordinatesEC_POINT_get_affine_coordinatesEC_POINT_addEC_POINT_dblEC_POINT_invertEC_POINT_is_at_infinityEC_POINT_is_on_curveEC_POINT_cmpEC_POINT_mulEC_GROUP_get_trinomial_basisEC_GROUP_get_pentanomial_basisgroup_new_from_nameossl_ec_group_set_paramsencodingdecoded-from-explicitEC_GROUP_new_from_paramsgeneratorcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.2.2built on: Tue Jun 4 16:20:25 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-ndysxfi8\src\rust\target\release\deps\cryptography_rust.pdbo source: build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2470488363.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\sqlite3.pdb source: build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3111615192.00007FF8B61E5000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_uuid.pdb source: stub.exe, 00000019.00000002.3112440354.00007FF8B7892000.00000002.00000001.01000000.0000002E.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: build.exe, 00000018.00000003.2773862520.00000207815C4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\python3.pdb source: build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042655656.000002606C7D0000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_ctypes.pdb source: stub.exe, 00000019.00000002.3120404184.00007FF8BA500000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\python310.pdb source: build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1n 15 Mar 2022built on: Tue Mar 15 18:32:50 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: build.exe, 00000018.00000003.2773862520.00000207815C4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_asyncio.pdb source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\select.pdb source: build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\unicodedata.pdb source: build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3111615192.00007FF8B61E5000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2470488363.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3120731805.00007FF8BFAD1000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_bz2.pdb source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3119029706.00007FF8B9F6D000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-ndysxfi8\src\rust\target\release\deps\cryptography_rust.pdb source: build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\pyexpat.pdb source: build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040D8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F4F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BCB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_004139B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00401710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004143F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DC50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	0_2_00414050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040EB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_004133C0

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://85.28.47.70/744f169d372be841.php
Source: Malware configuration extractor	IPs: 185.215.113.16
Source: Malware configuration extractor	URLs: 20.52.165.210:39030

Source: Joe Sandbox View	IP Address: 85.28.47.31 85.28.47.31
Source: Joe Sandbox View	IP Address: 185.215.113.19 185.215.113.19

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

0_2_00405000

Source: 342db65350.exe, 00000017.00000002.3339226587.0000000006443000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account equals www.youtube.com (Youtube)
Source: 342db65350.exe, 00000017.00000002.3339226587.0000000006443000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account"OO equals www.youtube.com (Youtube)
Source: 342db65350.exe, 00000017.00000002.3339226587.0000000006443000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account.NK equals www.youtube.com (Youtube)
Source: 342db65350.exe, 00000017.00000002.3339226587.0000000006443000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountMN equals www.youtube.com (Youtube)
Source: 342db65350.exe, 00000017.00000002.3285477229.00000000020B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountt% equals www.youtube.com (Youtube)
Source: 342db65350.exe, 00000017.00000002.3339226587.00000000064B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: x\firefox.exe" https://www.youtube.com/account equals www.youtube.com (Youtube)

Source: axplong.exe, 00000012.00000002.3285482105.0000000006320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo
Source: axplong.exe, 00000012.00000002.3270683057.0000000001578000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000012.00000002.3285482105.0000000006320000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000012.00000002.3270683057.00000000015D9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000012.00000002.3270683057.000000000155E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php
Source: axplong.exe, 00000012.00000002.3270683057.000000000155E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php-
Source: axplong.exe, 00000012.00000002.3285482105.0000000006320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php32
Source: axplong.exe, 00000012.00000002.3270683057.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php4z
Source: axplong.exe, 00000012.00000002.3285482105.0000000006320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpG
Source: axplong.exe, 00000012.00000002.3270683057.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpTemp
Source: axplong.exe, 00000012.00000002.3285482105.0000000006320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpahR=.
Source: axplong.exe, 00000012.00000002.3285482105.0000000006320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpeZR
Source: axplong.exe, 00000012.00000002.3285482105.0000000006320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpnu
Source: axplong.exe, 00000012.00000002.3285482105.0000000006320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/2020.exe
Source: axplong.exe, 00000012.00000002.3270683057.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/25072023.exe
Source: axplong.exe, 00000012.00000002.3270683057.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/25072023.exe2
Source: axplong.exe, 00000012.00000002.3270683057.0000000001578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/5447jsX.exeN
Source: axplong.exe, 00000012.00000002.3270683057.0000000001578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/5447jsX.exed
Source: axplong.exe, 00000012.00000002.3270683057.000000000150B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/build.exe
Source: axplong.exe, 00000012.00000002.3270683057.000000000150B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/build.exeYH
Source: axplong.exe, 00000012.00000002.3285482105.0000000006320000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000012.00000002.3270683057.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/buildred.exe
Source: axplong.exe, 00000012.00000002.3285482105.0000000006320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/buildred.exeL
Source: axplong.exe, 00000012.00000002.3270683057.0000000001578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/crypted.exe
Source: axplong.exe, 00000012.00000002.3270683057.0000000001578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/crypted.exeo
Source: axplong.exe, 00000012.00000002.3270683057.0000000001578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/crypteda.exe
Source: axplong.exe, 00000012.00000002.3270683057.0000000001578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/crypteda.exe?x
Source: axplong.exe, 00000012.00000002.3270683057.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/gawdth.exe
Source: axplong.exe, 00000012.00000002.3270683057.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/gawdth.exelF~n#
Source: axplong.exe, 00000012.00000002.3270683057.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/gawdth.exeu
Source: axplong.exe, 00000012.00000002.3285482105.0000000006320000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/pered.exe
Source: file.exe, 00000000.00000002.2443375443.0000000002657000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2443375443.000000000263A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe6Uf
Source: file.exe, 00000000.00000002.2443375443.0000000002657000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2464131529.0000000028D8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/soka/random.exe
Source: file.exe, 00000000.00000002.2464131529.0000000028D8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/soka/random.exe2
Source: explorti.exe, 00000013.00000002.3270790823.000000000186E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/stealc/random.exe
Source: explorti.exe, 00000013.00000002.3270790823.000000000186E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/stealc/random.exedgG
Source: explorti.exe, 00000013.00000002.3270790823.000000000186E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/stealc/random.exencodedcgN
Source: explorti.exe, 00000013.00000002.3270790823.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: explorti.exe, 00000013.00000002.3270790823.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exeB
Source: explorti.exe, 00000013.00000002.3270790823.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/
Source: explorti.exe, 00000013.00000002.3270790823.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/6165
Source: explorti.exe, 00000013.00000002.3270790823.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Local
Source: explorti.exe, 00000013.00000002.3270790823.0000000001885000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000013.00000002.3270790823.0000000001858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php
Source: explorti.exe, 00000013.00000002.3270790823.00000000018C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php.
Source: explorti.exe, 00000013.00000002.3270790823.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php0_
Source: explorti.exe, 00000013.00000002.3270790823.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php17001
Source: explorti.exe, 00000013.00000002.3270790823.000000000186E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php;
Source: explorti.exe, 00000013.00000002.3270790823.00000000018C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpN
Source: explorti.exe, 00000013.00000002.3270790823.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpWe
Source: explorti.exe, 00000013.00000002.3270790823.00000000018C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpf
Source: explorti.exe, 00000013.00000002.3270790823.00000000018C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpn
Source: explorti.exe, 00000013.00000002.3270790823.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phptch
Source: explorti.exe, 00000013.00000002.3270790823.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.phpx
Source: explorti.exe, 00000013.00000002.3270790823.00000000018C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/Vi9leo/index.php~
Source: explorti.exe, 00000013.00000002.3270790823.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#3.
Source: explorti.exe, 00000013.00000002.3270790823.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#U.
Source: explorti.exe, 00000013.00000002.3270790823.00000000018C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/d
Source: explorti.exe, 00000013.00000002.3270790823.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/fac00b58987e8fcf7b8c730804042ba5ce902415453
Source: explorti.exe, 00000013.00000002.3270790823.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/ferences.SourceAumid1e/x
Source: explorti.exe, 00000013.00000002.3270790823.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/l
Source: explorti.exe, 00000013.00000002.3270790823.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/lfons
Source: explorti.exe, 00000013.00000002.3270790823.0000000001885000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.19/ows
Source: file.exe, 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmp, 97a671ae5d.exe, 00000014.00000002.2744668224.00000000025EE000.00000004.00000020.00020000.00000000.sdmp, 97a671ae5d.exe, 00000014.00000002.2744968028.0000000002617000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31
Source: file.exe, 00000000.00000002.2443375443.000000000263A000.00000004.00000020.00020000.00000000.sdmp, 97a671ae5d.exe, 00000014.00000002.2744968028.0000000002617000.00000004.00000020.00020000.00000000.sdmp, 97a671ae5d.exe, 00000014.00000002.2744968028.000000000264A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/
Source: 97a671ae5d.exe, 00000014.00000002.2744968028.000000000264A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php
Source: file.exe, 00000000.00000002.2464131529.0000000028D8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php2
Source: 97a671ae5d.exe, 00000014.00000002.2744968028.0000000002617000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php2L
Source: file.exe, 00000000.00000002.2443375443.000000000263A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php8Rx
Source: file.exe, 00000000.00000002.2443375443.000000000263A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.php=U
Source: file.exe, 00000000.00000002.2443375443.000000000263A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpGR
Source: file.exe, 00000000.00000002.2469209996.0000000035220000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpQ
Source: 97a671ae5d.exe, 00000014.00000002.2744968028.0000000002617000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpZL
Source: file.exe, 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phposition:
Source: file.exe, 00000000.00000002.2469209996.0000000035220000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phpp
Source: 97a671ae5d.exe, 00000014.00000002.2744968028.000000000264A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3a3e55be.phps
Source: file.exe, 00000000.00000002.2469209996.0000000035220000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/5499d72b3i
Source: file.exe, 00000000.00000002.2443375443.0000000002657000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/freebl3.dll
Source: file.exe, 00000000.00000002.2443375443.0000000002657000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/freebl3.dll$3
Source: file.exe, 00000000.00000002.2443375443.0000000002657000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/mozglue.dll
Source: file.exe, 00000000.00000002.2443375443.0000000002657000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/msvcp140.dll
Source: file.exe, 00000000.00000002.2443375443.0000000002607000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/msvcp140.dllR
Source: file.exe, 00000000.00000002.2443375443.0000000002657000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/nss3.dll
Source: file.exe, 00000000.00000002.2443375443.0000000002657000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/nss3.dllll
Source: file.exe, 00000000.00000002.2443375443.0000000002657000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/softokn3.dll
Source: file.exe, 00000000.00000002.2443375443.0000000002657000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/softokn3.dllAw
Source: file.exe, 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/sqlite3.dll
Source: file.exe, 00000000.00000002.2443375443.000000000263A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/8405906461a5200c/vcruntime140.dll
Source: 97a671ae5d.exe, 00000014.00000002.2744968028.0000000002617000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/SSC:
Source: file.exe, 00000000.00000002.2443375443.000000000263A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/pr
Source: 97a671ae5d.exe, 00000014.00000002.2744968028.000000000264A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31/ro2s
Source: file.exe, 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://85.28.47.315499d72b3a3e55be.phposition:
Source: 97a671ae5d.exe, 00000014.00000002.2744968028.0000000002617000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31h
Source: 97a671ae5d.exe, 00000014.00000002.2744668224.00000000025EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.28.47.31lN$KsW5
Source: build.exe, 00000018.00000003.2773862520.00000207816BC000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: build.exe, 00000018.00000003.2773862520.00000207816BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: build.exe, 00000018.00000003.2773862520.00000207816BC000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.00000207816BC000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.00000207816BC000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: build.exe, 00000018.00000003.2773862520.00000207816BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: build.exe, 00000018.00000003.2773862520.00000207816BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: build.exe, 00000018.00000003.2773862520.00000207816BC000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.00000207816BC000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: build.exe, 00000018.00000003.2773862520.00000207816BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: build.exe, 00000018.00000003.2773862520.00000207816BC000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: build.exe, 00000018.00000003.2773862520.00000207816BC000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.00000207816BC000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: build.exe, 00000018.00000003.2773862520.00000207816BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: build.exe, 00000018.00000003.2773862520.00000207816BC000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3097971992.000002606F800000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.aiohttp.org/en/stable/logging.html#format-specification
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.aiohttp.org/en/stable/logging.html#format-specificationauvloopaset_event_loop_policyaEve
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3072092053.000002606ED60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://httpbin.org/post
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/jsonacityatimezoneaispaorgaasuMain.GetNetworkInfoT
Source: stub.exe, 00000019.00000003.3025477729.000002606E70F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://json.org
Source: build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.00000207816BC000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.00000207816BC000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.00000207816BC000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: build.exe, 00000018.00000003.2773862520.00000207816BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0N
Source: build.exe, 00000018.00000003.2773862520.00000207816BC000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: build.exe, 00000018.00000003.2773862520.00000207816BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000006DE000.00000040.00000001.01000000.00000011.sdmp, 342db65350.exe, 00000017.00000000.2736849521.000000000097E000.00000080.00000001.01000000.00000011.sdmp	String found in binary or memory: http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000006DE000.00000040.00000001.01000000.00000011.sdmp, 342db65350.exe, 00000017.00000000.2736849521.000000000097E000.00000080.00000001.01000000.00000011.sdmp	String found in binary or memory: http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000006DE000.00000040.00000001.01000000.00000011.sdmp, 342db65350.exe, 00000017.00000000.2736849521.000000000097E000.00000080.00000001.01000000.00000011.sdmp	String found in binary or memory: http://pki-ocsp.symauth.com0
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://python.org
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3048303310.000002606EA34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://python.org/
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://python.org:80
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://speleotrove.com/decimal/decarith.html
Source: build.exe, 00000018.00000003.2773862520.00000207816BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: build.exe, 00000018.00000003.2773862520.00000207816BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: build.exe, 00000018.00000003.2773862520.00000207816BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3047040170.000002606E860000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.00000207816BC000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3048303310.000002606EA34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3046738501.000002606E760000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: file.exe, file.exe, 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3046738501.000002606E760000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
Source: file.exe, 00000000.00000002.2469773266.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2456834295.000000001CBAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: file.exe, 00000000.00000003.2070352427.0000000002687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.riotgames.com/api/account/v1/user
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.riotgames.com/api/account/v1/userT
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.reddit.com/api/access_token
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.reddit.com/api/access_tokenaaccess_tokenuandroid:com.example.myredditapp:v1.2.3uBea
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/IPlayerService/GetOwnedGames/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/IPlayerService/GetSteamLevel/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/ISteamUser/GetPlayerSummaries/v0002/?key=440D7F4D810EF9298D25EDDF37C1F9
Source: file.exe, 00000000.00000002.2443375443.0000000002657000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2464131529.0000000028D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2443375443.0000000002657000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2464131529.0000000028D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3091985685.000002606F17B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3018700794.000002606F17A000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3072092053.000002606ED60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue37179
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/u.pngu.gifuunsupported
Source: file.exe, 00000000.00000003.2070352427.0000000002687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2070352427.0000000002687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2070352427.0000000002687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: axplong.exe, 00000012.00000002.3270683057.0000000001578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://coe.com.vn/
Source: axplong.exe, 00000012.00000002.3270683057.0000000001578000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000012.00000002.3270683057.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://coe.com.vn/tmp/2.exe
Source: axplong.exe, 00000012.00000002.3270683057.000000000154A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://coe.com.vn/tmp/2.exe9rl
Source: axplong.exe, 00000012.00000002.3270683057.0000000001578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://coe.com.vn/tmp/2.exePw;.
Source: axplong.exe, 00000012.00000002.3270683057.0000000001578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://coe.com.vn/tmp/2.exefdm
Source: file.exe, 00000000.00000002.2443375443.0000000002657000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2464131529.0000000028D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2443375443.0000000002657000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2464131529.0000000028D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3098111936.000002606F920000.00000004.00001000.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3098111936.000002606F9FC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://datatracker.ietf.org/doc/html/rfc5246#section-7.4.1.4.1
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v8/guilds/
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v8/guilds/u/invitesainvitesuhttps://discord.gg/acodeuhttps://t.me/monster_fr
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v8/users/
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3072092053.000002606ED60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.aiohttp.org/en/stable/client_advanced.html#character-set-detection
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.aiohttp.org/en/stable/client_advanced.html#character-set-detectionaDeprecationWarningD
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3091985685.000002606F17B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3018700794.000002606F17A000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3072092053.000002606ED60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.aiohttp.org/en/stable/client_advanced.html#proxy-support
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-github-profile/customizi
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3048303310.000002606EA34000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3025477729.000002606E70F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.7/library/asyncio-eventloop.html
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3096267679.000002606F4A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/ssl.html#ssl.OP_NO_COMPRESSION
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/ssl.html#ssl.OP_NO_COMPRESSIONaset_default_verify_pathsuSSL
Source: file.exe, 00000000.00000003.2070352427.0000000002687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2070352427.0000000002687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2070352427.0000000002687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://economy.roblox.com/v1/users/
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://filepreviews.io/
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3093364671.000002606F235000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3020784420.000002606F235000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3091985685.000002606F17B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3018700794.000002606F17A000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3072092053.000002606ED60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/aio-libs/aiohttp/discussions/6044
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues/8996
Source: build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues/9253
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs)
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/blob/main/.github/CONTRIBUTING.md)
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1141)
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1158)
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1165)
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1172)
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1187)
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1200)
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/1203)
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3048303310.000002606EA34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/136
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3048303310.000002606EA34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/251
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3048303310.000002606EA34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/issues/428
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python-attrs/attrs/wiki/Extensions-to-attrs)
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3091985685.000002606F17B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3018700794.000002606F17A000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3072092053.000002606ED60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/pull/28073
Source: stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sponsors/hynek
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sponsors/hynek).
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gql.twitch.tv/gql
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gql.twitch.tv/gqlT
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hynek.me/articles/import-attrs/)
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i.instagram.com/api/v1/accounts/current_user/?edit=true
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i.instagram.com/api/v1/accounts/current_user/?edit=trueuhttps://i.instagram.com/api/v1/users
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://i.instagram.com/api/v1/users/
Source: file.exe, 00000000.00000002.2464131529.0000000028D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://instagram.com/
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3092540180.000002606F1A1000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3017617111.000002606F19E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oauth.reddit.com/api/v1/me
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://oauth.reddit.com/api/v1/meuNo
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://open.spotify.com/user/
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://open.spotify.com/user/u
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/attrs/)
Source: build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/justforMonster/injection/main/injection.js
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/justforMonster/injection/main/injection.jsanulluMain.GetInjectionC
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/python-attrs/attrs/main/docs/_static/attrs_logo.svg
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://restores.name/log
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://restores.name/logaYMOVKJ1WAP6PFLQqz
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/questions/tagged/python-attrs)
Source: stub.exe, 00000019.00000003.2837202724.000002606F460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: stub.exe, 00000019.00000003.2837202724.000002606F460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/monster_free_cloud
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/monster_free_cloud----------------------
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://thumbnails.roblox.com/v1/users/avatar?userIds=
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi
Source: stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=referral&utm_campa
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiktok.com/
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/home
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/i/api/1.1/account/update_profile.json
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/i/api/1.1/account/update_profile.jsonareqadescriptionuThere
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/u
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.comarefereruhttps://twitter.com/homeusec-fetch-destaemptyusec-fetch-modeacorsusec-fe
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webcast.tiktok.com/webcast/wallet_api/diamond_buy/permission/?aid=1988&app_language=de-DE&ap
Source: file.exe, 00000000.00000002.2443375443.0000000002657000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2464131529.0000000028D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/)
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/23.2.0/_static/sponsors/FilePreviews.svg
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/23.2.0/_static/sponsors/Tidelift.svg
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/23.2.0/_static/sponsors/Variomedia.svg
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/latest/names.html)
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/changelog.html
Source: stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/changelog.html)
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/comparison.html#customization)
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization)
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.attrs.org/en/stable/why.html#data-classes).
Source: file.exe, 00000000.00000002.2443375443.0000000002657000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2464131529.0000000028D84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: build.exe, 00000018.00000003.2773862520.00000207816BC000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2070352427.0000000002687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2070352427.0000000002687000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ibm.com/
Source: stub.exe, 00000019.00000002.3098252283.000002606FB38000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: stub.exe, 00000019.00000003.2837202724.000002606F460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: stub.exe, 00000019.00000002.3097843536.000002606F6C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: stub.exe, 00000019.00000003.2837202724.000002606F460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmp, stub.exe, 00000019.00000002.3096504690.000002606F620000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2158189642.000000002EF53000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.2837202724.000002606F460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: stub.exe, 00000019.00000003.2837202724.000002606F460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2158189642.000000002EF53000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.2837202724.000002606F460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2158189642.000000002EF53000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.2837202724.000002606F460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: build.exe, 00000018.00000003.2773862520.00000207816B1000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3092540180.000002606F1A1000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3017617111.000002606F19E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/dev/peps/pep-0506/
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/user/
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/user/acomment_karmaatotal_karmaais_modais_goldais_suspendedaprofileUrlu
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.roblox.com/my/account/json
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.roblox.com/my/account/jsonuhttps://economy.roblox.com/v1/users/aresaUserIdu/currencyuhtt
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.spotify.com/api/account-settings/v1/profile
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.spotify.com/api/account-settings/v1/profileatextaloadsaprofileagenderabirthdateu
Source: stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.tiktok.com/passport/web/account/info/?aid=1459&app_language=de-DE&app_name=tiktok_web&ba
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.twitch.tv/
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.twitch.tv/adisplayNameahasPrimeaisPartneralanguageaprofileImageURLabitsBalanceatotalCoun
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.variomedia.de/
Source: 342db65350.exe, 00000017.00000002.3339226587.0000000006443000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account
Source: 342db65350.exe, 00000017.00000002.3339226587.0000000006443000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/account.NK
Source: 342db65350.exe, 00000017.00000002.3339226587.0000000006443000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountMN
Source: 342db65350.exe, 00000017.00000002.3285477229.00000000020B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/accountt%
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3048303310.000002606EA34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://zopeinterface.readthedocs.io/en/latest/

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window created: window name: CLIPBRDWNDCLASS

Source: 342db65350.exe, 00000017.00000002.3285477229.00000000020B5000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: _WINAPI_REGISTERRAWINPUTDEVICESl 3

memstr_c710819a-7

Source: Yara match

File source: Process Memory Space: 342db65350.exe PID: 5516, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000024.00000002.2850300180.00000000026D0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000014.00000002.2744587061.00000000025B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2443328439.00000000025ED000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2443697846.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000024.00000002.2851004349.00000000040D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000014.00000002.2744921977.00000000025FD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

Binary is likely a compiled AutoIt script file

Source: 342db65350.exe, 00000017.00000002.3262699829.0000000000182000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.		memstr_6e105682-5
Source: 342db65350.exe, 00000017.00000002.3262699829.0000000000182000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer		memstr_a06a6a42-c

PE file contains section with special chars

Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: RoamingIDBGHDGHCG.exe.0.dr	Static PE information: section name:
Source: RoamingIDBGHDGHCG.exe.0.dr	Static PE information: section name: .idata
Source: RoamingIDBGHDGHCG.exe.0.dr	Static PE information: section name:
Source: userGCAFCAFHJJ.exe.0.dr	Static PE information: section name:
Source: userGCAFCAFHJJ.exe.0.dr	Static PE information: section name: .idata
Source: userGCAFCAFHJJ.exe.0.dr	Static PE information: section name:
Source: explorti.exe.5.dr	Static PE information: section name:
Source: explorti.exe.5.dr	Static PE information: section name: .idata
Source: explorti.exe.5.dr	Static PE information: section name:
Source: axplong.exe.8.dr	Static PE information: section name:
Source: axplong.exe.8.dr	Static PE information: section name: .idata
Source: axplong.exe.8.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C60B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C60B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C60B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C5AF280

Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	File created: C:\Windows\Tasks\explorti.job			Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	File created: C:\Windows\Tasks\axplong.job			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A35A0	0_2_6C5A35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B5440	0_2_6C5B5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61545C	0_2_6C61545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61542B	0_2_6C61542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E5C10	0_2_6C5E5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F2C10	0_2_6C5F2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61AC00	0_2_6C61AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CD4D0	0_2_6C5CD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B64C0	0_2_6C5B64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E6CF0	0_2_6C5E6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AD4E0	0_2_6C5AD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6034A0	0_2_6C6034A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60C4A0	0_2_6C60C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B6C80	0_2_6C5B6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CED10	0_2_6C5CED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D0512	0_2_6C5D0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BFD00	0_2_6C5BFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E0DD0	0_2_6C5E0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6085F0	0_2_6C6085F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C616E63	0_2_6C616E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C9E50	0_2_6C5C9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E3E50	0_2_6C5E3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F2E4E	0_2_6C5F2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C4640	0_2_6C5C4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AC670	0_2_6C5AC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E7E10	0_2_6C5E7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C609E30	0_2_6C609E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F5600	0_2_6C5F5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6176E3	0_2_6C6176E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ABEF0	0_2_6C5ABEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BFEF0	0_2_6C5BFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C604EA0	0_2_6C604EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C5E90	0_2_6C5C5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60E680	0_2_6C60E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E7710	0_2_6C5E7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B9F00	0_2_6C5B9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D6FF0	0_2_6C5D6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ADFE0	0_2_6C5ADFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F77A0	0_2_6C5F77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C8850	0_2_6C5C8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CD850	0_2_6C5CD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EF070	0_2_6C5EF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B7810	0_2_6C5B7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EB820	0_2_6C5EB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F4820	0_2_6C5F4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6150C7	0_2_6C6150C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CC0E0	0_2_6C5CC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E58E0	0_2_6C5E58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D60A0	0_2_6C5D60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61B170	0_2_6C61B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5CA940	0_2_6C5CA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FB970	0_2_6C5FB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BD960	0_2_6C5BD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E5190	0_2_6C5E5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DD9B0	0_2_6C5DD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C602990	0_2_6C602990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AC9A0	0_2_6C5AC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E9A60	0_2_6C5E9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E8AC0	0_2_6C5E8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C1AF0	0_2_6C5C1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EE2F0	0_2_6C5EE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C612AB0	0_2_6C612AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BCAB0	0_2_6C5BCAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61BA90	0_2_6C61BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A22A0	0_2_6C5A22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D4AA0	0_2_6C5D4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A5340	0_2_6C5A5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BC370	0_2_6C5BC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ED320	0_2_6C5ED320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6153C8	0_2_6C6153C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AF380	0_2_6C5AF380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65AC60	0_2_6C65AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72AC30	0_2_6C72AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C716C00	0_2_6C716C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64ECC0	0_2_6C64ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AECD0	0_2_6C6AECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71ED70	0_2_6C71ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C77AD50	0_2_6C77AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D8D20	0_2_6C7D8D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DCDC0	0_2_6C7DCDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C654DB0	0_2_6C654DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E6D90	0_2_6C6E6D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EEE70	0_2_6C6EEE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C730E20	0_2_6C730E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65AEC0	0_2_6C65AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F0EC0	0_2_6C6F0EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D6E90	0_2_6C6D6E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C712F70	0_2_6C712F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BEF40	0_2_6C6BEF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C790F20	0_2_6C790F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C656F10	0_2_6C656F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72EFF0	0_2_6C72EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C650FE0	0_2_6C650FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C798FB0	0_2_6C798FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65EFB0	0_2_6C65EFB0

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 00404610 appears 316 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5DCBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5E94D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C7D09D0 appears 51 times

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6456 -s 2260

Source: 2.exe.18.dr	Static PE information: Data appended to the last section found
Source: 2[1].exe.18.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000000.1992970608.000000000244C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesOdilesigo@ vs file.exe
Source: file.exe, 00000000.00000002.2470654873.000000006C825000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2464131529.0000000028D8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000000.00000002.2464131529.0000000028D8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000024.00000002.2850300180.00000000026D0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000014.00000002.2744587061.00000000025B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2443328439.00000000025ED000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2443697846.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000024.00000002.2851004349.00000000040D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000014.00000002.2744921977.00000000025FD000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: file.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: random[1].exe0.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 2[1].exe.18.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 2.exe.18.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9997705344945356
Source: random[1].exe.0.dr	Static PE information: Section: jnaccepv ZLIB complexity 0.9946529587866425
Source: RoamingIDBGHDGHCG.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9997705344945356
Source: RoamingIDBGHDGHCG.exe.0.dr	Static PE information: Section: jnaccepv ZLIB complexity 0.9946529587866425
Source: userGCAFCAFHJJ.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9973390667574932
Source: userGCAFCAFHJJ.exe.0.dr	Static PE information: Section: rkxzdssx ZLIB complexity 0.9944472371164731
Source: explorti.exe.5.dr	Static PE information: Section: ZLIB complexity 0.9997705344945356
Source: explorti.exe.5.dr	Static PE information: Section: jnaccepv ZLIB complexity 0.9946529587866425
Source: axplong.exe.8.dr	Static PE information: Section: ZLIB complexity 0.9973390667574932
Source: axplong.exe.8.dr	Static PE information: Section: rkxzdssx ZLIB complexity 0.9944472371164731
Source: crypteda[1].exe.18.dr	Static PE information: Section: .data ZLIB complexity 0.9957952789319011
Source: crypteda.exe.18.dr	Static PE information: Section: .data ZLIB complexity 0.9957952789319011

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@129/133@0/13

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C607030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C607030

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_004190A0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\T3J5110P.htm

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7332
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2992:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7700:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5040:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7188
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5452:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7356:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5316:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Mutant created: \Sessions\1\BaseNamedObjects\M
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7452:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4164:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4304:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5228:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1016:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3856:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6460:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2616:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6456
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5428:120:WilError_03

Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe

File created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7

Jump to behavior

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\cmd.exe

File read: C:\Windows\System32\drivers\etc\hosts

Source: file.exe, 00000000.00000002.2456834295.000000001CBAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2470488363.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2469659271.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: file.exe, 00000000.00000002.2456834295.000000001CBAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2470488363.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2469659271.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2443165283.00000000025DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT url FROM urls LIMIT 1000S$;
Source: file.exe, 00000000.00000002.2456834295.000000001CBAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2470488363.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2469659271.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2456834295.000000001CBAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2470488363.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2469659271.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: file.exe, file.exe, 00000000.00000002.2456834295.000000001CBAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2470488363.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2469659271.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2456834295.000000001CBAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2469659271.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2456834295.000000001CBAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2470488363.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2469659271.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000003.2083091335.00000000026C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2069906964.0000000022C89000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2082464293.0000000022CA5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2456834295.000000001CBAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2469659271.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: file.exe, 00000000.00000002.2456834295.000000001CBAA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2469659271.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: RoamingIDBGHDGHCG.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: userGCAFCAFHJJ.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: explorti.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingIDBGHDGHCG.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe "C:\Users\user\AppData\RoamingIDBGHDGHCG.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userGCAFCAFHJJ.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userGCAFCAFHJJ.exe "C:\Users\userGCAFCAFHJJ.exe"
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6456 -s 2260
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Source: C:\Users\userGCAFCAFHJJ.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe "C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe"
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7188 -s 1040
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe "C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000001001\build.exe "C:\Users\user\AppData\Local\Temp\1000001001\build.exe"
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Process created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe "C:\Users\user\AppData\Local\Temp\1000001001\build.exe"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000002001\crypted.exe "C:\Users\user\AppData\Local\Temp\1000002001\crypted.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\AppData\Local\Temp\1000002001\crypted.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe "C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe "C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe"
Source: C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('%error_message%', 0, 'System Error', 0+16);close()""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe
Source: C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7332 -s 1320
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "chcp"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "chcp"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe "C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\systeminfo.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\HOSTNAME.EXE hostname
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic logicaldisk get caption,description,providername
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingIDBGHDGHCG.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userGCAFCAFHJJ.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe "C:\Users\user\AppData\RoamingIDBGHDGHCG.exe"	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userGCAFCAFHJJ.exe "C:\Users\userGCAFCAFHJJ.exe"	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000001001\build.exe "C:\Users\user\AppData\Local\Temp\1000001001\build.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000002001\crypted.exe "C:\Users\user\AppData\Local\Temp\1000002001\crypted.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe "C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe "C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe "C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe"
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe "C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe"
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Process created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe "C:\Users\user\AppData\Local\Temp\1000001001\build.exe"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe""
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('%error_message%', 0, 'System Error', 0+16);close()""
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "chcp"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "chcp"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Temp\1000002001\crypted.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\HOSTNAME.EXE hostname
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic logicaldisk get caption,description,providername
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Section loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Section loaded: python310.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Section loaded: libffi-7.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Section loaded: sqlite3.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Section loaded: python3.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Section loaded: libcrypto-1_1.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Section loaded: libssl-1_1.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Section loaded: libcrypto-1_1.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\crypted.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000002001\crypted.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dwrite.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: textshaping.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: textinputframework.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: coremessaging.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: coremessaging.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\attrib.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mozglue.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wsock32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: msvcp140.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: esscli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\systeminfo.exe systeminfo

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: k1k2k3X9_62_PENTANOMIALp.otherp.onBasisp.tpBasisp.ppBasismX9_62_CHARACTERISTIC_TWOp.primep.char_twofieldTypeX9_62_FIELDIDabX9_62_CURVEfieldIDcurvebaseordercofactorECPARAMETERSvalue.named_curvevalue.parametersvalue.implicitlyCAECPKPARAMETERSprivateKeyparameterspublicKeyEC_PRIVATEKEYec_asn1_group2fieldidcrypto\ec\ec_asn1.cec_asn1_group2curveEC_GROUP_get_ecparametersEC_GROUP_get_ecpkparametersEC_GROUP_new_from_ecparametersEC_GROUP_new_from_ecpkparametersi2d_ECPKParametersd2i_ECPrivateKeyi2d_ECPrivateKeyi2d_ECParametersd2i_ECParameterso2i_ECPublicKeyi2o_ECPublicKeyossl_ec_group_new_excrypto\ec\ec_lib.cEC_GROUP_copyEC_GROUP_set_generatorEC_GROUP_set_curveEC_GROUP_get_curveEC_GROUP_get_degreeEC_GROUP_check_discriminantEC_POINT_newEC_POINT_copyEC_POINT_set_to_infinityEC_POINT_set_Jprojective_coordinates_GFpEC_POINT_set_affine_coordinatesEC_POINT_get_affine_coordinatesEC_POINT_addEC_POINT_dblEC_POINT_invertEC_POINT_is_at_infinityEC_POINT_is_on_curveEC_POINT_cmpEC_POINT_mulEC_GROUP_get_trinomial_basisEC_GROUP_get_pentanomial_basisgroup_new_from_nameossl_ec_group_set_paramsencodingdecoded-from-explicitEC_GROUP_new_from_paramsgeneratorcompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"3.2.2built on: Tue Jun 4 16:20:25 2024 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availablecrypto\init.cOPENSSL_init_cryptocrypto\bio\bio_lib.cBIO_new_exbio_read_internbio_write_internBIO_sendmmsgBIO_recvmmsgBIO_putsBIO_getsBIO_get_line BIO_ctrlBIO_callback_ctrlBIO_find_type source: build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-ndysxfi8\src\rust\target\release\deps\cryptography_rust.pdbo source: build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2470488363.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\sqlite3.pdb source: build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb source: build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3111615192.00007FF8B61E5000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_uuid.pdb source: stub.exe, 00000019.00000002.3112440354.00007FF8B7892000.00000002.00000001.01000000.0000002E.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: build.exe, 00000018.00000003.2773862520.00000207815C4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\python3.pdb source: build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042655656.000002606C7D0000.00000002.00000001.01000000.0000001D.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_ctypes.pdb source: stub.exe, 00000019.00000002.3120404184.00007FF8BA500000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\python310.pdb source: build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1n 15 Mar 2022built on: Tue Mar 15 18:32:50 2022 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: build.exe, 00000018.00000003.2773862520.00000207815C4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_asyncio.pdb source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\select.pdb source: build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\unicodedata.pdb source: build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ossl_ec_GFp_simple_group_set_curvecrypto\ec\ecp_smpl.cossl_ec_GFp_simple_group_check_discriminantossl_ec_GFp_simple_point_set_affine_coordinatesossl_ec_GFp_simple_point_get_affine_coordinatesossl_ec_GFp_simple_make_affineossl_ec_GFp_simple_points_make_affineossl_ec_GFp_simple_field_invossl_ec_GFp_simple_blind_coordinatescompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specific.dllCPUINFO: crypto\initthread.cOPENSSL_ia32cap source: build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\_w\1\b\libssl-1_1.pdb@@ source: build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3111615192.00007FF8B61E5000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2470488363.000000006C7DF000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3120731805.00007FF8BFAD1000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\_bz2.pdb source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3119029706.00007FF8B9F6D000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: C:\Users\runneradmin\AppData\Local\Temp\pip-req-build-ndysxfi8\src\rust\target\release\deps\cryptography_rust.pdb source: build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\40\b\bin\amd64\pyexpat.pdb source: build.exe, 00000018.00000003.2773862520.0000020781739000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.maduco:R;.gubogus:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Unpacked PE file: 5.2.RoamingIDBGHDGHCG.exe.2e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jnaccepv:EW;oirghrul:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;jnaccepv:EW;oirghrul:EW;.taggant:EW;
Source: C:\Users\userGCAFCAFHJJ.exe	Unpacked PE file: 8.2.userGCAFCAFHJJ.exe.360000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rkxzdssx:EW;opdalfsp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rkxzdssx:EW;opdalfsp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 9.2.explorti.exe.d50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jnaccepv:EW;oirghrul:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;jnaccepv:EW;oirghrul:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 13.2.explorti.exe.d50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jnaccepv:EW;oirghrul:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;jnaccepv:EW;oirghrul:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 15.2.axplong.exe.280000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rkxzdssx:EW;opdalfsp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rkxzdssx:EW;opdalfsp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 18.2.axplong.exe.280000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rkxzdssx:EW;opdalfsp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rkxzdssx:EW;opdalfsp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Unpacked PE file: 19.2.explorti.exe.d50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jnaccepv:EW;oirghrul:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;jnaccepv:EW;oirghrul:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Unpacked PE file: 20.2.97a671ae5d.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.maduco:R;.gubogus:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Unpacked PE file: 23.2.342db65350.exe.c0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Unpacked PE file: 36.2.97a671ae5d.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.maduco:R;.gubogus:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Unpacked PE file: 20.2.97a671ae5d.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Unpacked PE file: 36.2.97a671ae5d.exe.400000.0.unpack

Source: 25072023[1].exe.18.dr

Static PE information: 0xBD051842 [Sun Jun 29 00:35:14 2070 UTC]

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004195E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_004195E0

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: crypteda.exe.18.dr	Static PE information: real checksum: 0x0 should be: 0x168d60
Source: userGCAFCAFHJJ.exe.0.dr	Static PE information: real checksum: 0x1e2bee should be: 0x1e2634
Source: gawdth[1].exe.18.dr	Static PE information: real checksum: 0x0 should be: 0xe84a7
Source: RoamingIDBGHDGHCG.exe.0.dr	Static PE information: real checksum: 0x1d7fc2 should be: 0x1d1201
Source: axplong.exe.8.dr	Static PE information: real checksum: 0x1e2bee should be: 0x1e2634
Source: 2.exe.18.dr	Static PE information: real checksum: 0x483a7 should be: 0x30585
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1d7fc2 should be: 0x1d1201
Source: 5447jsX[1].exe.18.dr	Static PE information: real checksum: 0x0 should be: 0x6c443
Source: 25072023.exe.18.dr	Static PE information: real checksum: 0x0 should be: 0x4f6f6
Source: explorti.exe.5.dr	Static PE information: real checksum: 0x1d7fc2 should be: 0x1d1201
Source: gawdth.exe.18.dr	Static PE information: real checksum: 0x0 should be: 0xe84a7
Source: buildred.exe.18.dr	Static PE information: real checksum: 0x0 should be: 0x56436
Source: crypted[1].exe.18.dr	Static PE information: real checksum: 0x0 should be: 0xf7aaf
Source: 25072023[1].exe.18.dr	Static PE information: real checksum: 0x0 should be: 0x4f6f6
Source: buildred[1].exe.18.dr	Static PE information: real checksum: 0x0 should be: 0x56436
Source: crypted.exe.18.dr	Static PE information: real checksum: 0x0 should be: 0xf7aaf
Source: 5447jsX.exe.18.dr	Static PE information: real checksum: 0x0 should be: 0x6c443
Source: 2[1].exe.18.dr	Static PE information: real checksum: 0x483a7 should be: 0x30585
Source: crypteda[1].exe.18.dr	Static PE information: real checksum: 0x0 should be: 0x168d60

Source: file.exe	Static PE information: section name: .maduco
Source: file.exe	Static PE information: section name: .gubogus
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: jnaccepv
Source: random[1].exe.0.dr	Static PE information: section name: oirghrul
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: RoamingIDBGHDGHCG.exe.0.dr	Static PE information: section name:
Source: RoamingIDBGHDGHCG.exe.0.dr	Static PE information: section name: .idata
Source: RoamingIDBGHDGHCG.exe.0.dr	Static PE information: section name:
Source: RoamingIDBGHDGHCG.exe.0.dr	Static PE information: section name: jnaccepv
Source: RoamingIDBGHDGHCG.exe.0.dr	Static PE information: section name: oirghrul
Source: RoamingIDBGHDGHCG.exe.0.dr	Static PE information: section name: .taggant
Source: userGCAFCAFHJJ.exe.0.dr	Static PE information: section name:
Source: userGCAFCAFHJJ.exe.0.dr	Static PE information: section name: .idata
Source: userGCAFCAFHJJ.exe.0.dr	Static PE information: section name:
Source: userGCAFCAFHJJ.exe.0.dr	Static PE information: section name: rkxzdssx
Source: userGCAFCAFHJJ.exe.0.dr	Static PE information: section name: opdalfsp
Source: userGCAFCAFHJJ.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe0.0.dr	Static PE information: section name: .maduco
Source: random[1].exe0.0.dr	Static PE information: section name: .gubogus
Source: explorti.exe.5.dr	Static PE information: section name:
Source: explorti.exe.5.dr	Static PE information: section name: .idata
Source: explorti.exe.5.dr	Static PE information: section name:
Source: explorti.exe.5.dr	Static PE information: section name: jnaccepv
Source: explorti.exe.5.dr	Static PE information: section name: oirghrul
Source: explorti.exe.5.dr	Static PE information: section name: .taggant
Source: axplong.exe.8.dr	Static PE information: section name:
Source: axplong.exe.8.dr	Static PE information: section name: .idata
Source: axplong.exe.8.dr	Static PE information: section name:
Source: axplong.exe.8.dr	Static PE information: section name: rkxzdssx
Source: axplong.exe.8.dr	Static PE information: section name: opdalfsp
Source: axplong.exe.8.dr	Static PE information: section name: .taggant
Source: crypteda[1].exe.18.dr	Static PE information: section name: .zzZ
Source: crypteda.exe.18.dr	Static PE information: section name: .zzZ
Source: 5447jsX[1].exe.18.dr	Static PE information: section name: .zzZ
Source: 5447jsX.exe.18.dr	Static PE information: section name: .zzZ
Source: 2[1].exe.18.dr	Static PE information: section name: .kic
Source: 2[1].exe.18.dr	Static PE information: section name: .yuh
Source: 2.exe.18.dr	Static PE information: section name: .kic
Source: 2.exe.18.dr	Static PE information: section name: .yuh
Source: pered[1].exe.18.dr	Static PE information: section name: _RDATA
Source: pered.exe.18.dr	Static PE information: section name: _RDATA
Source: gawdth[1].exe.18.dr	Static PE information: section name: .didat
Source: gawdth[1].exe.18.dr	Static PE information: section name: _RDATA
Source: gawdth.exe.18.dr	Static PE information: section name: .didat
Source: gawdth.exe.18.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041A9F5 push ecx; ret		0_2_0041AA08
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DB536 push ecx; ret		0_2_6C5DB549

Source: file.exe	Static PE information: section name: .text entropy: 7.8226282857662985
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.982538775715216
Source: random[1].exe.0.dr	Static PE information: section name: jnaccepv entropy: 7.9543392745735515
Source: RoamingIDBGHDGHCG.exe.0.dr	Static PE information: section name: entropy: 7.982538775715216
Source: RoamingIDBGHDGHCG.exe.0.dr	Static PE information: section name: jnaccepv entropy: 7.9543392745735515
Source: userGCAFCAFHJJ.exe.0.dr	Static PE information: section name: entropy: 7.984653502366883
Source: userGCAFCAFHJJ.exe.0.dr	Static PE information: section name: rkxzdssx entropy: 7.954277440139706
Source: random[1].exe0.0.dr	Static PE information: section name: .text entropy: 7.8226282857662985
Source: explorti.exe.5.dr	Static PE information: section name: entropy: 7.982538775715216
Source: explorti.exe.5.dr	Static PE information: section name: jnaccepv entropy: 7.9543392745735515
Source: axplong.exe.8.dr	Static PE information: section name: entropy: 7.984653502366883
Source: axplong.exe.8.dr	Static PE information: section name: rkxzdssx entropy: 7.954277440139706
Source: 2[1].exe.18.dr	Static PE information: section name: .text entropy: 7.772647603957998
Source: 2.exe.18.dr	Static PE information: section name: .text entropy: 7.772647603957998

Persistence and Installation Behavior

Uses attrib.exe to hide files

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe"

Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\buildred[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000002001\crypted.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\gawdth[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_cffi_backend.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\aiohttp\_http_writer.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\crypteda[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\userGCAFCAFHJJ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\pered[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\2020[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\multidict\_multidict.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\yarl\_quoting_c.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\build[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000012001\2020.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\charset_normalizer\md__mypyc.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\aiohttp\_helpers.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_queue.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\5447jsX[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_decimal.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\frozenlist\_frozenlist.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\aiohttp\_websocket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File created: C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\charset_normalizer\md.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\aiohttp\_http_parser.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	File created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\python310.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\2[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\25072023[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000009001\25072023.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000005001\2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\crypted[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000010001\pered.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000014001\gawdth.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000027001\buildred.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\userGCAFCAFHJJ.exe	File created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_uuid.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 97a671ae5d.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 342db65350.exe

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe

File created: C:\Windows\Tasks\explorti.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 97a671ae5d.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 97a671ae5d.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 342db65350.exe
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 342db65350.exe

Source: C:\Users\user\Desktop\file.exe

0_2_004195E0

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\systeminfo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-67316

High number of junk calls founds (likely related to sandbox DOS / API hammering)

Source: Global behavior

Junk call stats: NtWriteFile 1446916

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter

Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Caption, Description, ProviderName FROM Win32_LogicalDisk

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UFIDDLER.EXE
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: USBIEDLL.DLLUANTIVM.CHECKDLLT
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UXENSERVICE.EXE
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UWIRESHARK.EXE
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UOLLYDBG.EXE
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: USBIEDLL.DLL
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UVMTOOLSD.EXEUVMWARETRAY.EXEUVMACTHLP.EXEUVBOXTRAY.EXEUVBOXSERVICE.EXEUVMSRVC.EXEUPRL_TOOLS.EXEUXENSERVICE.EXEUANTIVM.CHECKPROCESST
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPROCESSHACKER.EXE
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UQEMU-GA.EXE
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UVMUSRVC.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 34EC2C second address: 34EC30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 34EC30 second address: 34EC36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4BFEB3 second address: 4BFEB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4BFEB9 second address: 4BFEC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0950EB8E4Ah 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4BFEC7 second address: 4BFECB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C0014 second address: 4C001E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F0950EB8E46h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C001E second address: 4C002A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007F0950FC2076h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C002A second address: 4C0043 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F0950EB8E4Dh 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C377D second address: 4C378A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C378A second address: 4C378F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C3889 second address: 4C3895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 push eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C3895 second address: 4C38F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E4Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jp 00007F0950EB8E4Eh 0x00000014 mov eax, dword ptr [eax] 0x00000016 jmp 00007F0950EB8E54h 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f pushad 0x00000020 jo 00007F0950EB8E5Ch 0x00000026 jmp 00007F0950EB8E56h 0x0000002b push eax 0x0000002c push edx 0x0000002d push ecx 0x0000002e pop ecx 0x0000002f rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C39C2 second address: 4C39C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C3A36 second address: 4C3A3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C3A3A second address: 4C3A44 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0950FC2076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C3A44 second address: 4C3A4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C3A4A second address: 4C3A4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C3A4E second address: 4C3AC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b xor dword ptr [ebp+122D19EFh], ecx 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007F0950EB8E48h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d movzx ecx, ax 0x00000030 call 00007F0950EB8E49h 0x00000035 push ebx 0x00000036 push esi 0x00000037 pushad 0x00000038 popad 0x00000039 pop esi 0x0000003a pop ebx 0x0000003b push eax 0x0000003c push ebx 0x0000003d jmp 00007F0950EB8E4Fh 0x00000042 pop ebx 0x00000043 mov eax, dword ptr [esp+04h] 0x00000047 jmp 00007F0950EB8E4Fh 0x0000004c mov eax, dword ptr [eax] 0x0000004e push eax 0x0000004f push edx 0x00000050 jno 00007F0950EB8E48h 0x00000056 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C3AC1 second address: 4C3B84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC207Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jmp 00007F0950FC2089h 0x00000012 pop eax 0x00000013 sub dword ptr [ebp+122D1A41h], ebx 0x00000019 push 00000003h 0x0000001b mov ecx, dword ptr [ebp+122D39EAh] 0x00000021 push 00000000h 0x00000023 or dword ptr [ebp+122D1AF4h], eax 0x00000029 push 00000003h 0x0000002b push 00000000h 0x0000002d push esi 0x0000002e call 00007F0950FC2078h 0x00000033 pop esi 0x00000034 mov dword ptr [esp+04h], esi 0x00000038 add dword ptr [esp+04h], 00000019h 0x00000040 inc esi 0x00000041 push esi 0x00000042 ret 0x00000043 pop esi 0x00000044 ret 0x00000045 call 00007F0950FC2079h 0x0000004a jmp 00007F0950FC207Eh 0x0000004f push eax 0x00000050 pushad 0x00000051 jg 00007F0950FC207Ch 0x00000057 jnc 00007F0950FC207Ch 0x0000005d popad 0x0000005e mov eax, dword ptr [esp+04h] 0x00000062 jmp 00007F0950FC2080h 0x00000067 mov eax, dword ptr [eax] 0x00000069 push eax 0x0000006a push edx 0x0000006b js 00007F0950FC2080h 0x00000071 jmp 00007F0950FC207Ah 0x00000076 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C3B84 second address: 4C3B8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C3B8A second address: 4C3B8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C3B8E second address: 4C3B92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C3B92 second address: 4C3BF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push edx 0x0000000d jnc 00007F0950FC2078h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov dword ptr [ebp+122D1BAEh], eax 0x0000001b lea ebx, dword ptr [ebp+124484F2h] 0x00000021 mov dword ptr [ebp+122D1A89h], eax 0x00000027 xchg eax, ebx 0x00000028 pushad 0x00000029 jmp 00007F0950FC2088h 0x0000002e jmp 00007F0950FC2088h 0x00000033 popad 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 jns 00007F0950FC2078h 0x0000003d rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C3BF9 second address: 4C3BFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4E4A0B second address: 4E4A26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0950FC2087h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4E4A26 second address: 4E4A2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4E4A2A second address: 4E4A34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4E2AF3 second address: 4E2AF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4E2AF8 second address: 4E2B0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a jo 00007F0950FC2076h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4E2B0C second address: 4E2B35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F0950EB8E46h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jl 00007F0950EB8E6Dh 0x00000013 jmp 00007F0950EB8E4Eh 0x00000018 push eax 0x00000019 push edx 0x0000001a jng 00007F0950EB8E46h 0x00000020 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4E2C64 second address: 4E2C69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4E2C69 second address: 4E2C93 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E58h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4E2C93 second address: 4E2CA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 js 00007F0950FC2076h 0x0000000e jg 00007F0950FC2076h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4E2F3D second address: 4E2F41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4E2F41 second address: 4E2F78 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F0950FC2085h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 push edx 0x00000012 pop edx 0x00000013 jmp 00007F0950FC207Fh 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b push edx 0x0000001c pop edx 0x0000001d rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4E2F78 second address: 4E2F82 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0950EB8E46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4E2F82 second address: 4E2F88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4E2F88 second address: 4E2F8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4E37FB second address: 4E3801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4E3AE7 second address: 4E3AED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4E3AED second address: 4E3B02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0950FC2080h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4E3B02 second address: 4E3B07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4E3B07 second address: 4E3B10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4E3B10 second address: 4E3B1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0950EB8E46h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4B5778 second address: 4B5795 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0950FC2081h 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4B5795 second address: 4B57BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0950EB8E50h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F0950EB8E4Fh 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4B57BE second address: 4B57CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4E4336 second address: 4E4348 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0950EB8E46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jno 00007F0950EB8E48h 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4E4348 second address: 4E434E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4E4496 second address: 4E449A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4B21F8 second address: 4B21FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4EFA44 second address: 4EFA48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4EFA48 second address: 4EFA68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0950FC2085h 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4EFC20 second address: 4EFC24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4EFC24 second address: 4EFC2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4EFC2A second address: 4EFC2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F0044 second address: 4F0070 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC207Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007F0950FC208Eh 0x0000000f push edx 0x00000010 pop edx 0x00000011 jmp 00007F0950FC2086h 0x00000016 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F0070 second address: 4F0076 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F01F4 second address: 4F0206 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F0950FC2078h 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F0206 second address: 4F021C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F0950EB8E4Eh 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F021C second address: 4F0226 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F0950FC2076h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F0226 second address: 4F022A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F247E second address: 4F24A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F0950FC2089h 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d push ebx 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F2632 second address: 4F263A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F263A second address: 4F263E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F263E second address: 4F264B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F264B second address: 4F264F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F2AF9 second address: 4F2B0A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0950EB8E48h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F2B0A second address: 4F2B10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F2B10 second address: 4F2B1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F2C85 second address: 4F2CAA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC207Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0950FC2080h 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F31D1 second address: 4F31FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], ebx 0x0000000d mov edi, esi 0x0000000f mov edi, dword ptr [ebp+12447145h] 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F0950EB8E4Fh 0x0000001f rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F31FA second address: 4F320C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC207Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F33C8 second address: 4F33CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F4BA1 second address: 4F4BA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F4BA5 second address: 4F4BD9 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0950EB8E46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jmp 00007F0950EB8E57h 0x00000010 pop esi 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F0950EB8E4Eh 0x00000019 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F4BD9 second address: 4F4BDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F4BDF second address: 4F4BF5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F0950EB8E4Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F525C second address: 4F5262 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F5262 second address: 4F5267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F83FD second address: 4F8402 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F65D7 second address: 4F65DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F973F second address: 4F9743 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F9743 second address: 4F9747 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4FA202 second address: 4FA206 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4FACD6 second address: 4FACDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4FA206 second address: 4FA21B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC207Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4FB8D0 second address: 4FB8D5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4B8EB1 second address: 4B8EB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4B8EB7 second address: 4B8EBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 50287C second address: 502881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 502881 second address: 50288B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0950EB8E4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5036CC second address: 5036E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0950FC207Ah 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5029E2 second address: 5029E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5036E1 second address: 503748 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC207Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a call 00007F0950FC2086h 0x0000000f call 00007F0950FC207Bh 0x00000014 mov ebx, dword ptr [ebp+122D392Eh] 0x0000001a pop edi 0x0000001b pop edi 0x0000001c push 00000000h 0x0000001e add bx, 49E2h 0x00000023 push 00000000h 0x00000025 jmp 00007F0950FC2087h 0x0000002a push eax 0x0000002b push edi 0x0000002c jc 00007F0950FC207Ch 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5029E6 second address: 5029EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 50391A second address: 503920 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 503920 second address: 503947 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007F0950EB8E5Ch 0x00000011 jmp 00007F0950EB8E56h 0x00000016 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 504979 second address: 50497F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 505810 second address: 505814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 50497F second address: 504984 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 50779B second address: 50779F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 50779F second address: 50781E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0950FC2082h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f mov di, dx 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F0950FC2078h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 00000016h 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e xor dword ptr [ebp+122D1AEEh], edi 0x00000034 mov edi, dword ptr [ebp+122D39DAh] 0x0000003a push 00000000h 0x0000003c mov ebx, dword ptr [ebp+122D3902h] 0x00000042 jmp 00007F0950FC207Dh 0x00000047 xchg eax, esi 0x00000048 jmp 00007F0950FC2089h 0x0000004d push eax 0x0000004e push eax 0x0000004f pushad 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 509715 second address: 509732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0950EB8E58h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 509732 second address: 509797 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC207Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007F0950FC2083h 0x0000000f xor edi, 6C866231h 0x00000015 push 00000000h 0x00000017 mov ebx, edi 0x00000019 push 00000000h 0x0000001b mov bx, ax 0x0000001e xchg eax, esi 0x0000001f push edi 0x00000020 push edi 0x00000021 jmp 00007F0950FC207Bh 0x00000026 pop edi 0x00000027 pop edi 0x00000028 push eax 0x00000029 pushad 0x0000002a jnl 00007F0950FC208Dh 0x00000030 push eax 0x00000031 push edx 0x00000032 push edx 0x00000033 pop edx 0x00000034 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 50890B second address: 508910 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 508910 second address: 508932 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0950FC2087h 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 508932 second address: 50893D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F0950EB8E46h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 50A772 second address: 50A78B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F0950FC2076h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007F0950FC207Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 50A78B second address: 50A78F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5098F4 second address: 5098F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 50A78F second address: 50A799 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F0950EB8E46h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 50A799 second address: 50A7EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jc 00007F0950FC207Bh 0x0000000f mov edi, 46575ED7h 0x00000014 push 00000000h 0x00000016 pushad 0x00000017 adc di, DC67h 0x0000001c jns 00007F0950FC2076h 0x00000022 popad 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push ebx 0x00000028 call 00007F0950FC2078h 0x0000002d pop ebx 0x0000002e mov dword ptr [esp+04h], ebx 0x00000032 add dword ptr [esp+04h], 0000001Bh 0x0000003a inc ebx 0x0000003b push ebx 0x0000003c ret 0x0000003d pop ebx 0x0000003e ret 0x0000003f mov dword ptr [ebp+12448D69h], edi 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 50A7EE second address: 50A7F8 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0950EB8E46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 50B5DB second address: 50B5DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 50B5DF second address: 50B5E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 50B5E3 second address: 50B60F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007F0950FC2086h 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 jo 00007F0950FC2080h 0x00000017 push eax 0x00000018 push edx 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 50D4D7 second address: 50D4DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 50D4DB second address: 50D4E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 50F5F9 second address: 50F607 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007F0950EB8E46h 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 50F607 second address: 50F60B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 50E851 second address: 50E857 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5197C5 second address: 5197D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F0950FC2076h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5197D1 second address: 5197D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 51993B second address: 519950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007F0950FC2076h 0x0000000c popad 0x0000000d pushad 0x0000000e push esi 0x0000000f pop esi 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 519950 second address: 519956 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 519956 second address: 519960 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 519960 second address: 519964 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 519C20 second address: 519C28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 51FCB4 second address: 51FCB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 51FCB8 second address: 51FCBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 51FCBC second address: 51FCF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jne 00007F0950EB8E54h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F0950EB8E58h 0x0000001a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 51FCF7 second address: 51FD13 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0950FC2076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e jmp 00007F0950FC207Ah 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 51FE1A second address: 51FE1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 51FE1F second address: 51FE5E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0950FC207Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b js 00007F0950FC208Ch 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jbe 00007F0950FC2096h 0x0000001b push eax 0x0000001c push edx 0x0000001d je 00007F0950FC2076h 0x00000023 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 51FE5E second address: 51FE82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e jnc 00007F0950EB8E46h 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 51FFFF second address: 520017 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jno 00007F0950FC2076h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 jne 00007F0950FC2076h 0x00000018 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 520017 second address: 52001B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 52001B second address: 52002E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 push esi 0x00000011 pop esi 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 52002E second address: 520064 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E53h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F0950EB8E56h 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 524FEE second address: 524FF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5242D4 second address: 5242E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 ja 00007F0950EB8E4Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5242E3 second address: 5242ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5242ED second address: 5242F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5249C2 second address: 5249C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5249C8 second address: 5249FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 js 00007F0950EB8E46h 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F0950EB8E4Eh 0x00000013 popad 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 je 00007F0950EB8E46h 0x0000001d jmp 00007F0950EB8E4Fh 0x00000022 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5249FD second address: 524A2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC2085h 0x00000007 jmp 00007F0950FC2080h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 524A2A second address: 524A34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F0950EB8E46h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 52A95C second address: 52A965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 52A965 second address: 52A981 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E50h 0x00000007 jo 00007F0950EB8E4Eh 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 52A981 second address: 52A99D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 jmp 00007F0950FC2080h 0x0000000e pushad 0x0000000f popad 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 52A99D second address: 52A9A2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 52AAFD second address: 52AB22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC2087h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnp 00007F0950FC207Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 52AB22 second address: 52AB28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 52AB28 second address: 52AB3D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 pop eax 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0950FC207Bh 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 52AB3D second address: 52AB41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 52AF54 second address: 52AF5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 52AF5C second address: 52AF66 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0950EB8E46h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 52B0C2 second address: 52B0F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC2081h 0x00000007 jmp 00007F0950FC207Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F0950FC2086h 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 52B0F8 second address: 52B10D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0950EB8E4Eh 0x00000008 push esi 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 52B3A1 second address: 52B3A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 52CE59 second address: 52CE78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F0950EB8E52h 0x0000000d pop edx 0x0000000e pushad 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 52CE78 second address: 52CE98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0950FC2088h 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 531776 second address: 531798 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F0950EB8E4Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F0950EB8E4Eh 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 531798 second address: 5317A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F0950FC2076h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5317A2 second address: 5317A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5317A6 second address: 5317B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5317B1 second address: 5317F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0950EB8E57h 0x00000009 jl 00007F0950EB8E46h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F0950EB8E55h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5317F0 second address: 5317F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5317F4 second address: 531829 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E4Fh 0x00000007 jmp 00007F0950EB8E52h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F0950EB8E50h 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 531829 second address: 531854 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0950FC207Eh 0x00000008 pushad 0x00000009 jl 00007F0950FC2076h 0x0000000f jnp 00007F0950FC2076h 0x00000015 jmp 00007F0950FC207Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 53065B second address: 53065F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 53065F second address: 53066B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 53066B second address: 53066F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 53066F second address: 530683 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F0950FC2076h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F0950FC2076h 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 530683 second address: 530687 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F0D0B second address: 4F0D0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F0E03 second address: 4F0E28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F0950EB8E57h 0x00000010 push edx 0x00000011 pop edx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F0E28 second address: 4F0E2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F0F2C second address: 4F0F30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F13CC second address: 34EC2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov dword ptr [esp], eax 0x00000009 mov edi, edx 0x0000000b push dword ptr [ebp+122D13D1h] 0x00000011 jmp 00007F0950FC2080h 0x00000016 call dword ptr [ebp+122D1BA9h] 0x0000001c pushad 0x0000001d pushad 0x0000001e cld 0x0000001f mov cx, dx 0x00000022 popad 0x00000023 xor eax, eax 0x00000025 jmp 00007F0950FC207Dh 0x0000002a mov edx, dword ptr [esp+28h] 0x0000002e cld 0x0000002f mov dword ptr [ebp+122D3936h], eax 0x00000035 add dword ptr [ebp+122D18E6h], edi 0x0000003b mov esi, 0000003Ch 0x00000040 mov dword ptr [ebp+122D1A41h], ebx 0x00000046 add esi, dword ptr [esp+24h] 0x0000004a jmp 00007F0950FC2085h 0x0000004f stc 0x00000050 lodsw 0x00000052 jmp 00007F0950FC2086h 0x00000057 add eax, dword ptr [esp+24h] 0x0000005b mov dword ptr [ebp+122D1A09h], ebx 0x00000061 mov ebx, dword ptr [esp+24h] 0x00000065 mov dword ptr [ebp+122D1962h], eax 0x0000006b nop 0x0000006c jmp 00007F0950FC2087h 0x00000071 push eax 0x00000072 push eax 0x00000073 push edx 0x00000074 push eax 0x00000075 push edx 0x00000076 jmp 00007F0950FC207Dh 0x0000007b rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F1542 second address: 4F1558 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E4Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F1558 second address: 4F155C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F15F0 second address: 4F15F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F15F6 second address: 4F1642 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0950FC2076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F0950FC2084h 0x00000012 xchg eax, esi 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F0950FC2078h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 00000017h 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d mov di, F8E6h 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 push edx 0x00000037 pop edx 0x00000038 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F1642 second address: 4F164C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0950EB8E46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F176E second address: 4F1780 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC207Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F1849 second address: 4F184D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F184D second address: 4F1869 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC2088h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F195B second address: 4F1965 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F0950EB8E46h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F1939 second address: 4F195B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F0950FC2089h 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F1CAB second address: 4F1D2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0950EB8E46h 0x0000000a popad 0x0000000b pop ebx 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F0950EB8E4Bh 0x00000013 jnc 00007F0950EB8E4Ch 0x00000019 popad 0x0000001a nop 0x0000001b push 00000000h 0x0000001d push eax 0x0000001e call 00007F0950EB8E48h 0x00000023 pop eax 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 add dword ptr [esp+04h], 00000014h 0x00000030 inc eax 0x00000031 push eax 0x00000032 ret 0x00000033 pop eax 0x00000034 ret 0x00000035 and edi, 4A5FFD51h 0x0000003b push 0000001Eh 0x0000003d push 00000000h 0x0000003f push ebx 0x00000040 call 00007F0950EB8E48h 0x00000045 pop ebx 0x00000046 mov dword ptr [esp+04h], ebx 0x0000004a add dword ptr [esp+04h], 00000019h 0x00000052 inc ebx 0x00000053 push ebx 0x00000054 ret 0x00000055 pop ebx 0x00000056 ret 0x00000057 sbb dh, FFFFFFC2h 0x0000005a xor edx, 326207A1h 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 pushad 0x00000065 popad 0x00000066 jnp 00007F0950EB8E46h 0x0000006c popad 0x0000006d rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F2074 second address: 4F2078 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F2078 second address: 4F20E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E4Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F0950EB8E4Fh 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 mov edx, dword ptr [ebp+122D1AEEh] 0x00000018 lea eax, dword ptr [ebp+12475ACBh] 0x0000001e push 00000000h 0x00000020 push edx 0x00000021 call 00007F0950EB8E48h 0x00000026 pop edx 0x00000027 mov dword ptr [esp+04h], edx 0x0000002b add dword ptr [esp+04h], 00000017h 0x00000033 inc edx 0x00000034 push edx 0x00000035 ret 0x00000036 pop edx 0x00000037 ret 0x00000038 and edi, dword ptr [ebp+122D18FFh] 0x0000003e nop 0x0000003f pushad 0x00000040 jmp 00007F0950EB8E50h 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4F20E3 second address: 4DB328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 jnp 00007F0950FC208Dh 0x0000000d nop 0x0000000e je 00007F0950FC2078h 0x00000014 mov dh, 48h 0x00000016 lea eax, dword ptr [ebp+12475A87h] 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007F0950FC2078h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 00000014h 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 sub edx, dword ptr [ebp+122D3AE6h] 0x0000003c push eax 0x0000003d jnp 00007F0950FC207Ah 0x00000043 mov dword ptr [esp], eax 0x00000046 jnp 00007F0950FC207Ah 0x0000004c call dword ptr [ebp+12455757h] 0x00000052 js 00007F0950FC20A8h 0x00000058 push esi 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4DB328 second address: 4DB32E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4DB32E second address: 4DB338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 530959 second address: 530966 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0950EB8E46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 530B03 second address: 530B0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F0950FC2076h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 530EE1 second address: 530EEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F0950EB8E46h 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 530EEC second address: 530EF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 je 00007F0950FC2076h 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 531165 second address: 531170 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F0950EB8E46h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5312EC second address: 5312F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 535A68 second address: 535A8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E4Fh 0x00000007 jmp 00007F0950EB8E50h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 53B8B7 second address: 53B8BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 53B8BC second address: 53B8C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 53B8C2 second address: 53B8C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4AD14F second address: 4AD160 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F0950EB8E4Bh 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 53A488 second address: 53A48E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 53A876 second address: 53A87A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 53A87A second address: 53A880 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 53A880 second address: 53A886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 53A886 second address: 53A8A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC2088h 0x00000007 jp 00007F0950FC2082h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 53A8A8 second address: 53A8AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 53AB5D second address: 53AB63 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 53B114 second address: 53B11A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 53B262 second address: 53B282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0950FC2089h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 53B6B0 second address: 53B6C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007F0950EB8E46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 53B6C0 second address: 53B6DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC2089h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 53B6DD second address: 53B6E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push ecx 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 53B6E8 second address: 53B6EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 53B6EE second address: 53B6F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 53A070 second address: 53A084 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 jo 00007F0950FC2082h 0x0000000c jc 00007F0950FC2076h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 541566 second address: 54156C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 54156C second address: 541570 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5416E4 second address: 5416E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5416E9 second address: 5416EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5416EF second address: 541712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0950EB8E54h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007F0950EB8E46h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 54199E second address: 5419A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 54585C second address: 545862 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 545862 second address: 545866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 545866 second address: 545877 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F0950EB8E46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 54AD03 second address: 54AD07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 54AD07 second address: 54AD19 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0950EB8E46h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 54AFC2 second address: 54AFD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F0950FC2076h 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 54AFD3 second address: 54AFD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 54AFD7 second address: 54AFDD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 54AFDD second address: 54AFFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a jno 00007F0950EB8E46h 0x00000010 jmp 00007F0950EB8E51h 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 54B51A second address: 54B522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 54B522 second address: 54B530 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jns 00007F0950EB8E46h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 54B530 second address: 54B562 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0950FC2081h 0x00000009 popad 0x0000000a push ecx 0x0000000b jmp 00007F0950FC2089h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 54B68B second address: 54B690 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 54C00F second address: 54C020 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC207Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 54FD8C second address: 54FD9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 54FD9A second address: 54FDB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0950FC2089h 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 550087 second address: 550095 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F0950EB8E4Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 550095 second address: 55009F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 55009F second address: 5500A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5500A8 second address: 5500C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC2086h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5500C2 second address: 5500CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F0950EB8E46h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5500CC second address: 5500E4 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0950FC2076h 0x00000008 jno 00007F0950FC2076h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jno 00007F0950FC2076h 0x00000018 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 554499 second address: 5544B1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F0950EB8E50h 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 553D40 second address: 553D5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F0950FC2083h 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 553ECA second address: 553ED6 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0950EB8E46h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 553ED6 second address: 553EEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jng 00007F0950FC2076h 0x0000000b popad 0x0000000c je 00007F0950FC2082h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 553EEA second address: 553EF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 553EF0 second address: 553F08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0950FC207Eh 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 553F08 second address: 553F22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F0950EB8E52h 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 55B1C2 second address: 55B1C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 55B1C6 second address: 55B1FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F0950EB8E46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jno 00007F0950EB8E46h 0x00000016 js 00007F0950EB8E46h 0x0000001c jmp 00007F0950EB8E58h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 55C53A second address: 55C540 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 55C540 second address: 55C546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 55CA9D second address: 55CAAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F0950FC2076h 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 55CAAB second address: 55CAD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E58h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007F0950EB8E48h 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 55CAD5 second address: 55CAE3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC207Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 55CAE3 second address: 55CB12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F0950EB8E5Ch 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f jg 00007F0950EB8E46h 0x00000015 pop ecx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 55CB12 second address: 55CB1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 561A53 second address: 561A8A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0950EB8E4Eh 0x00000008 push eax 0x00000009 pushad 0x0000000a popad 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F0950EB8E51h 0x00000015 push ebx 0x00000016 ja 00007F0950EB8E46h 0x0000001c jnp 00007F0950EB8E46h 0x00000022 pop ebx 0x00000023 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 565BC6 second address: 565BE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC2088h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 565BE2 second address: 565BFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007F0950EB8E46h 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F0950EB8E4Ah 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 565BFD second address: 565C02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 565C02 second address: 565C09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 565C09 second address: 565C14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 565C14 second address: 565C1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 565C1A second address: 565C1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 565C1E second address: 565C22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 564CDD second address: 564CEE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jne 00007F0950FC2076h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 565171 second address: 5651AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E4Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007F0950EB8E58h 0x0000000f ja 00007F0950EB8E4Ch 0x00000015 push esi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 56562F second address: 565647 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0950FC2084h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 565647 second address: 56564D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5658D1 second address: 5658D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5658D7 second address: 5658E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 570106 second address: 570123 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007F0950FC2076h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0950FC207Eh 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 570123 second address: 570136 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0950EB8E46h 0x00000008 jno 00007F0950EB8E46h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 570136 second address: 57013C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 56E283 second address: 56E2B4 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0950EB8E4Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jbe 00007F0950EB8E4Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F0950EB8E50h 0x00000018 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 56E2B4 second address: 56E2BE instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0950FC2076h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 56E9C1 second address: 56E9E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E50h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jno 00007F0950EB8E4Ah 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 56ECBB second address: 56ECDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0950FC2087h 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 56ECDA second address: 56ECDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 56ECDE second address: 56ECFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F0950FC2083h 0x0000000e push ebx 0x0000000f pushad 0x00000010 popad 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 56ECFE second address: 56ED08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F0950EB8E46h 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 56EE5A second address: 56EE5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 56EE5F second address: 56EE72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b jc 00007F0950EB8E46h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 56EE72 second address: 56EE82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 56EE82 second address: 56EE8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 56EE8A second address: 56EE8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 56F151 second address: 56F15F instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0950EB8E46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 56DE0C second address: 56DE1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push esi 0x00000006 ja 00007F0950FC2076h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 56DE1A second address: 56DE26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 56DE26 second address: 56DE2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 56DE2A second address: 56DE32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 56DE32 second address: 56DE55 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0950FC208Eh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 56DE55 second address: 56DE5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 56DE5D second address: 56DE63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 576DBA second address: 576DBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 583A87 second address: 583A98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 583729 second address: 583790 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F0950EB8E46h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F0950EB8E54h 0x00000011 jmp 00007F0950EB8E4Ch 0x00000016 popad 0x00000017 js 00007F0950EB8E8Fh 0x0000001d jg 00007F0950EB8E60h 0x00000023 pushad 0x00000024 popad 0x00000025 jmp 00007F0950EB8E58h 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F0950EB8E52h 0x00000031 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 596EF5 second address: 596F14 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jnl 00007F0950FC2076h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F0950FC207Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 596F14 second address: 596F18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 596F18 second address: 596F38 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0950FC2076h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F0950FC207Ah 0x00000013 push eax 0x00000014 push edx 0x00000015 jc 00007F0950FC2076h 0x0000001b rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 596F38 second address: 596F3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 596F3C second address: 596F46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 596F46 second address: 596F55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E4Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 59EBCC second address: 59EBFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC2086h 0x00000007 jmp 00007F0950FC207Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 59D42D second address: 59D43F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 je 00007F0950EB8E48h 0x0000000b push ebx 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 59D6F8 second address: 59D72F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0950FC2088h 0x00000008 jmp 00007F0950FC2085h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 59D72F second address: 59D733 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 59D901 second address: 59D922 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC2085h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jno 00007F0950FC2076h 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 59D922 second address: 59D932 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E4Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 59D932 second address: 59D938 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 59DC30 second address: 59DC46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0950EB8E50h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 59DDE5 second address: 59DDEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5A67BE second address: 5A67C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5A67C2 second address: 5A67E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0950FC2086h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5A67E1 second address: 5A67F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0950EB8E4Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5ADC22 second address: 5ADC36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC207Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5ADC36 second address: 5ADC3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5ADABC second address: 5ADAC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5B2270 second address: 5B2276 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5B2144 second address: 5B2148 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5B2148 second address: 5B2157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 je 00007F0950EB8E46h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5B7A8A second address: 5B7A92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5B7A92 second address: 5B7A9C instructions: 0x00000000 rdtsc 0x00000002 js 00007F0950EB8E46h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5B7A9C second address: 5B7AD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F0950FC2078h 0x0000000c push edx 0x0000000d pop edx 0x0000000e jmp 00007F0950FC207Fh 0x00000013 popad 0x00000014 push esi 0x00000015 pushad 0x00000016 jmp 00007F0950FC2085h 0x0000001b push esi 0x0000001c pop esi 0x0000001d popad 0x0000001e push esi 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5E0B02 second address: 5E0B24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0950EB8E46h 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0950EB8E55h 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5E0B24 second address: 5E0B41 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0950FC2076h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d jmp 00007F0950FC207Ch 0x00000012 pop ecx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5E0F80 second address: 5E0F88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5E10F4 second address: 5E10F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5E1859 second address: 5E187E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0950EB8E48h 0x00000008 pushad 0x00000009 jmp 00007F0950EB8E58h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5E187E second address: 5E1884 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5E1884 second address: 5E188A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5E1A11 second address: 5E1A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5E5D83 second address: 5E5D88 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5E5D88 second address: 5E5D99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F0950FC2076h 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5E636D second address: 5E6377 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5E6377 second address: 5E63E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a pushad 0x0000000b mov dword ptr [ebp+122D19F9h], ecx 0x00000011 call 00007F0950FC2087h 0x00000016 mov esi, dword ptr [ebp+122D20DFh] 0x0000001c pop edx 0x0000001d popad 0x0000001e push dword ptr [ebp+122D1B32h] 0x00000024 ja 00007F0950FC208Eh 0x0000002a call 00007F0950FC2086h 0x0000002f stc 0x00000030 pop edx 0x00000031 push E258888Fh 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F0950FC207Eh 0x0000003d rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5E7ABF second address: 5E7AD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F0950EB8E4Ch 0x0000000c rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5E7AD1 second address: 5E7AD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5E7AD9 second address: 5E7AF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E57h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5E9AEF second address: 5E9AF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 5E9AF3 second address: 5E9B05 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0950EB8E46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F0950EB8E46h 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C80EBB second address: 4C80EC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C80EC1 second address: 4C80EDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0950EB8E59h 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C80EDE second address: 4C80EFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC2081h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C80EFC second address: 4C80F0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E4Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C80F0F second address: 4C80F1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ax, di 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C5008E second address: 4C50094 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C50094 second address: 4C50166 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, al 0x00000005 pushfd 0x00000006 jmp 00007F0950FC2089h 0x0000000b adc si, CBD6h 0x00000010 jmp 00007F0950FC2081h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a pushad 0x0000001b pushad 0x0000001c push eax 0x0000001d pop ebx 0x0000001e mov eax, 1EFC6255h 0x00000023 popad 0x00000024 pushfd 0x00000025 jmp 00007F0950FC2082h 0x0000002a or ax, F128h 0x0000002f jmp 00007F0950FC207Bh 0x00000034 popfd 0x00000035 popad 0x00000036 push eax 0x00000037 jmp 00007F0950FC2089h 0x0000003c xchg eax, ebp 0x0000003d pushad 0x0000003e push ecx 0x0000003f pushad 0x00000040 popad 0x00000041 pop edi 0x00000042 mov si, EC15h 0x00000046 popad 0x00000047 mov ebp, esp 0x00000049 jmp 00007F0950FC2080h 0x0000004e push dword ptr [ebp+04h] 0x00000051 jmp 00007F0950FC2080h 0x00000056 push dword ptr [ebp+0Ch] 0x00000059 jmp 00007F0950FC2080h 0x0000005e push dword ptr [ebp+08h] 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 push edi 0x00000065 pop esi 0x00000066 mov ax, dx 0x00000069 popad 0x0000006a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C708D6 second address: 4C708DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C708DA second address: 4C708E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C70537 second address: 4C70578 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F0950EB8E56h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F0950EB8E57h 0x00000018 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C7042B second address: 4C70431 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C70431 second address: 4C70440 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C70440 second address: 4C70444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C70444 second address: 4C70455 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E4Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C70455 second address: 4C7045B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C701E6 second address: 4C701EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C701EC second address: 4C701F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C70EC8 second address: 4C70EEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, bl 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F0950EB8E57h 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C70EEC second address: 4C70EF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C70EF0 second address: 4C70EF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C70EF6 second address: 4C70EFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C70EFC second address: 4C70F00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C70F00 second address: 4C70F04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CC0554 second address: 4CC0559 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CC0559 second address: 4CC056A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx edi, cx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CC056A second address: 4CC0570 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CC0570 second address: 4CC05DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0950FC2086h 0x00000009 jmp 00007F0950FC2085h 0x0000000e popfd 0x0000000f mov ch, 0Ch 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 jmp 00007F0950FC207Ah 0x0000001a xchg eax, ebp 0x0000001b jmp 00007F0950FC2080h 0x00000020 mov ebp, esp 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F0950FC2087h 0x00000029 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CC05DC second address: 4CC05E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C90327 second address: 4C90344 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC2089h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C90344 second address: 4C903BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0950EB8E57h 0x00000008 movzx ecx, dx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e and dword ptr [eax], 00000000h 0x00000011 pushad 0x00000012 push edi 0x00000013 push eax 0x00000014 pop edi 0x00000015 pop eax 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F0950EB8E4Fh 0x0000001d sbb si, A17Eh 0x00000022 jmp 00007F0950EB8E59h 0x00000027 popfd 0x00000028 popad 0x00000029 popad 0x0000002a and dword ptr [eax+04h], 00000000h 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F0950EB8E58h 0x00000035 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C70306 second address: 4C7030C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C7030C second address: 4C70312 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C70312 second address: 4C7034A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC2088h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0950FC2087h 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C80DD2 second address: 4C80DD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C80DD6 second address: 4C80DDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C80DDC second address: 4C80E0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f call 00007F0950EB8E53h 0x00000014 pop ecx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C80E0F second address: 4C80E3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC2086h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0950FC207Eh 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C80E3A second address: 4C80E70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F0950EB8E56h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F0950EB8E4Ah 0x0000001a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C80E70 second address: 4C80E76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C80E76 second address: 4C80E88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F0950EB8E4Ch 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C900C6 second address: 4C900CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C900CA second address: 4C900D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C900D0 second address: 4C900FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC207Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0950FC2087h 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C900FC second address: 4C90101 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C90101 second address: 4C90141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ax, di 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c mov ax, B393h 0x00000010 pushfd 0x00000011 jmp 00007F0950FC2088h 0x00000016 add ah, 00000018h 0x00000019 jmp 00007F0950FC207Bh 0x0000001e popfd 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C90141 second address: 4C9015C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E57h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CB0676 second address: 4CB06FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 34C2h 0x00000007 pushfd 0x00000008 jmp 00007F0950FC2083h 0x0000000d add eax, 334A23BEh 0x00000013 jmp 00007F0950FC2089h 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ebp 0x0000001d pushad 0x0000001e mov edx, ecx 0x00000020 mov dh, ch 0x00000022 popad 0x00000023 push eax 0x00000024 jmp 00007F0950FC2082h 0x00000029 xchg eax, ebp 0x0000002a jmp 00007F0950FC2080h 0x0000002f mov ebp, esp 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F0950FC2087h 0x00000038 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CB06FA second address: 4CB0700 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CB0700 second address: 4CB073A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC207Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c jmp 00007F0950FC2086h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F0950FC207Dh 0x0000001b rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CB073A second address: 4CB073E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CB073E second address: 4CB0744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CB0744 second address: 4CB074A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CB074A second address: 4CB074E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CB074E second address: 4CB0775 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007F0950EB8E57h 0x00000011 pop eax 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CB0775 second address: 4CB080E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0950FC2082h 0x00000009 or esi, 5155BFC8h 0x0000000f jmp 00007F0950FC207Bh 0x00000014 popfd 0x00000015 movzx eax, bx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov eax, dword ptr [76FA65FCh] 0x00000020 pushad 0x00000021 jmp 00007F0950FC2081h 0x00000026 pushfd 0x00000027 jmp 00007F0950FC2080h 0x0000002c and ch, 00000058h 0x0000002f jmp 00007F0950FC207Bh 0x00000034 popfd 0x00000035 popad 0x00000036 test eax, eax 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b pushfd 0x0000003c jmp 00007F0950FC207Bh 0x00000041 xor ch, 0000001Eh 0x00000044 jmp 00007F0950FC2089h 0x00000049 popfd 0x0000004a mov cx, 79E7h 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CB080E second address: 4CB083B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop edi 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F09C312BF96h 0x0000000e pushad 0x0000000f mov cl, 7Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 call 00007F0950EB8E59h 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CB083B second address: 4CB083F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CB083F second address: 4CB0878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ecx, eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F0950EB8E56h 0x00000012 sub ax, 4ED8h 0x00000017 jmp 00007F0950EB8E4Bh 0x0000001c popfd 0x0000001d mov si, B18Fh 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CB0878 second address: 4CB087F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, 37h 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CB087F second address: 4CB08DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xor eax, dword ptr [ebp+08h] 0x0000000a jmp 00007F0950EB8E59h 0x0000000f and ecx, 1Fh 0x00000012 pushad 0x00000013 movzx esi, dx 0x00000016 mov cl, bl 0x00000018 popad 0x00000019 ror eax, cl 0x0000001b jmp 00007F0950EB8E50h 0x00000020 leave 0x00000021 jmp 00007F0950EB8E50h 0x00000026 retn 0004h 0x00000029 nop 0x0000002a mov esi, eax 0x0000002c lea eax, dword ptr [ebp-08h] 0x0000002f xor esi, dword ptr [00342014h] 0x00000035 push eax 0x00000036 push eax 0x00000037 push eax 0x00000038 lea eax, dword ptr [ebp-10h] 0x0000003b push eax 0x0000003c call 00007F0955869728h 0x00000041 push FFFFFFFEh 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CB08DA second address: 4CB08DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CB08DE second address: 4CB08E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CB08E4 second address: 4CB090B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC2084h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F0950FC207Ah 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CB090B second address: 4CB091A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CB091A second address: 4CB0992 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0950FC207Fh 0x00000008 mov bh, cl 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d ret 0x0000000e nop 0x0000000f push eax 0x00000010 call 00007F09559729B1h 0x00000015 mov edi, edi 0x00000017 pushad 0x00000018 jmp 00007F0950FC2081h 0x0000001d pushfd 0x0000001e jmp 00007F0950FC2080h 0x00000023 sub esi, 07973C48h 0x00000029 jmp 00007F0950FC207Bh 0x0000002e popfd 0x0000002f popad 0x00000030 xchg eax, ebp 0x00000031 pushad 0x00000032 mov bx, ax 0x00000035 push eax 0x00000036 push edx 0x00000037 pushfd 0x00000038 jmp 00007F0950FC207Eh 0x0000003d and esi, 75067EA8h 0x00000043 jmp 00007F0950FC207Bh 0x00000048 popfd 0x00000049 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CB0992 second address: 4CB09A8 instructions: 0x00000000 rdtsc 0x00000002 mov cx, F19Fh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a pushad 0x0000000b push edi 0x0000000c mov ebx, ecx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 mov edx, 1E427F1Ch 0x00000016 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CB09A8 second address: 4CB0A40 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F0950FC2085h 0x00000008 sbb si, E976h 0x0000000d jmp 00007F0950FC2081h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 xchg eax, ebp 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F0950FC207Ch 0x0000001e add ax, 2698h 0x00000023 jmp 00007F0950FC207Bh 0x00000028 popfd 0x00000029 jmp 00007F0950FC2088h 0x0000002e popad 0x0000002f mov ebp, esp 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 pushfd 0x00000035 jmp 00007F0950FC207Dh 0x0000003a sub ah, FFFFFFE6h 0x0000003d jmp 00007F0950FC2081h 0x00000042 popfd 0x00000043 mov cx, 6D17h 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CB0A40 second address: 4CB0A46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CB0A46 second address: 4CB0A4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C60008 second address: 4C6000E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C6000E second address: 4C60014 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C60014 second address: 4C60018 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C60018 second address: 4C6001C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C6001C second address: 4C6002F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov bx, E98Ah 0x00000010 mov bh, 14h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C6002F second address: 4C60035 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C60035 second address: 4C60039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C60039 second address: 4C6008B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a call 00007F0950FC2080h 0x0000000f mov dh, ch 0x00000011 pop ebx 0x00000012 pushfd 0x00000013 jmp 00007F0950FC207Ch 0x00000018 sub ah, FFFFFFA8h 0x0000001b jmp 00007F0950FC207Bh 0x00000020 popfd 0x00000021 popad 0x00000022 xchg eax, ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F0950FC2085h 0x0000002a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C6008B second address: 4C60091 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C60091 second address: 4C60095 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C60095 second address: 4C60114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b push edi 0x0000000c pushfd 0x0000000d jmp 00007F0950EB8E50h 0x00000012 sub al, 00000068h 0x00000015 jmp 00007F0950EB8E4Bh 0x0000001a popfd 0x0000001b pop esi 0x0000001c mov ecx, edx 0x0000001e popad 0x0000001f and esp, FFFFFFF8h 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007F0950EB8E51h 0x00000029 and cx, 4486h 0x0000002e jmp 00007F0950EB8E51h 0x00000033 popfd 0x00000034 mov esi, 2EEFFA37h 0x00000039 popad 0x0000003a xchg eax, ecx 0x0000003b jmp 00007F0950EB8E4Ah 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 jmp 00007F0950EB8E4Eh 0x00000048 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C60114 second address: 4C6017E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F0950FC2081h 0x00000008 pop eax 0x00000009 call 00007F0950FC2081h 0x0000000e pop esi 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 xchg eax, ecx 0x00000013 jmp 00007F0950FC2087h 0x00000018 xchg eax, ebx 0x00000019 jmp 00007F0950FC2086h 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F0950FC207Eh 0x00000026 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C6017E second address: 4C601AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F0950EB8E56h 0x0000000f mov ebx, dword ptr [ebp+10h] 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov ecx, edx 0x00000017 mov esi, ebx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C601AF second address: 4C601F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov edx, esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, esi 0x0000000b jmp 00007F0950FC2088h 0x00000010 push eax 0x00000011 pushad 0x00000012 mov si, bx 0x00000015 mov ebx, 7D8BC180h 0x0000001a popad 0x0000001b xchg eax, esi 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F0950FC2082h 0x00000023 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C601F2 second address: 4C601F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C601F8 second address: 4C601FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C601FC second address: 4C60221 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E4Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F0950EB8E4Dh 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C60221 second address: 4C60226 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C60226 second address: 4C6028E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ecx 0x00000008 pushad 0x00000009 mov edi, eax 0x0000000b pushfd 0x0000000c jmp 00007F0950EB8E4Eh 0x00000011 adc ecx, 561FB488h 0x00000017 jmp 00007F0950EB8E4Bh 0x0000001c popfd 0x0000001d popad 0x0000001e mov dword ptr [esp], edi 0x00000021 jmp 00007F0950EB8E56h 0x00000026 test esi, esi 0x00000028 pushad 0x00000029 mov cl, 4Ch 0x0000002b movsx ebx, cx 0x0000002e popad 0x0000002f je 00007F09C31771E6h 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F0950EB8E51h 0x0000003c rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C6028E second address: 4C60308 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC2081h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 jmp 00007F0950FC207Eh 0x00000015 je 00007F09C32803E9h 0x0000001b jmp 00007F0950FC2080h 0x00000020 mov edx, dword ptr [esi+44h] 0x00000023 jmp 00007F0950FC2080h 0x00000028 or edx, dword ptr [ebp+0Ch] 0x0000002b jmp 00007F0950FC2080h 0x00000030 test edx, 61000000h 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F0950FC207Ah 0x0000003f rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C60308 second address: 4C60317 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C60317 second address: 4C6031D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C6031D second address: 4C60321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C60321 second address: 4C6033B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F09C32803D5h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F0950FC207Ah 0x00000015 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C6033B second address: 4C60341 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C60341 second address: 4C60345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C60345 second address: 4C60349 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C60349 second address: 4C60380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test byte ptr [esi+48h], 00000001h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F0950FC2082h 0x00000015 sub ch, 00000028h 0x00000018 jmp 00007F0950FC207Bh 0x0000001d popfd 0x0000001e mov ecx, 77E9AA1Fh 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C60380 second address: 4C60386 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C507A7 second address: 4C507B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0950FC207Eh 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C507B9 second address: 4C507CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0950EB8E4Ah 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C507CE second address: 4C50821 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 mov ax, di 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e pushad 0x0000000f mov cx, bx 0x00000012 mov eax, edx 0x00000014 popad 0x00000015 and esp, FFFFFFF8h 0x00000018 pushad 0x00000019 mov eax, edx 0x0000001b movsx ebx, cx 0x0000001e popad 0x0000001f xchg eax, ebx 0x00000020 jmp 00007F0950FC207Ch 0x00000025 push eax 0x00000026 pushad 0x00000027 mov bx, C174h 0x0000002b mov si, dx 0x0000002e popad 0x0000002f xchg eax, ebx 0x00000030 jmp 00007F0950FC207Fh 0x00000035 xchg eax, esi 0x00000036 pushad 0x00000037 push esi 0x00000038 mov edi, 0F7E51E6h 0x0000003d pop edx 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C50821 second address: 4C50833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 movsx edi, ax 0x0000000c mov ecx, 4EB507E9h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C50833 second address: 4C50867 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC207Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov edi, 7FA081F6h 0x00000012 jmp 00007F0950FC2087h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C50867 second address: 4C5088C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C5088C second address: 4C508D7 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F0950FC2088h 0x00000008 sbb ecx, 253CCCA8h 0x0000000e jmp 00007F0950FC207Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 mov ah, D7h 0x00000018 popad 0x00000019 mov ebx, 00000000h 0x0000001e pushad 0x0000001f mov cl, 3Dh 0x00000021 movsx edx, cx 0x00000024 popad 0x00000025 test esi, esi 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a mov edx, 44C7A352h 0x0000002f pushad 0x00000030 popad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C508D7 second address: 4C50940 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E56h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F09C317E8E3h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F0950EB8E4Dh 0x00000018 jmp 00007F0950EB8E4Bh 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007F0950EB8E58h 0x00000024 adc ecx, 18779EF8h 0x0000002a jmp 00007F0950EB8E4Bh 0x0000002f popfd 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C50940 second address: 4C5099D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 jmp 00007F0950FC2080h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e cmp dword ptr [esi+08h], DDEEDDEEh 0x00000015 jmp 00007F0950FC2080h 0x0000001a mov ecx, esi 0x0000001c jmp 00007F0950FC2080h 0x00000021 je 00007F09C3287A97h 0x00000027 pushad 0x00000028 mov eax, ebx 0x0000002a popad 0x0000002b test byte ptr [76FA6968h], 00000002h 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 mov ch, FDh 0x00000037 mov di, 0F00h 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C5099D second address: 4C509A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, dx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C509A5 second address: 4C509CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jne 00007F09C3287A80h 0x0000000d jmp 00007F0950FC207Dh 0x00000012 mov edx, dword ptr [ebp+0Ch] 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov edi, 0F1C52DEh 0x0000001d movsx ebx, si 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C509CE second address: 4C509D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C509D4 second address: 4C509D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C509D8 second address: 4C50A57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E53h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F0950EB8E54h 0x00000013 xor ecx, 178C1208h 0x00000019 jmp 00007F0950EB8E4Bh 0x0000001e popfd 0x0000001f jmp 00007F0950EB8E58h 0x00000024 popad 0x00000025 push eax 0x00000026 jmp 00007F0950EB8E4Bh 0x0000002b xchg eax, ebx 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F0950EB8E55h 0x00000033 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C50B43 second address: 4C50BB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0950FC2087h 0x00000009 sub cx, 454Eh 0x0000000e jmp 00007F0950FC2089h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F0950FC2080h 0x0000001a xor si, 59C8h 0x0000001f jmp 00007F0950FC207Bh 0x00000024 popfd 0x00000025 popad 0x00000026 pop edx 0x00000027 pop eax 0x00000028 pop ebx 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F0950FC2082h 0x00000031 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C50BB8 second address: 4C50BBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C60C17 second address: 4C60CC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC2081h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F0950FC207Ch 0x00000011 and eax, 383BC148h 0x00000017 jmp 00007F0950FC207Bh 0x0000001c popfd 0x0000001d mov edx, eax 0x0000001f popad 0x00000020 push eax 0x00000021 pushad 0x00000022 push edi 0x00000023 mov bl, ch 0x00000025 pop ebx 0x00000026 pushfd 0x00000027 jmp 00007F0950FC2088h 0x0000002c xor ch, FFFFFFD8h 0x0000002f jmp 00007F0950FC207Bh 0x00000034 popfd 0x00000035 popad 0x00000036 xchg eax, ebp 0x00000037 pushad 0x00000038 call 00007F0950FC2084h 0x0000003d pushfd 0x0000003e jmp 00007F0950FC2082h 0x00000043 sbb cl, 00000068h 0x00000046 jmp 00007F0950FC207Bh 0x0000004b popfd 0x0000004c pop eax 0x0000004d mov dx, F0ACh 0x00000051 popad 0x00000052 mov ebp, esp 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C60CC5 second address: 4C60CE1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E58h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C60CE1 second address: 4C60CE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CE0AD3 second address: 4CE0B0E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 pushfd 0x00000007 jmp 00007F0950EB8E4Dh 0x0000000c jmp 00007F0950EB8E4Bh 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F0950EB8E55h 0x0000001d rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CE0B0E second address: 4CE0B45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC2081h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F0950FC2081h 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F0950FC207Dh 0x00000017 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CE0B45 second address: 4CE0B62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CE0B62 second address: 4CE0B75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC207Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CE0B75 second address: 4CE0B7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CD0EBA second address: 4CD0ECC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0950FC207Eh 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CD0ECC second address: 4CD0EDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CD0EDC second address: 4CD0EE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CD0EE0 second address: 4CD0EE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CD0EE6 second address: 4CD0F00 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC207Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov bx, 2D86h 0x00000011 mov dl, 9Ch 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CD0DB1 second address: 4CD0DB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C60F1A second address: 4C60F1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C60F1E second address: 4C60F24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C60F24 second address: 4C60F37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0950FC207Fh 0x00000009 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C60F37 second address: 4C60F90 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950EB8E59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov cx, bx 0x00000014 pushfd 0x00000015 jmp 00007F0950EB8E4Fh 0x0000001a sub eax, 0EDA67BEh 0x00000020 jmp 00007F0950EB8E59h 0x00000025 popfd 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C60F90 second address: 4C60FAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC2081h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4C60FAD second address: 4C60FB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	RDTSC instruction interceptor: First address: 4CE0366 second address: 4CE03DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0950FC2087h 0x00000009 and esi, 7BD17A8Eh 0x0000000f jmp 00007F0950FC2089h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F0950FC2080h 0x0000001b and ax, 8508h 0x00000020 jmp 00007F0950FC207Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 pop ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F0950FC2085h 0x00000031 rdtsc
Source: C:\Users\userGCAFCAFHJJ.exe	RDTSC instruction interceptor: First address: 3CF1D2 second address: 3CF1D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userGCAFCAFHJJ.exe	RDTSC instruction interceptor: First address: 5501B4 second address: 5501C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 ja 00007F0950FC2076h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\userGCAFCAFHJJ.exe	RDTSC instruction interceptor: First address: 54F63D second address: 54F645 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\userGCAFCAFHJJ.exe	RDTSC instruction interceptor: First address: 54F7DA second address: 54F7E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userGCAFCAFHJJ.exe	RDTSC instruction interceptor: First address: 54F7E0 second address: 54F7E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\userGCAFCAFHJJ.exe	RDTSC instruction interceptor: First address: 54F7E6 second address: 54F7F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0950FC207Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\userGCAFCAFHJJ.exe	RDTSC instruction interceptor: First address: 54FAC0 second address: 54FAC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\userGCAFCAFHJJ.exe	RDTSC instruction interceptor: First address: 551458 second address: 55146B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0950FC207Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\userGCAFCAFHJJ.exe	RDTSC instruction interceptor: First address: 55146B second address: 551482 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0950EB8E53h 0x00000009 rdtsc
Source: C:\Users\userGCAFCAFHJJ.exe	RDTSC instruction interceptor: First address: 551482 second address: 5514C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F0950FC2089h 0x0000000e nop 0x0000000f jng 00007F0950FC2076h 0x00000015 push 00000000h 0x00000017 mov ecx, dword ptr [ebp+122D3925h] 0x0000001d mov dx, 5500h 0x00000021 push F761C4B2h 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 push esi 0x0000002a pop esi 0x0000002b push esi 0x0000002c pop esi 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\userGCAFCAFHJJ.exe	RDTSC instruction interceptor: First address: 5514C4 second address: 55156A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0950EB8E4Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 089E3BCEh 0x00000011 mov si, CE8Eh 0x00000015 push 00000003h 0x00000017 push 00000000h 0x00000019 cld 0x0000001a push 00000003h 0x0000001c jns 00007F0950EB8E62h 0x00000022 call 00007F0950EB8E49h 0x00000027 jmp 00007F0950EB8E4Fh 0x0000002c push eax 0x0000002d pushad 0x0000002e pushad 0x0000002f pushad 0x00000030 popad 0x00000031 jmp 00007F0950EB8E4Ch 0x00000036 popad 0x00000037 pushad 0x00000038 jmp 00007F0950EB8E4Bh 0x0000003d pushad 0x0000003e popad 0x0000003f popad 0x00000040 popad 0x00000041 mov eax, dword ptr [esp+04h] 0x00000045 jl 00007F0950EB8E4Ah 0x0000004b push eax 0x0000004c pushad 0x0000004d popad 0x0000004e pop eax 0x0000004f mov eax, dword ptr [eax] 0x00000051 push edx 0x00000052 push eax 0x00000053 jg 00007F0950EB8E46h 0x00000059 pop eax 0x0000005a pop edx 0x0000005b mov dword ptr [esp+04h], eax 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 jg 00007F0950EB8E46h 0x00000069 rdtsc
Source: C:\Users\userGCAFCAFHJJ.exe	RDTSC instruction interceptor: First address: 55156A second address: 551570 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\userGCAFCAFHJJ.exe	RDTSC instruction interceptor: First address: 5516E1 second address: 5516E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Special instruction interceptor: First address: 34EC98 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Special instruction interceptor: First address: 34EBAB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Special instruction interceptor: First address: 4F0EA7 instructions caused by: Self-modifying code
Source: C:\Users\userGCAFCAFHJJ.exe	Special instruction interceptor: First address: 3CEA77 instructions caused by: Self-modifying code
Source: C:\Users\userGCAFCAFHJJ.exe	Special instruction interceptor: First address: 57A043 instructions caused by: Self-modifying code
Source: C:\Users\userGCAFCAFHJJ.exe	Special instruction interceptor: First address: 57A3DE instructions caused by: Self-modifying code
Source: C:\Users\userGCAFCAFHJJ.exe	Special instruction interceptor: First address: 578FCC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: DBEC98 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: DBEBAB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Special instruction interceptor: First address: F60EA7 instructions caused by: Self-modifying code
Source: C:\Users\userGCAFCAFHJJ.exe	Special instruction interceptor: First address: 60287D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 2EEA77 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 49A043 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 49A3DE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 498FCC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 52287D instructions caused by: Self-modifying code

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 14C0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 3160000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 5160000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe

Code function: 5_2_04CE0285 rdtsc

5_2_04CE0285

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 180000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Window / User API: threadDelayed 363
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Window / User API: threadDelayed 1187
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Window / User API: threadDelayed 851
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Window / User API: threadDelayed 1063
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 1633
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 1624
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1419

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\buildred[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\gawdth[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_cffi_backend.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\aiohttp\_http_writer.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\pered[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\2020[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\multidict\_multidict.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\yarl\_quoting_c.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1000012001\2020.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\charset_normalizer\md__mypyc.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\aiohttp\_helpers.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_queue.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_decimal.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\frozenlist\_frozenlist.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\aiohttp\_websocket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\charset_normalizer\md.pyd	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\aiohttp\_http_parser.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\25072023[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\2[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1000009001\25072023.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1000005001\2.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1000010001\pered.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1000014001\gawdth.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1000027001\buildred.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_socket.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 8.3 %

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7940	Thread sleep count: 57 > 30
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7940	Thread sleep time: -114057s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7944	Thread sleep count: 50 > 30
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7944	Thread sleep time: -100050s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7892	Thread sleep count: 177 > 30
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7892	Thread sleep time: -5310000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7948	Thread sleep count: 37 > 30
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7948	Thread sleep time: -74037s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7924	Thread sleep count: 49 > 30
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7924	Thread sleep time: -98049s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7920	Thread sleep count: 57 > 30
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7920	Thread sleep time: -114057s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7932	Thread sleep count: 47 > 30
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7932	Thread sleep time: -94047s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 7892	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 8040	Thread sleep count: 54 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 8040	Thread sleep time: -108054s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 8044	Thread sleep count: 46 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 8044	Thread sleep time: -92046s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7900	Thread sleep count: 363 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7900	Thread sleep time: -10890000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 8016	Thread sleep count: 46 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 8016	Thread sleep time: -92046s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 8024	Thread sleep count: 46 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 8024	Thread sleep time: -92046s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 8148	Thread sleep time: -720000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 8020	Thread sleep count: 45 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 8020	Thread sleep time: -90045s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 8032	Thread sleep count: 52 > 30
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 8032	Thread sleep time: -104052s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe TID: 7900	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 2232	Thread sleep time: -11068046444225724s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7324	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7620	Thread sleep count: 36 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7620	Thread sleep time: -216000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5880	Thread sleep count: 1419 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5880	Thread sleep count: 100 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2464	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1268	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\systeminfo.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\System32\systeminfo.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe

Thread sleep count: Count: 1187 delay: -10

Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040D8C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040D8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040F4F0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F4F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040BCB0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BCB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004139B0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_004139B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040E270 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E270
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00401710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004143F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004143F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040DC50 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DC50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00414050 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlenA,lstrlenA,	0_2_00414050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EB60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040EB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004133C0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_004133C0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401160 GetSystemInfo,ExitProcess,

0_2_00401160

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread delayed: delay time: 30000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 2012 Server Standard without Hyper-V (core)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: #Windows 10 Microsoft Hyper-V Server
Source: 342db65350.exe, 00000017.00000002.3282714744.0000000001E4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V (core)
Source: stub.exe, 00000019.00000003.2980692355.000002606FD93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Volume Shadow Copy Requestor
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (core)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 6Windows 2012 R2 Server Standard without Hyper-V (core)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: vmware
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (full)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Essential Server Solutions without Hyper-V
Source: stub.exe, 00000019.00000003.2980692355.000002606FD93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V PowerShell Direct Service
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: "Windows 8 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Microsoft Hyper-V Server
Source: stub.exe, 00000019.00000003.3016768492.000002606F47C000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3014173409.000002606F47C000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3002278553.000002606F473000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.2988153464.000002606F47C000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3020050954.000002606F47E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3096155859.000002606F484000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.2980692355.000002606FD93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Remote Desktop Virtualization Service
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V (core)
Source: stub.exe, 00000019.00000003.2980692355.000002606FD93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SERVICE_NAME: vmicvss
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V (core)
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Essential Server Solutions without Hyper-V
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Microsoft Hyper-V Server
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: 342db65350.exe, 00000017.00000002.3265664089.0000000000326000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Microsoft Hyper-V Server
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: /Windows 2012 R2 Server Standard without Hyper-V
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: )Windows 8 Server Standard without Hyper-V
Source: RoamingIDBGHDGHCG.exe, 00000005.00000002.2246869524.00000000004C7000.00000040.00000001.01000000.00000009.sdmp, userGCAFCAFHJJ.exe, 00000008.00000002.2316247776.0000000000557000.00000040.00000001.01000000.0000000B.sdmp, explorti.exe, 00000009.00000002.2282977099.0000000000F37000.00000040.00000001.01000000.0000000D.sdmp, explorti.exe, 0000000D.00000002.2288956274.0000000000F37000.00000040.00000001.01000000.0000000D.sdmp, axplong.exe, 0000000F.00000002.2362284017.0000000000477000.00000040.00000001.01000000.0000000F.sdmp, axplong.exe, 00000012.00000002.3265021970.0000000000477000.00000040.00000001.01000000.0000000F.sdmp, explorti.exe, 00000013.00000002.3264864901.0000000000F37000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (core)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (full)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (full)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (core)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Hyper-V
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: ,Windows 2012 Server Standard without Hyper-V
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Microsoft Hyper-V Server
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (core)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000002.2443375443.0000000002657000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2443375443.0000000002607000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000012.00000002.3270683057.0000000001578000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000012.00000002.3270683057.000000000154A000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000013.00000002.3270790823.0000000001885000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000013.00000002.3270790823.0000000001858000.00000004.00000020.00020000.00000000.sdmp, 97a671ae5d.exe, 00000014.00000002.2744968028.0000000002666000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (core)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V (core)
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: uvmtoolsd.exeuvmwaretray.exeuvmacthlp.exeuvboxtray.exeuvboxservice.exeuvmsrvc.exeuprl_tools.exeuxenservice.exeuAntiVM.CheckProcessT
Source: stub.exe, 00000019.00000003.3016768492.000002606F47C000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3014173409.000002606F47C000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3002278553.000002606F473000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.2988153464.000002606F47C000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3020050954.000002606F47E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3096155859.000002606F484000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.2980692355.000002606FD93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Time Synchronization Service
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (core)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (full)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (core)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (core)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 7Windows 2016 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (core)
Source: 97a671ae5d.exe, 00000014.00000002.2744921977.00000000025FD000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: stub.exe, 00000019.00000003.3016768492.000002606F47C000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3014173409.000002606F47C000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3002278553.000002606F473000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.2988153464.000002606F47C000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3020050954.000002606F47E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3096155859.000002606F484000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.2980692355.000002606FD93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Guest Shutdown Service
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (full)
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: uvmusrvc.exe
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 11 Essential Server Solutions without Hyper-V
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V (core)
Source: userGCAFCAFHJJ.exe, 00000008.00000003.2275354382.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V (core)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 10 Essential Server Solutions without Hyper-V
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: uvmtoolsd.exe
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: xVBoxService.exe
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: uvmwaretray.exe
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (core)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V (core)
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: stub.exe, 00000019.00000002.3098957207.000002606FD82000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3098891403.000002606FC92000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.2980692355.000002606FD93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (core)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V
Source: 342db65350.exe, 00000017.00000002.3282714744.0000000001E4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: VMWare
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (core)
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: uvboxtray.exe
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (full)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (full)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (core)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (full)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: #Windows 11 Microsoft Hyper-V Server
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Essential Server Solutions without Hyper-V
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Microsoft Hyper-V Server
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Microsoft Hyper-V Server
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (full)
Source: stub.exe, 00000019.00000002.3098957207.000002606FD82000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.2980692355.000002606FD93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: *Hyper-V Administrators
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (core)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 2016 Server Standard without Hyper-V (core)
Source: 97a671ae5d.exe, 00000014.00000002.2744968028.0000000002617000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: aqemu
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: (Windows 2012 R2 Microsoft Hyper-V Server
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Microsoft Hyper-V Server
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avirtualboxavmwareuAntiVM.CheckGpuadecoded_outputu<genexpr>uAntiVM.CheckGpu.<locals>.<genexpr>L
Source: stub.exe, 00000019.00000003.3025477729.000002606E70F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (core)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 0Windows 8 Server Standard without Hyper-V (core)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 6Windows 8.1 Essential Server Solutions without Hyper-V
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 4Windows 8 Essential Server Solutions without Hyper-V
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: stub.exe, 00000019.00000003.3016768492.000002606F47C000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3014173409.000002606F47C000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3002278553.000002606F473000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.2988153464.000002606F47C000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3020050954.000002606F47E000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3096155859.000002606F484000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.2980692355.000002606FD93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Data Exchange Service
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (core)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (full)
Source: RoamingIDBGHDGHCG.exe, RoamingIDBGHDGHCG.exe, 00000005.00000002.2246869524.00000000004C7000.00000040.00000001.01000000.00000009.sdmp, userGCAFCAFHJJ.exe, userGCAFCAFHJJ.exe, 00000008.00000002.2316247776.0000000000557000.00000040.00000001.01000000.0000000B.sdmp, explorti.exe, explorti.exe, 00000009.00000002.2282977099.0000000000F37000.00000040.00000001.01000000.0000000D.sdmp, explorti.exe, 0000000D.00000002.2288956274.0000000000F37000.00000040.00000001.01000000.0000000D.sdmp, axplong.exe, 0000000F.00000002.2362284017.0000000000477000.00000040.00000001.01000000.0000000F.sdmp, axplong.exe, 00000012.00000002.3265021970.0000000000477000.00000040.00000001.01000000.0000000F.sdmp, explorti.exe, 00000013.00000002.3264864901.0000000000F37000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (full)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: uvboxservice.exe
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: uqemu-ga.exe
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: uvmsrvc.exe
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cvmware
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (core)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Essential Server Solutions without Hyper-V
Source: stub.exe, 00000019.00000003.2980692355.000002606FD93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SERVICE_NAME: vmicheartbeat
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Hyper-V (guest)
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: stub.exe, 00000019.00000003.2980692355.000002606FD93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SERVICE_NAME: vmicshutdown
Source: 342db65350.exe, 00000017.00000002.3265664089.0000000000326000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 342db65350.exe, 00000017.00000002.3265664089.0000000000326000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: 342db65350.exe, 00000017.00000002.3339226587.0000000006443000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\]
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: %Windows 2012 Microsoft Hyper-V Server
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: $Windows 8.1 Microsoft Hyper-V Server
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (full)
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: stub.exe, 00000019.00000002.3093364671.000002606F235000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3020784420.000002606F235000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.2980692355.000002606FD93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Heartbeat Service
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: uvmwareuser.exe
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Essential Server Solutions without Hyper-V
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Essential Server Solutions without Hyper-V
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 7Windows 2012 Essential Server Solutions without Hyper-V
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (full)
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avmware
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (full)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (full)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: %Windows 2016 Microsoft Hyper-V Server
Source: RoamingIDBGHDGHCG.exe, 00000005.00000002.2248551949.0000000000D1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: +Windows 8.1 Server Standard without Hyper-V
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: asandboxacuckooavmavirtualaqemuavboxaxenanodeuAntiVM.CheckHostNameT
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (core)
Source: stub.exe, 00000019.00000002.3093364671.000002606F235000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3020784420.000002606F235000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.2980692355.000002606FD93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DISPLAY_NAME: Hyper-V Guest Service Interface
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (full)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (core)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (core)
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (core)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: :Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (full)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (full)
Source: file.exe, 00000000.00000003.2082844403.0000000028D2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: *Windows 11 Server Standard without Hyper-V
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: ,Windows 2016 Server Standard without Hyper-V
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (full)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (full)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: VBoxService.exe
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cVMware
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: *Windows 10 Server Standard without Hyper-V
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 1Windows 11 Server Standard without Hyper-V (core)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 1Windows 10 Server Standard without Hyper-V (core)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (full)
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (full)
Source: 97a671ae5d.exe, 00000014.00000002.2744968028.0000000002666000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: axplong.exe, 00000012.00000002.3270683057.0000000001578000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWd2
Source: 342db65350.exe, 00000017.00000002.3265664089.00000000001F6000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: 2Windows 8.1 Server Standard without Hyper-V (core)
Source: build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: uwmic path Win32_ComputerSystem get ManufacturercVMwarecvmwareuAntiVM.CheckHypervisoraFakeErrorT

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-67322
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-68479
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-67301
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-67304
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-67323
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-67143
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-67344
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-67315

Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	File opened: SIWVID

Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe

Code function: 5_2_04CE0285 rdtsc

5_2_04CE0285

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0041ACFA

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00404610 VirtualProtect ?,00000004,00000100,00000000

0_2_00404610

Source: C:\Users\user\Desktop\file.exe

0_2_004195E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00419160 mov eax, dword ptr fs:[00000030h]

0_2_00419160

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

0_2_00405000

Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041C8D9 SetUnhandledExceptionFilter,	0_2_0041C8D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041ACFA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041ACFA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041A718 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0041A718
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C5DB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C5DB1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C78AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 6456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 97a671ae5d.exe PID: 7188, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\1000002001\crypted.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1000002001\crypted.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004190A0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_004190A0

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\1000002001\crypted.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\1000002001\crypted.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
Source: C:\Users\user\AppData\Local\Temp\1000002001\crypted.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 430000
Source: C:\Users\user\AppData\Local\Temp\1000002001\crypted.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44E000
Source: C:\Users\user\AppData\Local\Temp\1000002001\crypted.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1172008
Source: C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 41E000
Source: C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42B000
Source: C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 63E000
Source: C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: BE2008
Source: C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000
Source: C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 426000
Source: C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 434000
Source: C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 436000
Source: C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 534000
Source: C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 673008

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingIDBGHDGHCG.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userGCAFCAFHJJ.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe "C:\Users\user\AppData\RoamingIDBGHDGHCG.exe"	Jump to behavior
Source: C:\Users\user\AppData\RoamingIDBGHDGHCG.exe	Process created: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe "C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\userGCAFCAFHJJ.exe "C:\Users\userGCAFCAFHJJ.exe"	Jump to behavior
Source: C:\Users\userGCAFCAFHJJ.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000001001\build.exe "C:\Users\user\AppData\Local\Temp\1000001001\build.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000002001\crypted.exe "C:\Users\user\AppData\Local\Temp\1000002001\crypted.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe "C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe "C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe "C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe"
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Process created: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe "C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe"
Source: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000001001\build.exe	Process created: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe "C:\Users\user\AppData\Local\Temp\1000001001\build.exe"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe""
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "chcp"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "chcp"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Local\Temp\1000002001\crypted.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Get-Clipboard
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\systeminfo.exe systeminfo
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\HOSTNAME.EXE hostname
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic logicaldisk get caption,description,providername
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe

Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "echo ####system info#### & systeminfo & echo ####system version#### & ver & echo ####host name#### & hostname & echo ####environment variable#### & set & echo ####logical disk#### & wmic logicaldisk get caption,description,providername & echo ####user info#### & net user & echo ####online user#### & query user & echo ####local group#### & net localgroup & echo ####administrators info#### & net localgroup administrators & echo ####guest user info#### & net user guest & echo ####administrator user info#### & net user administrator & echo ####startup info#### & wmic startup get caption,command & echo ####tasklist#### & tasklist /svc & echo ####ipconfig#### & ipconfig/all & echo ####hosts#### & type c:\windows\system32\drivers\etc\hosts & echo ####route table#### & route print & echo ####arp info#### & arp -a & echo ####netstat#### & netstat -ano & echo ####service info#### & sc query type= service state= all & echo ####firewallinfo#### & netsh firewall show state & netsh firewall show config"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "echo ####system info#### & systeminfo & echo ####system version#### & ver & echo ####host name#### & hostname & echo ####environment variable#### & set & echo ####logical disk#### & wmic logicaldisk get caption,description,providername & echo ####user info#### & net user & echo ####online user#### & query user & echo ####local group#### & net localgroup & echo ####administrators info#### & net localgroup administrators & echo ####guest user info#### & net user guest & echo ####administrator user info#### & net user administrator & echo ####startup info#### & wmic startup get caption,command & echo ####tasklist#### & tasklist /svc & echo ####ipconfig#### & ipconfig/all & echo ####hosts#### & type c:\windows\system32\drivers\etc\hosts & echo ####route table#### & route print & echo ####arp info#### & arp -a & echo ####netstat#### & netstat -ano & echo ####service info#### & sc query type= service state= all & echo ####firewallinfo#### & netsh firewall show state & netsh firewall show config"

Source: 342db65350.exe, 00000017.00000002.3262699829.0000000000182000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: RoamingIDBGHDGHCG.exe, RoamingIDBGHDGHCG.exe, 00000005.00000002.2246869524.00000000004C7000.00000040.00000001.01000000.00000009.sdmp, explorti.exe, explorti.exe, 00000009.00000002.2282977099.0000000000F37000.00000040.00000001.01000000.0000000D.sdmp, explorti.exe, 0000000D.00000002.2288956274.0000000000F37000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: Program Manager
Source: userGCAFCAFHJJ.exe, userGCAFCAFHJJ.exe, 00000008.00000002.2316247776.0000000000557000.00000040.00000001.01000000.0000000B.sdmp, axplong.exe, 0000000F.00000002.2362284017.0000000000477000.00000040.00000001.01000000.0000000F.sdmp, axplong.exe, 00000012.00000002.3265021970.0000000000477000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: *XProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5DB341 cpuid

0_2_6C5DB341

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00417630

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000001001\build.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000001001\build.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000002001\crypted.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000002001\crypted.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000005001\2.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000005001\2.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000009001\25072023.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000009001\25072023.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000010001\pered.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000010001\pered.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000012001\2020.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000012001\2020.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000014001\gawdth.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000014001\gawdth.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000027001\buildred.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000001001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000001001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000001001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\multidict VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\multidict VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\multidict VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000001001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000001001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000001001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000001001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000001001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000001001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000001001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000001001\build.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000001001\build.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000001001\build.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\3e445a25-c088-46bb-968a-82532b92e486 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\af VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\am VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ar VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_CA VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_US VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\fr VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ja VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ka VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\kk VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lv VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ms VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\nl VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ro VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ta VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\th VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\zh_CN VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\pt_BR VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\Temp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\FileTypePolicies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\hyphen-data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\MEIPreload VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\OriginTrials VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2023.8.1 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AutofillStrikeDatabase VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Download Service\Files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\bn VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\ca VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\en_GB VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_locales\lo VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform\SignalDB VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Segmentation Platform\SignalStorageConfigDB VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Cache VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ar VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\de VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\en-GB VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\es VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\id VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\fr VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\de VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-mobile-hub\es VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification\en-GB VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\en-GB VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\es VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-notification-shared\fr VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded\2023.9.25.0 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded\2023.9.25.0\_metadata VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\36\10.34.0.50 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2023.9.4.1 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\bookmarkbackups VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\events VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\default VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\temporary VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\to-be-removed VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Logins.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Logins.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Web.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Web.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Cookies.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000001001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Cookies.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\HistoryData.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\HistoryData.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\DownloadData.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\DownloadData.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AutofillData.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AutofillData.db VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: \Device\CdRom0\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Games VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\screenshot.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\screenshot.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\process_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Firefox\History.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Cookies.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\system_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\network_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Sessions VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Tokens VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Wallets VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\network_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\network_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\network_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\process_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\process_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\process_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\screenshot.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\screenshot.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\screenshot.png VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\system_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\system_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\system_info.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Firefox VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Cookies.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Cookies.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Cookies.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Firefox VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Firefox\History.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Firefox\History.txt VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Wallets VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493 VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00417420 GetProcessHeap,HeapAlloc,GetLocalTime,wsprintfA,

0_2_00417420

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004172F0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_004172F0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004174D0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_004174D0

Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 9.2.explorti.exe.d50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.userGCAFCAFHJJ.exe.360000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.axplong.exe.280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.explorti.exe.d50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.axplong.exe.280000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.RoamingIDBGHDGHCG.exe.2e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.explorti.exe.d50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.2288695597.0000000000D51000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2321675490.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2316104817.0000000000361000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2649838006.0000000005520000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2362139356.0000000000281000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.3262529236.0000000000D51000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2203716913.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2646169494.00000000051A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2225111532.0000000004B40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3262997504.0000000000281000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2248436376.0000000005540000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2282786078.0000000000D51000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.2242115500.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2245471234.00000000002E1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY

Yara detected Monster Stealer

Source: Yara match	File source: 00000019.00000000.2782464290.00007FF725AE6000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3102011990.00007FF725AE6000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build.exe PID: 3032, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: stub.exe PID: 1524, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\system_info.txt, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: 33.2.crypted.exe.6fcbc0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.crypted.exe.6fcbc0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.crypted.exe.660000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000023.00000002.2992462261.00000000031F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2793593184.00000000006FC000.00000004.00000001.01000000.00000032.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2956394415.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\25072023[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000009001\25072023.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\buildred[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000027001\buildred.exe, type: DROPPED

Yara detected Stealc

Source: Yara match	File source: 00000024.00000002.2850361286.00000000026EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2744968028.0000000002617000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.3029002681.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2443375443.0000000002607000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 97a671ae5d.exe PID: 7188, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6456, type: MEMORYSTR

Detected generic credential text file

Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File created: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\process_info.txt
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File created: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\system_info.txt
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File created: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Cookies.txt
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File created: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Firefox\History.txt
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File created: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\network_info.txt

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: file.exe	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: passphrase.json
Source: file.exe	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe	String found in binary or memory: \Ethereum\
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe, 00000000.00000002.2443375443.0000000002657000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16fons\AppData\Roaming\Binance\.finger-print.fp*pH
Source: file.exe	String found in binary or memory: Ethereum
Source: file.exe	String found in binary or memory: file__0.localstorage
Source: file.exe	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe	String found in binary or memory: ltiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.js
Source: file.exe	String found in binary or memory: us\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|M
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo
Source: file.exe	String found in binary or memory: lockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.*\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exo

Gathers network related connection and port information

Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal WLAN passwords

Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\031db23f-f53a-4d6b-b429-cd0302ef56d3
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\3e445a25-c088-46bb-968a-82532b92e486
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\6490c938-fe3f-48ae-bc5e-e1986298f7c1
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\security_state
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\a5f61848-f128-4a80-965b-a3000feed295
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Bookmarks
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\default
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\to-be-removed
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Monochrome
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Maskable
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Maskable
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pdadjkfkgcafgbceimcpbkalnfnepbnk
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Monochrome
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\58ef9818-5ea1-49a0-b5b0-9338401a7943
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Monochrome
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Maskable
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Monochrome
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\15702f96-fbc1-4934-99bf-a9a7406c1be7
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\events
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Monochrome
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\temporary
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\minidumps
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nphplpgoakhhjchkkhmiggakijnkhfnd
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.files
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\bookmarkbackups
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hmeobnfnfcmdkdcmlblgagmfpfboieaf
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnnegphlobjdpkhecapkijjdkgcjhkib
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Maskable
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Maskable
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004

Tries to steal communication platform credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\discord
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\discordcanary
Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	File opened: C:\Users\user\AppData\Local\discordptb

Yara detected Generic Python Stealer

Source: Yara match	File source: 00000019.00000000.2782464290.00007FF725AE6000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3102011990.00007FF725AE6000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build.exe PID: 3032, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe, type: DROPPED

Source: Yara match	File source: 00000023.00000002.2992462261.00000000031F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.3029002681.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.2782464290.00007FF725AE6000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3043239757.000002606E460000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3102011990.00007FF725AE6000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: build.exe PID: 3032, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: stub.exe PID: 1524, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe, type: DROPPED

Remote Access Functionality

Yara detected Monster Stealer

Source: Yara match	File source: 00000019.00000000.2782464290.00007FF725AE6000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3102011990.00007FF725AE6000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build.exe PID: 3032, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: stub.exe PID: 1524, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\system_info.txt, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: 33.2.crypted.exe.6fcbc0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.crypted.exe.6fcbc0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.crypted.exe.660000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000023.00000002.2992462261.00000000031F5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2793593184.00000000006FC000.00000004.00000001.01000000.00000032.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.2956394415.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\25072023[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000009001\25072023.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\buildred[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1000027001\buildred.exe, type: DROPPED

Yara detected Stealc

Source: Yara match	File source: 00000024.00000002.2850361286.00000000026EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2744968028.0000000002617000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.3029002681.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2443375443.0000000002607000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 97a671ae5d.exe PID: 7188, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6456, type: MEMORYSTR

Yara detected Generic Python Stealer

Source: Yara match	File source: 00000019.00000000.2782464290.00007FF725AE6000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.3102011990.00007FF725AE6000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build.exe PID: 3032, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe, type: DROPPED

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C790C40 sqlite3_bind_zeroblob,	0_2_6C790C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C790D60 sqlite3_bind_parameter_name,	0_2_6C790D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B8EA0 sqlite3_clear_bindings,	0_2_6C6B8EA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	441 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	221 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 Scheduled Task/Job	412 Process Injection	1 Deobfuscate/Decode Files or Information	11 Input Capture	1 Account Discovery	Remote Desktop Protocol	5 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	112 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	1 System Network Connections Discovery	SMB/Windows Admin Shares	2 Email Collection	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	11 Registry Run Keys / Startup Folder	23 Software Packing	NTDS	3 File and Directory Discovery	Distributed Component Object Model	11 Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	469 System Information Discovery	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Query Registry	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1291 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	691 Virtualization/Sandbox Evasion	Proc Filesystem	691 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	14 Process Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 Application Window Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Owner/User Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	Embedded Payloads	Keylogging	1 Remote System Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	HEUR/AGEN.1312596
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\userGCAFCAFHJJ.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\crypteda[1].exe	100%	Avira	HEUR/AGEN.1317026
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	HEUR/AGEN.1312596
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\2[1].exe	100%	Joe Sandbox ML
C:\Users\userGCAFCAFHJJ.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\crypteda[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\build[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\pered[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\build[1].exe	79%	ReversingLabs	Win64.Trojan.Casdet
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\pered[1].exe	5%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\buildred[1].exe	75%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\crypteda[1].exe	79%	ReversingLabs	Win32.Ransomware.RedLine
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\gawdth[1].exe	62%	ReversingLabs	Win64.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\2020[1].exe	75%	ReversingLabs	Win64.Trojan.Molotov
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\25072023[1].exe	92%	ReversingLabs	ByteCode-MSIL.Ransomware.RedLine
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\5447jsX[1].exe	79%	ReversingLabs	Win32.Spyware.Stealc
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\crypted[1].exe	88%	ReversingLabs	Win32.Spyware.Redline
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe	79%	ReversingLabs	Win64.Trojan.Casdet
C:\Users\user\AppData\Local\Temp\1000001001\build.exe	79%	ReversingLabs	Win64.Trojan.Casdet
C:\Users\user\AppData\Local\Temp\1000002001\crypted.exe	88%	ReversingLabs	Win32.Spyware.Redline
C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe	79%	ReversingLabs	Win32.Spyware.Stealc
C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe	79%	ReversingLabs	Win32.Ransomware.RedLine
C:\Users\user\AppData\Local\Temp\1000009001\25072023.exe	92%	ReversingLabs	ByteCode-MSIL.Ransomware.RedLine
C:\Users\user\AppData\Local\Temp\1000010001\pered.exe	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1000012001\2020.exe	75%	ReversingLabs	Win64.Trojan.Molotov
C:\Users\user\AppData\Local\Temp\1000014001\gawdth.exe	62%	ReversingLabs	Win64.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1000027001\buildred.exe	75%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_cffi_backend.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_uuid.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\aiohttp\_helpers.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\aiohttp\_http_parser.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\aiohttp\_http_writer.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\aiohttp\_websocket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\charset_normalizer\md.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\charset_normalizer\md__mypyc.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\cryptography\hazmat\bindings\_rust.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\frozenlist\_frozenlist.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\libffi-7.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\multidict\_multidict.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\pyexpat.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\python3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\python310.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe	79%	ReversingLabs	Win64.Trojan.Generic
C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\unicodedata.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	0%	URL Reputation	safe
http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr	0%	URL Reputation	safe
http://curl.haxx.se/rfc/cookie_spec.html	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	0%	URL Reputation	safe
http://ip-api.com/json	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
https://twitter.com/	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://github.com/pyca/cryptography/issues/8996	0%	Avira URL Cloud	safe
https://github.com/aio-libs/aiohttp/discussions/6044	0%	Avira URL Cloud	safe
https://account.riotgames.com/api/account/v1/user	0%	Avira URL Cloud	safe
https://python.org/dev/peps/pep-0263/	0%	Avira URL Cloud	safe
http://python.org	0%	Avira URL Cloud	safe
https://github.com/python-attrs/attrs/issues/251	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/vcruntime140.dll	100%	Avira URL Cloud	malware
https://tiktok.com/	0%	Avira URL Cloud	safe
https://oauth.reddit.com/api/v1/me	0%	Avira URL Cloud	safe
https://github.com/sponsors/hynek	0%	Avira URL Cloud	safe
http://185.215.113.19/Vi9leo/index.php0_	100%	Avira URL Cloud	phishing
https://restores.name/logaYMOVKJ1WAP6PFLQqz	0%	Avira URL Cloud	safe
https://github.com/python-attrs/attrs/issues/1200)	0%	Avira URL Cloud	safe
http://185.215.113.19/ows	100%	Avira URL Cloud	phishing
https://coe.com.vn/tmp/2.exefdm	0%	Avira URL Cloud	safe
https://www.attrs.org/en/23.2.0/_static/sponsors/FilePreviews.svg	0%	Avira URL Cloud	safe
http://185.215.113.19/Vi9leo/index.php	100%	Avira URL Cloud	phishing
http://ip-api.com/jsonacityatimezoneaispaorgaasuMain.GetNetworkInfoT	0%	Avira URL Cloud	safe
http://85.28.47.31/ro2s	100%	Avira URL Cloud	malware
http://185.215.113.19/Local	100%	Avira URL Cloud	phishing
http://speleotrove.com/decimal/decarith.html	0%	Avira URL Cloud	safe
https://github.com/python-attrs/attrs/issues/136	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/softokn3.dllAw	100%	Avira URL Cloud	malware
http://185.215.113.16/Jo89Ku7d/index.php4z	100%	Avira URL Cloud	phishing
https://discord.com/api/v9/users/	0%	Avira URL Cloud	safe
http://json.org	0%	Avira URL Cloud	safe
https://www.tiktok.com/passport/web/account/info/?aid=1459&app_language=de-DE&app_name=tiktok_web&ba	0%	Avira URL Cloud	safe
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode	0%	Avira URL Cloud	safe
https://open.spotify.com/user/u	0%	Avira URL Cloud	safe
https://zopeinterface.readthedocs.io/en/latest/	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/softokn3.dll	100%	Avira URL Cloud	malware
http://85.28.47.31/8405906461a5200c/nss3.dll	100%	Avira URL Cloud	malware
http://185.215.113.16/stealc/random.exencodedcgN	100%	Avira URL Cloud	phishing
https://twitter.com/i/api/1.1/account/update_profile.jsonareqadescriptionuThere	0%	Avira URL Cloud	safe
http://185.215.113.16/inc/25072023.exe	100%	Avira URL Cloud	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://185.215.113.19/c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#3.	100%	Avira URL Cloud	phishing
https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file	0%	Avira URL Cloud	safe
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	0%	Avira URL Cloud	safe
http://185.215.113.16/inc/buildred.exeL	100%	Avira URL Cloud	phishing
https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=referral&utm_campa	0%	Avira URL Cloud	safe
http://85.28.47.31lN$KsW5	0%	Avira URL Cloud	safe
http://185.215.113.16/inc/gawdth.exelF~n#	100%	Avira URL Cloud	phishing
https://api.steampowered.com/IPlayerService/GetOwnedGames/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s	0%	Avira URL Cloud	safe
https://filepreviews.io/	0%	Avira URL Cloud	safe
https://www.attrs.org/en/stable/changelog.html	0%	Avira URL Cloud	safe
https://www.variomedia.de/	0%	Avira URL Cloud	safe
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	0%	Avira URL Cloud	safe
https://www.attrs.org/	0%	Avira URL Cloud	safe
https://github.com/pyca/cryptography/issues	0%	Avira URL Cloud	safe
https://mahler:8092/site-updates.py	0%	Avira URL Cloud	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
http://85.28.47.31/5499d72b3i	100%	Avira URL Cloud	malware
https://github.com/python-attrs/attrs/issues/1203)	0%	Avira URL Cloud	safe
https://www.attrs.org/en/23.2.0/_static/sponsors/Tidelift.svg	0%	Avira URL Cloud	safe
http://85.28.47.31/8405906461a5200c/msvcp140.dllR	100%	Avira URL Cloud	malware
https://discord.gg/	0%	Avira URL Cloud	safe
https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).	0%	Avira URL Cloud	safe
http://185.215.113.19/fac00b58987e8fcf7b8c730804042ba5ce902415453	100%	Avira URL Cloud	phishing
https://github.com/python-attrs/attrs/issues/1187)	0%	Avira URL Cloud	safe
https://www.spotify.com/api/account-settings/v1/profile	0%	Avira URL Cloud	safe
http://185.215.113.16/inc/5447jsX.exed	100%	Avira URL Cloud	phishing
http://85.28.47.31/5499d72b3a3e55be.php=U	100%	Avira URL Cloud	malware
http://85.28.47.31/8405906461a5200c/nss3.dllll	100%	Avira URL Cloud	malware
http://185.215.113.16/inc/crypted.exeo	100%	Avira URL Cloud	phishing
https://github.com/pyca/cryptography/issues/9253	0%	Avira URL Cloud	safe
https://www.attrs.org/en/stable/changelog.html)	0%	Avira URL Cloud	safe
http://www.iana.org/time-zones/repository/tz-link.html	0%	Avira URL Cloud	safe
http://185.215.113.19/c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#U.	100%	Avira URL Cloud	phishing
https://www.attrs.org/en/stable/comparison.html#customization)	0%	Avira URL Cloud	safe
https://www.youtube.com/accountt%	0%	Avira URL Cloud	safe
http://185.215.113.16/Jo89Ku7d/index.php32	100%	Avira URL Cloud	phishing
http://185.215.113.16/inc/gawdth.exe	100%	Avira URL Cloud	malware
https://www.youtube.com/account.NK	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/justforMonster/injection/main/injection.js	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
https://github.com/python-attrs/attrs/blob/main/.github/CONTRIBUTING.md)	0%	Avira URL Cloud	safe
http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/	0%	Avira URL Cloud	safe
https://t.me/monster_free_cloud----------------------	0%	Avira URL Cloud	safe
https://github.com/python-attrs/attrs/issues/1172)	0%	Avira URL Cloud	safe
https://www.python.org/	0%	Avira URL Cloud	safe
http://85.28.47.31/pr	100%	Avira URL Cloud	malware
http://185.215.113.16/inc/pered.exe	100%	Avira URL Cloud	phishing
http://185.215.113.19/Vi9leo/index.php17001	100%	Avira URL Cloud	phishing
https://gql.twitch.tv/gql	0%	Avira URL Cloud	safe
https://discord.com/api/v8/guilds/	0%	Avira URL Cloud	safe
https://www.python.org/dev/peps/pep-0205/	0%	Avira URL Cloud	safe
http://185.215.113.16/Jo89Ku7d/index.phpTemp	100%	Avira URL Cloud	phishing

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2070352427.0000000002687000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.28.47.31/8405906461a5200c/vcruntime140.dll	file.exe, 00000000.00000002.2443375443.000000000263A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://account.riotgames.com/api/account/v1/user	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2070352427.0000000002687000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/pyca/cryptography/issues/8996	build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/python-attrs/attrs/issues/251	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3048303310.000002606EA34000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tiktok.com/	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2443375443.0000000002657000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2464131529.0000000028D84000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/aio-libs/aiohttp/discussions/6044	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3091985685.000002606F17B000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3018700794.000002606F17A000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3072092053.000002606ED60000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr	342db65350.exe, 00000017.00000002.3265664089.00000000006DE000.00000040.00000001.01000000.00000011.sdmp, 342db65350.exe, 00000017.00000000.2736849521.000000000097E000.00000080.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown
http://python.org	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://python.org/dev/peps/pep-0263/	build.exe, 00000018.00000003.2773862520.0000020781AF5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/sponsors/hynek	stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://oauth.reddit.com/api/v1/me	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.19/Vi9leo/index.php0_	explorti.exe, 00000013.00000002.3270790823.0000000001885000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://www.attrs.org/en/23.2.0/_static/sponsors/FilePreviews.svg	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.19/ows	explorti.exe, 00000013.00000002.3270790823.0000000001885000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://github.com/python-attrs/attrs/issues/1200)	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.19/Vi9leo/index.php	explorti.exe, 00000013.00000002.3270790823.0000000001885000.00000004.00000020.00020000.00000000.sdmp, explorti.exe, 00000013.00000002.3270790823.0000000001858000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://coe.com.vn/tmp/2.exefdm	axplong.exe, 00000012.00000002.3270683057.0000000001578000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com/jsonacityatimezoneaispaorgaasuMain.GetNetworkInfoT	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://restores.name/logaYMOVKJ1WAP6PFLQqz	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.19/Local	explorti.exe, 00000013.00000002.3270790823.0000000001885000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://85.28.47.31/ro2s	97a671ae5d.exe, 00000014.00000002.2744968028.000000000264A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://discord.com/api/v9/users/	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.28.47.31/8405906461a5200c/softokn3.dllAw	file.exe, 00000000.00000002.2443375443.0000000002657000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/python-attrs/attrs/issues/136	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3048303310.000002606EA34000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.tiktok.com/passport/web/account/info/?aid=1459&app_language=de-DE&app_name=tiktok_web&ba	stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://curl.haxx.se/rfc/cookie_spec.html	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://speleotrove.com/decimal/decarith.html	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/Jo89Ku7d/index.php4z	axplong.exe, 00000012.00000002.3270683057.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://json.org	stub.exe, 00000019.00000003.3025477729.000002606E70F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://zopeinterface.readthedocs.io/en/latest/	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3048303310.000002606EA34000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://open.spotify.com/user/u	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/stealc/random.exencodedcgN	explorti.exe, 00000013.00000002.3270790823.000000000186E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://85.28.47.31/8405906461a5200c/softokn3.dll	file.exe, 00000000.00000002.2443375443.0000000002657000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/inc/25072023.exe	axplong.exe, 00000012.00000002.3270683057.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.19/c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#3.	explorti.exe, 00000013.00000002.3270790823.0000000001885000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://twitter.com/i/api/1.1/account/update_profile.jsonareqadescriptionuThere	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2070352427.0000000002687000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.28.47.31/8405906461a5200c/nss3.dll	file.exe, 00000000.00000002.2443375443.0000000002657000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cryptography.io/en/latest/faq/#why-can-t-i-import-my-pem-file	build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.cl.cam.ac.uk/~mgk25/iso-time.html	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3047040170.000002606E860000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/inc/buildred.exeL	axplong.exe, 00000012.00000002.3285482105.0000000006320000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://api.steampowered.com/IPlayerService/GetOwnedGames/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/inc/gawdth.exelF~n#	axplong.exe, 00000012.00000002.3270683057.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://filepreviews.io/	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2070352427.0000000002687000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://85.28.47.31lN$KsW5	97a671ae5d.exe, 00000014.00000002.2744668224.00000000025EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=referral&utm_campa	stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.attrs.org/en/stable/changelog.html	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	stub.exe, 00000019.00000003.2837202724.000002606F460000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.variomedia.de/	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2443375443.0000000002657000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2464131529.0000000028D84000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2443375443.0000000002657000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2464131529.0000000028D84000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3046738501.000002606E760000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/pyca/cryptography/issues	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.attrs.org/	stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mahler:8092/site-updates.py	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3092540180.000002606F1A1000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3017617111.000002606F19E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.28.47.31/5499d72b3i	file.exe, 00000000.00000002.2469209996.0000000035220000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://85.28.47.31/8405906461a5200c/msvcp140.dllR	file.exe, 00000000.00000002.2443375443.0000000002607000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/python-attrs/attrs/issues/1203)	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.attrs.org/en/23.2.0/_static/sponsors/Tidelift.svg	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://discord.gg/	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000002.2464131529.0000000028D84000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com/json	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.19/fac00b58987e8fcf7b8c730804042ba5ce902415453	explorti.exe, 00000013.00000002.3270790823.0000000001885000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://www.spotify.com/api/account-settings/v1/profile	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/inc/5447jsX.exed	axplong.exe, 00000012.00000002.3270683057.0000000001578000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://github.com/python-attrs/attrs/issues/1187)	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/inc/crypted.exeo	axplong.exe, 00000012.00000002.3270683057.0000000001578000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	build.exe, 00000018.00000003.2773862520.00000207816BC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://85.28.47.31/5499d72b3a3e55be.php=U	file.exe, 00000000.00000002.2443375443.000000000263A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://85.28.47.31/8405906461a5200c/nss3.dllll	file.exe, 00000000.00000002.2443375443.0000000002657000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/pyca/cryptography/issues/9253	build.exe, 00000018.00000003.2773862520.0000020781E6D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.attrs.org/en/stable/changelog.html)	stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.iana.org/time-zones/repository/tz-link.html	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3046738501.000002606E760000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/accountt%	342db65350.exe, 00000017.00000002.3285477229.00000000020B5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.19/c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#U.	explorti.exe, 00000013.00000002.3270790823.0000000001885000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://www.attrs.org/en/stable/comparison.html#customization)	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/Jo89Ku7d/index.php32	axplong.exe, 00000012.00000002.3285482105.0000000006320000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://raw.githubusercontent.com/justforMonster/injection/main/injection.js	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/account.NK	342db65350.exe, 00000017.00000002.3339226587.0000000006443000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2070352427.0000000002687000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/inc/gawdth.exe	axplong.exe, 00000012.00000002.3270683057.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/python-attrs/attrs/blob/main/.github/CONTRIBUTING.md)	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/monster_free_cloud----------------------	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/python-attrs/attrs/issues/1172)	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3042192631.000002606C756000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3023690982.000002606C72A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.python.org/	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000002.3092540180.000002606F1A1000.00000004.00000020.00020000.00000000.sdmp, stub.exe, 00000019.00000003.3017617111.000002606F19E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://85.28.47.31/pr	file.exe, 00000000.00000002.2443375443.000000000263A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/inc/pered.exe	axplong.exe, 00000012.00000002.3285482105.0000000006320000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.19/Vi9leo/index.php17001	explorti.exe, 00000013.00000002.3270790823.0000000001885000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://gql.twitch.tv/gql	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://discord.com/api/v8/guilds/	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.python.org/dev/peps/pep-0205/	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://twitter.com/	build.exe, 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/Jo89Ku7d/index.phpTemp	axplong.exe, 00000012.00000002.3270683057.00000000015D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
85.28.47.31	unknown	Russian Federation	31643	GES-ASRU	false
185.215.113.19	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.52.165.210	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true
20.189.173.22	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.189.173.21	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
208.95.112.1	unknown	United States	53334	TUT-ASUS	false
185.199.109.133	unknown	Netherlands	54113	FASTLYUS	false
20.42.73.29	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
103.28.36.182	unknown	Viet Nam	131353	NHANHOA-AS-VNNhanHoaSoftwarecompanyVN	false
89.248.174.171	unknown	Netherlands	202425	INT-NETWORKSC	false
85.28.47.70	unknown	Russian Federation	31643	GES-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483332
Start date and time:	2024-07-27 01:41:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	79
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@129/133@0/13
EGA Information:	Successful, ratio: 25%
HCA Information:	Successful, ratio: 61% Number of executed functions: 84 Number of non-executed functions: 114
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Execution Graph export aborted for target RoamingIDBGHDGHCG.exe, PID 6768 because it is empty
Execution Graph export aborted for target userGCAFCAFHJJ.exe, PID 2676 because it is empty
Execution Graph export aborted for target explorti.exe, PID 1960 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Skipping network analysis since amount of network traffic is too extensive
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
01:42:19	Task Scheduler	Run new task: explorti path: C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
01:42:23	Task Scheduler	Run new task: axplong path: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
01:43:08	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 97a671ae5d.exe C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe
01:43:16	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 342db65350.exe C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe
01:43:25	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 97a671ae5d.exe C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe
01:43:33	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 342db65350.exe C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe
01:44:02	Task Scheduler	Run new task: Test Task17 path: C:\ProgramData\ptssov\kmpt.exe
01:44:26	Task Scheduler	Run new task: MyTask path: "C:\Users\user\AppData\Roaming\Suh\jre8\bin\javaw.exe" s>-jar "C:\Users\user\AppData\Roaming\Suh\client.jar"
19:42:40	API Interceptor	3x Sleep call for process: WerFault.exe modified
19:43:01	API Interceptor	979x Sleep call for process: explorti.exe modified
19:43:01	API Interceptor	947x Sleep call for process: axplong.exe modified
19:43:15	API Interceptor	2x Sleep call for process: WMIC.exe modified
19:43:18	API Interceptor	56x Sleep call for process: RegAsm.exe modified
19:43:23	API Interceptor	6x Sleep call for process: powershell.exe modified
19:43:43	API Interceptor	60x Sleep call for process: 342db65350.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
85.28.47.31	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	joom.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/
	6SoKuOqyNh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	CqFFuklrhj.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	85.28.47.31/5499d72b3a3e55be.php
	Jzu7V2qdJx.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31/5499d72b3a3e55be.php
185.215.113.19	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	6SoKuOqyNh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	SecuriteInfo.com.Win32.TrojanX-gen.22664.27275.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	LbMTyCFRzs.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	185.215.113.19/Vi9leo/index.php
	DHBIT8FeuO.exe	Get hash	malicious	Amadey	Browse	185.215.113.19/Vi9leo/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey, SmokeLoader	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	RedLine	Browse	185.215.113.9
	file.exe	Get hash	malicious	RedLine	Browse	185.215.113.9
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://forms.office.com/r/Rv9K1pC66n	Get hash	malicious	Unknown	Browse	204.79.197.237
	https://muscletherapytec.com/wp-admin/bvn2/sprom2/popular/41936a0e62f13ad8ca77add4983dc24b	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://muscletherapytec.com/wp-admin/bvn2/sprom2/popular/4e3ca076003281dc76236e73f1cc5142	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://mega.nz/file/BDtUFLTB#5EiSlR7Iv9EQbSU384OWSKh4fgfl1lGDyJermCYi3Gc	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://muscletherapytec.com/wp-admin/bvn2/sprom2/popular/e5ea942a18732b1311810dd2e55b146b/	Get hash	malicious	Unknown	Browse	13.107.246.44
	https://muscletherapytec.com/wp-admin/bvn2/sprom2/popular/17f299cc4b87de0e07a1fdc16d0d9e99/	Get hash	malicious	Unknown	Browse	13.107.246.60
	setup.exe	Get hash	malicious	MicroClip	Browse	204.79.197.239
	setup.exe	Get hash	malicious	MicroClip	Browse	13.107.21.239
	file.exe	Get hash	malicious	Babadeda	Browse	204.79.197.237
	file.exe	Get hash	malicious	Babadeda	Browse	94.245.104.56
GES-ASRU	file.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	85.28.47.31
	joom.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	6SoKuOqyNh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31
	CqFFuklrhj.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	85.28.47.31
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	85.28.47.31
	Jzu7V2qdJx.exe	Get hash	malicious	Stealc	Browse	85.28.47.31
	file.exe	Get hash	malicious	Python Stealer, Amadey, Babadeda, Monster Stealer, RedLine, Stealc, Vidar	Browse	85.28.47.31
WHOLESALECONNECTIONSNL	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey, SmokeLoader	Browse	185.215.113.16
	setup.exe	Get hash	malicious	Amadey	Browse	185.215.113.19
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	RedLine	Browse	185.215.113.9
	file.exe	Get hash	malicious	RedLine	Browse	185.215.113.9

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	1lKbb2hF7fYToopfpmEvlyRN.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	6SoKuOqyNh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	IRqsWvBBMc.exe	Get hash	malicious	Amadey, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	1lKbb2hF7fYToopfpmEvlyRN.exe	Get hash	malicious	LummaC, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	6SoKuOqyNh.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	IRqsWvBBMc.exe	Get hash	malicious	Amadey, Vidar	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse
	JGKjBsQrMc.exe	Get hash	malicious	Amadey, Babadeda, RedLine, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAFHIIDHJEBFBFIDAKFB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AEGHCFIDAKJEBGCAFBAE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	11781
Entropy (8bit):	5.464142513931946
Encrypted:	false
SSDEEP:	192:vnPOeRnLYbBp69J0aX+H6SEXK5No+K5RHWNBw8dFSl:nDeEJUasoxHEwu0
MD5:	4ECE1227386A2524F9381B344F5C62DD
SHA1:	23C3FFB2F1D45C457A7D9E32156293095A75654F
SHA-256:	1DE3FECADC2DDA8D9FF5E5D73844D77BE5FA240E42ACE9D6A356B720115C8583
SHA-512:	01C5D0E9BF5E8047AE308391460CA9B34B8828FD3EED3DB7E10688A9B2585F2B8D3DB34B8BE6790BB6D86849B15E2418DCDB170878B32286352CF8F64B9ED6E0
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1722037413);..user_pref("app.up

C:\ProgramData\AFIIIIJKFCAAECAKFIEH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BAKEBAFI

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAEGIDHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHIDHIEGIIIECAKEBFBAAEBKFC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECBGCGCGIEGCBFHIIEBFCAFHIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHCFBFBAEBKJKEBGCAEHCFCBAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIIEGDBAEBFIIDHJJJEBAAAKJE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIDHIEGIIIECAKEBFBAAEBKFCF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIJJEGDBFIIDGCAKJEBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJDAKFBFBFBAAAAAEBKJEBKJEG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDGDAAKFHIEHIECAFBAA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IIDHJKFBGIIJJKFIJDBG

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJDBGDGC

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJJJEBGDAFHJEBGDGIJDHCAKJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KECFIDGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFBFCAFCBKFIEBFHIDBAKJJJJE

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_97a671ae5d.exe_7dcb868ca26e3aae60ffda4dccee10c0a07bb282_b2579906_72f508e7-538a-4aa3-9aa5-782ae425d0c5\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9706135853111209
Encrypted:	false
SSDEEP:	192:rlK+ORY0pCIEjEhZrMZtzuiFEZ24IO8y:RcRzpCIEjbTzuiFEY4IO8y
MD5:	61F51A02B2E263F3E87DDF833AB2C707
SHA1:	A14773FDB04787217CDB7E219D724651ADD9BA57
SHA-256:	81398E50ACEFAB2A33021ED611A04F062963E18E8DAD41FB6D010E7F7D7B5779
SHA-512:	C3A09EC3FE676582A1839201B0C5BD773DFF2DC1B7AEE8FFC8D2365CECDF5061E78BAB6F502ECFADF2372AD135D04250426E8A42F69A21E772BEB0AD62D09D99
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.5.1.0.9.8.8.1.1.8.0.3.7.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.5.1.0.9.8.8.4.7.7.4.4.4.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.2.f.5.0.8.e.7.-.5.3.8.a.-.4.a.a.3.-.9.a.a.5.-.7.8.2.a.e.4.2.5.d.0.c.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.7.d.c.c.1.b.4.-.c.d.d.5.-.4.d.4.5.-.b.c.0.c.-.8.f.4.c.6.e.d.7.5.6.5.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.9.7.a.6.7.1.a.e.5.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.1.4.-.0.0.0.1.-.0.0.1.4.-.1.8.b.6.-.a.9.8.f.b.5.d.f.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.4.b.f.2.3.7.6.8.7.6.d.b.2.7.f.6.8.c.6.7.d.b.3.f.2.7.9.e.0.4.4.0.0.0.0.f.f.f.f.!.0.0.0.0.2.1.b.7.f.4.b.c.a.e.0.7.c.8.c.2.2.9.0.3.5.e.f.7.f.5.b.5.3.b.e.2.a.7.f.e.b.c.5.4.!.9.7.a.6.7.1.a.e.5.d...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_97a671ae5d.exe_7dcb868ca26e3aae60ffda4dccee10c0a07bb282_b2579906_82289d7c-8e0e-4049-9eb7-7e6b356408d9\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9638448204806939
Encrypted:	false
SSDEEP:	96:Fi9k8JGPsXhq42Ggf/QXIDcQHc6GcEScw3Vx+HbHgnoW6HeysrLOyKI0ZvXNtZr9:IkTPRY0pCIEjldZrP2azuiFVZ24IO8y
MD5:	24ADCD09429A7A4FB3EFED44326CC059
SHA1:	FE1A5A89120C5992FC7FA98484FF327952614EAB
SHA-256:	ECA72E86B844907562FD157CACC0BAEF0DD40781B0FCD4AE34A857894591998D
SHA-512:	8D71BC6C830763F3F1415049C6352257B91655DEA4018583FDFB28D0A2BA55FD4CA9AE87E4BEFE416DFC0A2F4DF0DCA4AA663913EE1372A9C6ECCDA180B53D37
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.5.1.0.9.9.9.3.7.4.8.3.7.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.5.1.0.9.9.9.8.9.0.4.6.0.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.2.2.8.9.d.7.c.-.8.e.0.e.-.4.0.4.9.-.9.e.b.7.-.7.e.6.b.3.5.6.4.0.8.d.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.2.1.7.9.6.3.3.-.a.3.d.7.-.4.1.a.5.-.9.f.e.b.-.e.d.3.d.5.3.f.3.e.4.5.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.9.7.a.6.7.1.a.e.5.d...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.a.4.-.0.0.0.1.-.0.0.1.4.-.4.2.8.5.-.1.f.9.6.b.5.d.f.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.4.b.f.2.3.7.6.8.7.6.d.b.2.7.f.6.8.c.6.7.d.b.3.f.2.7.9.e.0.4.4.0.0.0.0.f.f.f.f.!.0.0.0.0.2.1.b.7.f.4.b.c.a.e.0.7.c.8.c.2.2.9.0.3.5.e.f.7.f.5.b.5.3.b.e.2.a.7.f.e.b.c.5.4.!.9.7.a.6.7.1.a.e.5.d...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_a3b8183025e5d33eb444661acef6d25a49d72c_864df792_412fbb62-31c0-4596-812f-113c8ca72d34\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1155723559075876
Encrypted:	false
SSDEEP:	192:DTTEhv+PlTtO0cYLHFEE3jEhZrMZm905zuiFEZ24IO8ThB:U+N51cYLHFXjb8ozuiFEY4IO8r
MD5:	264E897F5CEB52E1219080CC54352B66
SHA1:	558C11D8927F34A3F8621AF7722E47C2C10B5940
SHA-256:	2EB27A245B197250C624C742DFA4F61EE5A88C949A4D3098F76C7B6D836B37F4
SHA-512:	18F432E3CDEC0E803BFA3D4EAE117E8DB61B1213BA60A37BFEB05D00E1689A4A8DF589DF2E4352440207AB96A9AEC7DE8241CF56D08F9F9D18836185C4ADC937
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.6.6.5.1.0.9.3.9.7.1.0.9.9.0.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.6.6.5.1.0.9.4.0.5.5.4.7.3.0.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.1.2.f.b.b.6.2.-.3.1.c.0.-.4.5.9.6.-.8.1.2.f.-.1.1.3.c.8.c.a.7.2.d.3.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.b.5.1.4.d.e.7.-.5.6.3.c.-.4.2.6.c.-.b.e.e.4.-.1.7.c.0.f.4.b.c.0.e.c.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.3.8.-.0.0.0.1.-.0.0.1.4.-.4.2.2.0.-.2.8.6.6.b.5.d.f.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.e.4.9.2.d.7.6.8.e.7.9.7.3.1.6.2.4.b.c.d.f.2.e.7.6.1.5.f.9.1.8.0.0.0.0.f.f.f.f.!.0.0.0.0.2.1.b.7.f.4.b.c.a.e.0.7.c.8.c.2.2.9.0.3.5.e.f.7.f.5.b.5.3.b.e.2.a.7.f.e.b.c.5.4.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.7.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9EEA.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Jul 26 23:43:08 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	64433
Entropy (8bit):	2.0507627045766035
Encrypted:	false
SSDEEP:	384:hcFJekESYC90lP16mkqaB8ZQYV9u/zz0Yg6vfUOTO:SFJekEPPP8B7Tb+WfU6O
MD5:	FB63308C5EB74C874B76FA8D8AA75711
SHA1:	60D1C1F7EC3ADC2C2A4D177A9B153B862E2A411A
SHA-256:	B2372577F54C9A195F519CACCE96AD8027B6A74B539E6EA7DC825CDD49F2CAE8
SHA-512:	559AC85220C250475CA9B26A5CB6ABEC16C90B8029C37E75627334CA9C0B85815F653653ED53ECECD39D0C9CD18CC23DE2E2D44C212E4244BF598C8E05CC32B0
Malicious:	false
Preview:	MDMP..a..... ........4.f............4...............<.......D....*..........T.......8...........T............3..........................................................................................................eJ......H.......GenuineIntel............T............4.f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9F58.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8328
Entropy (8bit):	3.69452293631531
Encrypted:	false
SSDEEP:	192:R6l7wVeJVv66zUb36Y4u68gCdgmfSvqpDT89b7HsfzJm:R6lXJd60Ub6YB68gCdgmfSL7MfQ
MD5:	4CB1722E49B5CE1426346EBA50C2F713
SHA1:	3D5197F4E71FE6B76ED308FE22B7BB70F1EF4DD5
SHA-256:	504B0148D2FBC4AFDC3C2A8069F7CA178B2C42D6CED1B51CF0237ABBCB3C685E
SHA-512:	B659C08BA6A82FC93FA42DC17207B9AC56175BC4A09F036345E066C6CA0F4068BE1B1CFB841B88D03B36A66FE06BEC051D59A70D633E6F32E5CBFED7DAF43DF7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9F88.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4583
Entropy (8bit):	4.445069678257119
Encrypted:	false
SSDEEP:	48:cvIwWl8zsiJg77aI9C9WpW8VYIYm8M4JMzZnFto4+q8JYCcltNNSBuSbd:uIjfwI7sM7VAJspGcPNIBBbd
MD5:	3084BE7B52D9F41990A7D76ED9FBA325
SHA1:	C9C6786B4FF7BFC9C551F46AF79703C9A5423BDA
SHA-256:	753438B1445AAF1DFFA1C58AD9B7DE6716C00D91EC2F054982D2F726EFDC1F88
SHA-512:	851A671B72AEF60326E80140DE0E61EE07F1EA5AD66EBB036C0D0751B0400D6724501CAA6D7501190F8346CB9F15DBFCF7DB45AB9A501560F609E032139F925E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="428565" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCAEB.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Jul 26 23:43:19 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	63937
Entropy (8bit):	2.032922422919212
Encrypted:	false
SSDEEP:	192:jV8XifhMj2w7XMlvOwOJwhG0dhhgSXAYDiYTFHPIcQODGKWqTu9Xmbk+fzSzT8CY:B3hMCmwEAPdhhgiR4+6wbkWlF5lecP
MD5:	68A8D9C4E75CA96D02239F850FE4826C
SHA1:	084178660427FB945D218930B327D54199A09C6B
SHA-256:	C6C3C4DC9117494AA5A8366CBFAFAB60E34EE034A3E5A2B0B1AD00492C2DCC88
SHA-512:	D7C802E5C13F4DCA4DDE0CA9069D332CFA04D91225EF193D4A4C2AEACA6890F2EE219B59D0661A693981E97D6A6EAC772614B90BB4C901745CC8B485AFE4BF76
Malicious:	false
Preview:	MDMP..a..... ........4.f............4...............<.......D...0*..........T.......8...........T............2..............X...........D...............................................................................eJ..............GenuineIntel............T............4.f............................. ..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCB88.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8342
Entropy (8bit):	3.6976080341902575
Encrypted:	false
SSDEEP:	192:R6l7wVeJ2c6My46YEIPSUjgmfSvqpD089bDfsf1hm:R6lXJt6My46YEASUjgmfS+DEfK
MD5:	A92A77CCC70771A75D98DCD6D701CEDC
SHA1:	6D503DDEF52DA420005B1F0D1F9847753EB25ED8
SHA-256:	E7C21E8142BBF88F4018CCA4A608DB232FD6CC193DD005ADD55AE7D766846EFF
SHA-512:	126627D6873F5FDC9C193B20E04A56F1D62686E28E20E5F05691A59CD864C5A85B6E2E1B3E56066670AA6EA8991020B00C08122D8897F484E9970964906FAA26
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.3.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCBD8.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4583
Entropy (8bit):	4.444992679171057
Encrypted:	false
SSDEEP:	48:cvIwWl8zs3Jg77aI9C9WpW8VYtYm8M4JMzZnFvS+q8JYZltNNSBuSEd:uIjfZI7sM7VJJWSVPNIBBEd
MD5:	4199515B2FE1016A9AA2D8CE67DC4739
SHA1:	E8E3CF54B5E87E66765ECB1B6009B59E6F5923A2
SHA-256:	F7C9E88B26BD1932A9496ACE6AE67D6AC8FF58ACC0BB4B156D9B7F49B9528CDE
SHA-512:	3B300EFD0D17D0DE8DDDA13701A5CAF1FB0D60AC2C5C4778778F718BB877F2DD3487D12F809DBFA3BA8A70F508848758D50717F306A0C1D03DB42F35F40A9623
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="428566" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE1D3.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Jul 26 23:42:20 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	60553
Entropy (8bit):	2.748390649082903
Encrypted:	false
SSDEEP:	384:LrmAZ+FRUkEWhRQl23yIldVkiayYY9SlCw6YFzK:LqAoPUkEWD3hSia8UCwZe
MD5:	8957DA4A66DAC8C3ADC25440BCCE2250
SHA1:	FCA3CF7BB6BB76B9364987D8381F910EF6309DF3
SHA-256:	0810E1AEFF2791B31F2560DC18A69BACC97269B68353D7B6B25BC61462BFD651
SHA-512:	6930663F27EE781A35D27BA21211F13AC05DB0C1C3FD25CF2EC112E4D6A1B4CDFD71A4ADB87C87E8671AD127ED160857CBC873BE10D1F654F18038A6E7D6A828
Malicious:	false
Preview:	MDMP..a..... .......\4.f............4...............<.......D....7..........T.......8...........T............_...............&...........(..............................................................................eJ......h)......GenuineIntel............T.......8...C4.f.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE407.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8312
Entropy (8bit):	3.6929179263315755
Encrypted:	false
SSDEEP:	192:R6l7wVeJjCn6pBi6YEIjFSUlWgmfB1i3+GVpD089bgxsfegm:R6lXJG6pU6YEkFSUlWgmf+3+egqfA
MD5:	E6E4A9283440A3B2FA8901C836838CD0
SHA1:	D6AD0012DDDF0DB23360083A98260B70FDD624FB
SHA-256:	CBDEDB3CF034C693776D3E67F81E3CC0767DD0788A1B32A390BEE4D8AC7D4B9F
SHA-512:	3D13C6DADB63757EE02346B5091D72FD12B2ECDE782A5CC91AD60A99C9B59740D806F7447AFDDF5E7DFEEEBB332212D610B833FF90DB6B2CE8568AE09DD0AC23
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.4.5.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE427.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4537
Entropy (8bit):	4.422670104821241
Encrypted:	false
SSDEEP:	48:cvIwWl8zsiJg77aI9C9WpW8VY5Ym8M4JWdFpFo+q80u53SBPid:uIjfwI7sM7VhJAFoU53SBPid
MD5:	6AD36DFCD5CF997C676CA839389B6BAB
SHA1:	27985E0C9945E0AB94AB6C48B1F513EAEFEF2F3A
SHA-256:	9BFF408E352E92E3099462769F56A946D4C76F905A4B39F51D3A39F0F23E352C
SHA-512:	74C35B502FE96908F0533F06AD27FFF1CD65693053EBB839EDCCEF539C007FAA52ABFE0E346D65BD924F7D71D492AFF3F1B28E05EFB4E71AA582624060BD9059
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="428565" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 1lKbb2hF7fYToopfpmEvlyRN.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 6SoKuOqyNh.exe, Detection: malicious, Browse Filename: IRqsWvBBMc.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: JGKjBsQrMc.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 1lKbb2hF7fYToopfpmEvlyRN.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 6SoKuOqyNh.exe, Detection: malicious, Browse Filename: IRqsWvBBMc.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: JGKjBsQrMc.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\userGCAFCAFHJJ.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1922560
Entropy (8bit):	7.950908898530812
Encrypted:	false
SSDEEP:	49152:0/5azCrhk4Q8UTiDoqoxhloaHALny4G4217:0/5azt4Q8UTiDV2loXnxG9
MD5:	AC2D65E997C85BE5D4D2807C12BAB4E8
SHA1:	B766BBEC104FCAB185A79C79461BA7114BC1F4E8
SHA-256:	1C82687004957253FB6737FC4B6000C86257835C7D8C642BFE92FD420A015262
SHA-512:	CB22A70491A16E49DF693CEAACDB074FBF1D6C0E8A19507A578D1B51FC2F0E730301F49D63A388F4D027AA5DE0E3CF4ECF3456027C4C83B082BF59671B2F8CE4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f.............................@L...........@..........................pL......+....@.................................W...k............................&L..............................&L..................................................... . ............................@....rsrc...............................@....idata ............................@... .@+.........................@...rkxzdssx.@....1..:..................@...opdalfsp.....0L.....................@....taggant.0...@L.."...4..............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3094
Entropy (8bit):	5.33145931749415
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0atTqdqlq7qV
MD5:	3FD5C0634443FB2EF2796B9636159CB6
SHA1:	366DDE94AEFCFFFAB8E03AD8B448E05D7489EB48
SHA-256:	58307E94C67E2348F5A838DE4FF668983B38B7E9A3B1D61535D3A392814A57D6
SHA-512:	8535E7C0777C6B0876936D84BDE2BDC59963CF0954D4E50D65808E6E806E8B131DF5DB8FA0E030FAE2702143A7C3A70698A2B9A80519C9E2FFC286A71F0B797C
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\build[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	11267584
Entropy (8bit):	7.997463890942098
Encrypted:	true
SSDEEP:	196608:SnvxO+j9q6y7PuZANMCgvUF+j6yrO5H+KB4kj6vgC51U7BlUdinrDRQF6f1:WvxPBly7Pumdgv9RrOF+LkGvgMGBa4n7
MD5:	C8CF26425A6CE325035E6DA8DFB16C4E
SHA1:	31C2B3A26C05B4BF8DEA8718D1DF13A0C2BE22EE
SHA-256:	9F7BE9BF913D8378F094B3F6416DB9AA4C80C380000202F7CFADDADB6EFC41B4
SHA-512:	0321E48E185C22165AC6429E08AFAC1CCFDF393249436C8EAC8A6D64794B3B399740AA5B2BE23D568F57495D17E9220280ED1C2EA8F012B2C4021BEB02CBC646
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...*..f...............)......................@..........................................`... ..............................................P..........@......(............p..............................@...(...................hS...............................text...............................`..`.data...............................@....rdata..P+.......,..................@..@.eh_fram............................@....pdata..(...........................@..@.xdata....... ......................@..@.bss.........0...........................idata.......P......................@....CRT....`....`......................@....tls.........p......................@....rsrc...@.........................@..@.reloc.......p.....................@..B................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\pered[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11437924
Entropy (8bit):	7.993860126356866
Encrypted:	true
SSDEEP:	196608:I3pwZJjbyU3b01Kpn3V+uq+VvpqL2Vmd6+Dfc/f/+SveM0EVRuvEKn:uSZL01+l+uq+VvIL2Vmd6mfc/e03RMZ
MD5:	FAF1270013C6935AE2EDAF8E2C2B2C08
SHA1:	D9A44759CD449608589B8F127619D422CCB40AFA
SHA-256:	1011889E66C56FD137BF85B832C4AFC1FD054222B2FCBAAE6608836D27E8F840
SHA-512:	4A9CA18F796D4876EFFC5692CFEB7CE6D1CFFDD2541B68753F416D2B0A7EFF87588BC05793145A2882FC62A48512A862FA42826761022FED1696C20864C89098
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:.f}i.f}i.f}i..~h.f}i..xhSf}i..yh.f}i...i.f}i..xh.f}i..yh.f}i..~h.f}i..\|h.f}i.f\|igf}i..yh.f}i...h.f}iRich.f}i........................PE..d...pZ.f..........".... .....\.................@.............................0......p....`.....................................................x.... ........... ........... ..X... ...................................@............................................text... ........................... ..`.rdata...*.......,..................@..@.data...............................@....pdata... ......."..................@..@_RDATA..\...........................@..@.rsrc........ ......................@..@.reloc..X.... ......................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257024
Entropy (8bit):	5.977391135328092
Encrypted:	false
SSDEEP:	3072:wCOU4fRBfg3ENpgjcuGUSqhGerZg0F+DqV87clD4viAcs:rJ4frpG1PJLOqrDS
MD5:	D0FCC1D2AD23B05B53EEFE1137594DDB
SHA1:	21B7F4BCAE07C8C229035EF7F5B53BE2A7FEBC54
SHA-256:	367699D2C1F464B4C508846DE8E1A760DF77756492A2503C49A9086A374B5EF0
SHA-512:	53E0F35C685D53E85C7DC824B284FD7EEF3C26545BB4571F17354C3730B61AE8EDBD760B0BDDAE8F6D9853EF2C66FBA243061A3A179A68FA558E97B7EE10D48B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Tg.s... ... ... .pQ ... .pd ... .pP t.. .~i ... ... d.. .pU ... .p` ... .pg ... Rich... ........PE..L....3zd............................. .......0....@.................................Zq.......................................X..x...................................\Y...............................S..@............0...............................text............................... ..`.rdata...2...0...4..................@..@.data........p.......P..............@....maduco..............,..............@..@.gubogus.............0..............@....rsrc................4..............@..@................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\buildred[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	311296
Entropy (8bit):	5.081451547709962
Encrypted:	false
SSDEEP:	3072:aq6EgY6igrUjsgMmwPPoDqeRFSCotTAbtAYKtJcZqf7D341eqiOLibBOU:ZqY6iXwPwuaFjGTARANJcZqf7DIfL
MD5:	4E0235942A9CDE99EE2EE0EE1A736E4F
SHA1:	D084D94DF2502E68EE0443B335DD621CD45E2790
SHA-256:	A0D7BC2CCF07AF7960C580FD43928B5FB02B901F9962EAFB10F607E395759306
SHA-512:	CFC4B7D58F662EE0789349B38C1DEC0C4E6DC1D2E660F5D92F8566D49C4850B2BF1D70E43EDF84DB7B21CB8E316E8BCC3E20B797E32D9668C69A029B15804E3F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\buildred[1].exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...G.................0.................. ... ....@.. ....................... ............@.................................P...O.... ..............................4................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\crypteda[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1464832
Entropy (8bit):	7.929603549541649
Encrypted:	false
SSDEEP:	24576:HFTGHKQCRBkD/5vn3MdVu9VNY5oofD0f8jKchmlZ38HKlzNCPvk8IjOz4H0czmue:pGHW7E/5/kVQDooorBvmnVovHIakHVmH
MD5:	04E90B2CF273EFB3F6895CFCEF1E59BA
SHA1:	79AFCC39DB33426EE8B97AD7BFB48F3F2E4C3449
SHA-256:	E015F535C8A9FAB72F2E06863C559108B1A25AF90468CB9F80292C3BA2C33F6E
SHA-512:	72AA08242507F6DD39822A34C68D6185927F6772A3FC03A0850D7C8542B21A43E176F29E5FBB3A4E54BC02FA68C807A01091158EF68C5A2F425CC432C95EA555
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g.X.............t.......t.......t.......t..............n.......n.......n......._......._......._.......Rich............................PE..L....].f...............'.:...,......A........`....@.......................................@.................................x...(...............................d ..H...................................@............`..l............................text...G1.......2.................. ..`.zzZ.... ....P.......6.............. ..`.rdata......`.......>..............@..@.data....T... ...F..................@....reloc..d ......."...8..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\gawdth[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	920382
Entropy (8bit):	6.472374354214049
Encrypted:	false
SSDEEP:	24576:juDXTIGaPhEYzUzA0aouDXTIGaPhEYzUzA0br:KDjlabwz9MDjlabwz93
MD5:	C02798B26BDAF8E27C1C48EF5DE4B2C3
SHA1:	BC59AB8827E13D1A9A1892EB4DA9CF2D7D62A615
SHA-256:	AF41B9AC95C32686BA1EF373929B54F49088E5C4F295FE828B43B32B5160AA78
SHA-512:	B541AEEDCC4DB6F8E0DB0788F2791339476A863C15EFC72AEF3DB916FC7C8AB41D84C0546C05B675BE4D7700C4F986DBAE5E2858D60ECD44B4FFBCAE2065CFC4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i..i.\.i..b.\.i..g.\.`.].C.\..Y.R.\..\.a.\...a.\..^.a.\.Rich`.\.........PE..d...#.@f.........."....!.h.....................@..........................................`.............................................4......P.......\|.......l0..............p....6..T....................7..(......@....................... ....................text...ng.......h.................. ..`.rdata...(.......*...l..............@..@.data...\...........................@....pdata..l0.......2..................@..@.didat..`...........................@..._RDATA..\...........................@..@.rsrc...\|...........................@..@.reloc..p...........................@..B........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1897472
Entropy (8bit):	7.949701996348257
Encrypted:	false
SSDEEP:	49152:jBdwMerCYAiL+O4QL3rXc1gppowZocEZxbI:wMkCxiLzzrs1gp+JcCxM
MD5:	DFA220EFB513FE8F746AB0B1CD410F08
SHA1:	AEE474375A70F0C3076CBE90C0F536C77D8CFD93
SHA-256:	32FE15F8671860B82039D80651F5A7977D26A3CD1CB26BA87960EB723E675134
SHA-512:	7409C33205B0B39BA1AC2513904356974877156907FAF4DF56D7EA2CF3B981036C5C57FF1A47FE826C2A904AA04B18826F14569201FF5FEF2A30EEF16AFFDCC4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....A.f............................. K...........@..........................PK...........@.................................W...k.............................K.............................H.K..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...jnaccepv.....01.....................@...oirghrul......K.....................@....taggant.0... K.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\2[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	6.278028630601556
Encrypted:	false
SSDEEP:	3072:xCVuay93ubwEso9cGc7TwfWAVHm6Kb4tntz++oAkVd5tdsqQ:scay93GwEsSYsfWpGjS9AkDnOV
MD5:	E1AF11811CF628021B8CC6DF11371057
SHA1:	6D60ADBA0A6C0A50C2CF549F77A88F15616062AE
SHA-256:	61A703EF973C68D96C9C90B59EF33E2C38DF17945F8FDA96E7B86E432D253308
SHA-512:	77ECDCBB1EE95F48C0E62523C9CF8F03D8E1B381AF518CA300BFF1D3E7620B1BF3DFD42647AAE44EBBDFF8416FC3D565FF5C04B4DB806A683B1563B378EDD802
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Tg.s... ... ... .pQ ... .pd ... .pP t.. .~i ... ... d.. .pU ... .p` ... .pg ... Rich... ........PE..L.....ge............................. ............@..........................@..................................................x...................................\...................................@............................................text...@........................... ..`.rdata...2.......4..................@..@.data........0......................@....kic.........`......................@..@.yuh.........p......................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\2020[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12946352
Entropy (8bit):	7.987996422721966
Encrypted:	false
SSDEEP:	393216:kzuRUAwf7vLF4NkW+eGQR6n/ikWMWfogBIv:kzuRIx1W+e5R4qPDXe
MD5:	95606667AC40795394F910864B1F8CC4
SHA1:	E7DE36B5E85369D55A948BEDB2391F8FAE2DA9CF
SHA-256:	6F2964216C81A6F67309680B7590DFD4DF31A19C7FC73917FA8057B9A194B617
SHA-512:	FAB43D361900A8D7F1A17C51455D4EEDBBD3AEC23D11CDB92EC1FB339FC018701320F18A2A6B63285AAAFAFEA30FA614777D30CDF410FFD7698A48437760A142
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Xhc.Xhc.Xhc...`._hc...f..hc...g.Rhc...[hc..`.Qhc..g.Ihc..f.phc...b.Shc.Xhb..hc.K.g.Ahc.K.a.Yhc.RichXhc.........PE..d....j.f.........."....(.......................@..........................................`.................................................l...x........+...`..."..............h.......................................@...............P............................text............................... ..`.rdata..B&.......(..................@..@.data....s..........................@....pdata..."...`...$..................@..@.rsrc....+.......,..................@..@.reloc..h...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\25072023[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	311296
Entropy (8bit):	5.081927371705491
Encrypted:	false
SSDEEP:	3072:aq6EgY6iQrUjGk14lwPK4qw9LwwPITAztASKwlcZqf7D34leqiOLibBOh:ZqY6iwwPIknATAZA+lcZqf7DIvL
MD5:	A9A37926C6D3AB63E00B12760FAE1E73
SHA1:	944D6044E111BBAD742D06852C3ED2945DC9E051
SHA-256:	27955C80C620C31DF686CCD2A92BCE1D07E97C16FDA6BD141812E9B0BDD7B06B
SHA-512:	575485D1C53B1BF145C7385940423B16089CF9AB75404E2E9C7AF42B594480470F0E28DADCDDBD66E4CD469E45326A6EB4EB2362CCC37EDB2A956D224E04CF97
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\25072023[1].exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B.................0................. ... ....@.. ....................... ............@.................................t...O.... ..............................X................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\5447jsX[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	401920
Entropy (8bit):	7.46202558733713
Encrypted:	false
SSDEEP:	6144:VykkCFQ1esX/lLdp9k/dO/Yu0u9KIv7AGjTm7iIJ3Aqu4lQdvqb:lkUQ1esP01uYu0u9n08m/xV
MD5:	5DD9C1FFC4A95D8F1636CE53A5D99997
SHA1:	38AE8BF6A0891B56EF5FF0C1476D92CECAE34B83
SHA-256:	D695267DE534C2C99EC2823ACC193FDBEC9F398B0F78155AE2B982457FF631AA
SHA-512:	148D1B324391C4BB63B152A3C91A586B6821C4F5CDE2A3F7AFA56AD92074672619554FBA3B2BACA9802FF1ED9B42081574163304D450F7CCF664638599B23C2A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g.X.............t.......t.......t.......t..............n.......n.......n......._......._......._.......Rich............................PE..L...k\.f...............'.:..........A........`....@..........................p............@.................................x...(............................@..\ ..H...................................@............`..l............................text...G1.......2.................. ..`.zzZ.... ....P.......6.............. ..`.rdata......`.......>..............@..@.data...\|.... ......................@....reloc..\ ...@..."..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\crypted[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	967168
Entropy (8bit):	7.283234984449825
Encrypted:	false
SSDEEP:	24576:TwGArtsJR9XoZ6vuES4K316MxyeV+xQQjTP6hW:TxJR9XoZ6vPMUeVjeb
MD5:	371D606AA2FCD2945D84A13E598DA55F
SHA1:	0F8F19169F79B3933D225A2702DC51F906DE4DCD
SHA-256:	59C6D955B28461CD8D1F8F8C9A97D4F7A2E741DD62C69E67F0B71ECB3F7F040A
SHA-512:	01C5B0AFD03518406FA452CBB79D452865C6DAF0140F32AD4B78E51A0B786F6C19BBA46A4D017DCDCC37D6EDF828F0C87249964440E2ABBFB42A437E1CFD91A4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........xl...?...?...?W..>...?W..>...?W..>...?F..>...?W..>...?...?...?F..>..?F..>...?w..>...?w..?...?w..>...?Rich...?........PE..L......f...............'.r...d....................@.......................... ............@.....................................<................................P...1..T....................2.......0..@............................................text....p.......r.................. ..`.rdata..l'.......(...v..............@..@.data...............................@....rsrc................n..............@..@.reloc...P.......R...p..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	11267584
Entropy (8bit):	7.997463890942098
Encrypted:	true
SSDEEP:	196608:SnvxO+j9q6y7PuZANMCgvUF+j6yrO5H+KB4kj6vgC51U7BlUdinrDRQF6f1:WvxPBly7Pumdgv9RrOF+LkGvgMGBa4n7
MD5:	C8CF26425A6CE325035E6DA8DFB16C4E
SHA1:	31C2B3A26C05B4BF8DEA8718D1DF13A0C2BE22EE
SHA-256:	9F7BE9BF913D8378F094B3F6416DB9AA4C80C380000202F7CFADDADB6EFC41B4
SHA-512:	0321E48E185C22165AC6429E08AFAC1CCFDF393249436C8EAC8A6D64794B3B399740AA5B2BE23D568F57495D17E9220280ED1C2EA8F012B2C4021BEB02CBC646
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...*..f...............)......................@..........................................`... ..............................................P..........@......(............p..............................@...(...................hS...............................text...............................`..`.data...............................@....rdata..P+.......,..................@..@.eh_fram............................@....pdata..(...........................@..@.xdata....... ......................@..@.bss.........0...........................idata.......P......................@....CRT....`....`......................@....tls.........p......................@....rsrc...@.........................@..@.reloc.......p.....................@..B................................................................................................................................

C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe

Download File

Process:	C:\Users\user\AppData\RoamingIDBGHDGHCG.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1897472
Entropy (8bit):	7.949701996348257
Encrypted:	false
SSDEEP:	49152:jBdwMerCYAiL+O4QL3rXc1gppowZocEZxbI:wMkCxiLzzrs1gp+JcCxM
MD5:	DFA220EFB513FE8F746AB0B1CD410F08
SHA1:	AEE474375A70F0C3076CBE90C0F536C77D8CFD93
SHA-256:	32FE15F8671860B82039D80651F5A7977D26A3CD1CB26BA87960EB723E675134
SHA-512:	7409C33205B0B39BA1AC2513904356974877156907FAF4DF56D7EA2CF3B981036C5C57FF1A47FE826C2A904AA04B18826F14569201FF5FEF2A30EEF16AFFDCC4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....A.f............................. K...........@..........................PK...........@.................................W...k.............................K.............................H.K..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...jnaccepv.....01.....................@...oirghrul......K.....................@....taggant.0... K.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000001001\build.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	11267584
Entropy (8bit):	7.997463890942098
Encrypted:	true
SSDEEP:	196608:SnvxO+j9q6y7PuZANMCgvUF+j6yrO5H+KB4kj6vgC51U7BlUdinrDRQF6f1:WvxPBly7Pumdgv9RrOF+LkGvgMGBa4n7
MD5:	C8CF26425A6CE325035E6DA8DFB16C4E
SHA1:	31C2B3A26C05B4BF8DEA8718D1DF13A0C2BE22EE
SHA-256:	9F7BE9BF913D8378F094B3F6416DB9AA4C80C380000202F7CFADDADB6EFC41B4
SHA-512:	0321E48E185C22165AC6429E08AFAC1CCFDF393249436C8EAC8A6D64794B3B399740AA5B2BE23D568F57495D17E9220280ED1C2EA8F012B2C4021BEB02CBC646
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...*..f...............)......................@..........................................`... ..............................................P..........@......(............p..............................@...(...................hS...............................text...............................`..`.data...............................@....rdata..P+.......,..................@..@.eh_fram............................@....pdata..(...........................@..@.xdata....... ......................@..@.bss.........0...........................idata.......P......................@....CRT....`....`......................@....tls.........p......................@....rsrc...@.........................@..@.reloc.......p.....................@..B................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000002001\crypted.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	967168
Entropy (8bit):	7.283234984449825
Encrypted:	false
SSDEEP:	24576:TwGArtsJR9XoZ6vuES4K316MxyeV+xQQjTP6hW:TxJR9XoZ6vPMUeVjeb
MD5:	371D606AA2FCD2945D84A13E598DA55F
SHA1:	0F8F19169F79B3933D225A2702DC51F906DE4DCD
SHA-256:	59C6D955B28461CD8D1F8F8C9A97D4F7A2E741DD62C69E67F0B71ECB3F7F040A
SHA-512:	01C5B0AFD03518406FA452CBB79D452865C6DAF0140F32AD4B78E51A0B786F6C19BBA46A4D017DCDCC37D6EDF828F0C87249964440E2ABBFB42A437E1CFD91A4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........xl...?...?...?W..>...?W..>...?W..>...?F..>...?W..>...?...?...?F..>..?F..>...?w..>...?w..?...?w..>...?Rich...?........PE..L......f...............'.r...d....................@.......................... ............@.....................................<................................P...1..T....................2.......0..@............................................text....p.......r.................. ..`.rdata..l'.......(...v..............@..@.data...............................@....rsrc................n..............@..@.reloc...P.......R...p..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	401920
Entropy (8bit):	7.46202558733713
Encrypted:	false
SSDEEP:	6144:VykkCFQ1esX/lLdp9k/dO/Yu0u9KIv7AGjTm7iIJ3Aqu4lQdvqb:lkUQ1esP01uYu0u9n08m/xV
MD5:	5DD9C1FFC4A95D8F1636CE53A5D99997
SHA1:	38AE8BF6A0891B56EF5FF0C1476D92CECAE34B83
SHA-256:	D695267DE534C2C99EC2823ACC193FDBEC9F398B0F78155AE2B982457FF631AA
SHA-512:	148D1B324391C4BB63B152A3C91A586B6821C4F5CDE2A3F7AFA56AD92074672619554FBA3B2BACA9802FF1ED9B42081574163304D450F7CCF664638599B23C2A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g.X.............t.......t.......t.......t..............n.......n.......n......._......._......._.......Rich............................PE..L...k\.f...............'.:..........A........`....@..........................p............@.................................x...(............................@..\ ..H...................................@............`..l............................text...G1.......2.................. ..`.zzZ.... ....P.......6.............. ..`.rdata......`.......>..............@..@.data...\|.... ......................@....reloc..\ ...@..."..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1464832
Entropy (8bit):	7.929603549541649
Encrypted:	false
SSDEEP:	24576:HFTGHKQCRBkD/5vn3MdVu9VNY5oofD0f8jKchmlZ38HKlzNCPvk8IjOz4H0czmue:pGHW7E/5/kVQDooorBvmnVovHIakHVmH
MD5:	04E90B2CF273EFB3F6895CFCEF1E59BA
SHA1:	79AFCC39DB33426EE8B97AD7BFB48F3F2E4C3449
SHA-256:	E015F535C8A9FAB72F2E06863C559108B1A25AF90468CB9F80292C3BA2C33F6E
SHA-512:	72AA08242507F6DD39822A34C68D6185927F6772A3FC03A0850D7C8542B21A43E176F29E5FBB3A4E54BC02FA68C807A01091158EF68C5A2F425CC432C95EA555
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g.X.............t.......t.......t.......t..............n.......n.......n......._......._......._.......Rich............................PE..L....].f...............'.:...,......A........`....@.......................................@.................................x...(...............................d ..H...................................@............`..l............................text...G1.......2.................. ..`.zzZ.... ....P.......6.............. ..`.rdata......`.......>..............@..@.data....T... ...F..................@....reloc..d ......."...8..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000005001\2.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	6.278028630601556
Encrypted:	false
SSDEEP:	3072:xCVuay93ubwEso9cGc7TwfWAVHm6Kb4tntz++oAkVd5tdsqQ:scay93GwEsSYsfWpGjS9AkDnOV
MD5:	E1AF11811CF628021B8CC6DF11371057
SHA1:	6D60ADBA0A6C0A50C2CF549F77A88F15616062AE
SHA-256:	61A703EF973C68D96C9C90B59EF33E2C38DF17945F8FDA96E7B86E432D253308
SHA-512:	77ECDCBB1EE95F48C0E62523C9CF8F03D8E1B381AF518CA300BFF1D3E7620B1BF3DFD42647AAE44EBBDFF8416FC3D565FF5C04B4DB806A683B1563B378EDD802
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Tg.s... ... ... .pQ ... .pd ... .pP t.. .~i ... ... d.. .pU ... .p` ... .pg ... Rich... ........PE..L.....ge............................. ............@..........................@..................................................x...................................\...................................@............................................text...@........................... ..`.rdata...2.......4..................@..@.data........0......................@....kic.........`......................@..@.yuh.........p......................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000009001\25072023.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	311296
Entropy (8bit):	5.081927371705491
Encrypted:	false
SSDEEP:	3072:aq6EgY6iQrUjGk14lwPK4qw9LwwPITAztASKwlcZqf7D34leqiOLibBOh:ZqY6iwwPIknATAZA+lcZqf7DIvL
MD5:	A9A37926C6D3AB63E00B12760FAE1E73
SHA1:	944D6044E111BBAD742D06852C3ED2945DC9E051
SHA-256:	27955C80C620C31DF686CCD2A92BCE1D07E97C16FDA6BD141812E9B0BDD7B06B
SHA-512:	575485D1C53B1BF145C7385940423B16089CF9AB75404E2E9C7AF42B594480470F0E28DADCDDBD66E4CD469E45326A6EB4EB2362CCC37EDB2A956D224E04CF97
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\1000009001\25072023.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...B.................0................. ... ....@.. ....................... ............@.................................t...O.... ..............................X................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000010001\pered.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11437924
Entropy (8bit):	7.993860126356866
Encrypted:	true
SSDEEP:	196608:I3pwZJjbyU3b01Kpn3V+uq+VvpqL2Vmd6+Dfc/f/+SveM0EVRuvEKn:uSZL01+l+uq+VvIL2Vmd6mfc/e03RMZ
MD5:	FAF1270013C6935AE2EDAF8E2C2B2C08
SHA1:	D9A44759CD449608589B8F127619D422CCB40AFA
SHA-256:	1011889E66C56FD137BF85B832C4AFC1FD054222B2FCBAAE6608836D27E8F840
SHA-512:	4A9CA18F796D4876EFFC5692CFEB7CE6D1CFFDD2541B68753F416D2B0A7EFF87588BC05793145A2882FC62A48512A862FA42826761022FED1696C20864C89098
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:.f}i.f}i.f}i..~h.f}i..xhSf}i..yh.f}i...i.f}i..xh.f}i..yh.f}i..~h.f}i..\|h.f}i.f\|igf}i..yh.f}i...h.f}iRich.f}i........................PE..d...pZ.f..........".... .....\.................@.............................0......p....`.....................................................x.... ........... ........... ..X... ...................................@............................................text... ........................... ..`.rdata...*.......,..................@..@.data...............................@....pdata... ......."..................@..@_RDATA..\...........................@..@.rsrc........ ......................@..@.reloc..X.... ......................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000012001\2020.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12946352
Entropy (8bit):	7.987996422721966
Encrypted:	false
SSDEEP:	393216:kzuRUAwf7vLF4NkW+eGQR6n/ikWMWfogBIv:kzuRIx1W+e5R4qPDXe
MD5:	95606667AC40795394F910864B1F8CC4
SHA1:	E7DE36B5E85369D55A948BEDB2391F8FAE2DA9CF
SHA-256:	6F2964216C81A6F67309680B7590DFD4DF31A19C7FC73917FA8057B9A194B617
SHA-512:	FAB43D361900A8D7F1A17C51455D4EEDBBD3AEC23D11CDB92EC1FB339FC018701320F18A2A6B63285AAAFAFEA30FA614777D30CDF410FFD7698A48437760A142
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Xhc.Xhc.Xhc...`._hc...f..hc...g.Rhc...[hc..`.Qhc..g.Ihc..f.phc...b.Shc.Xhb..hc.K.g.Ahc.K.a.Yhc.RichXhc.........PE..d....j.f.........."....(.......................@..........................................`.................................................l...x........+...`..."..............h.......................................@...............P............................text............................... ..`.rdata..B&.......(..................@..@.data....s..........................@....pdata..."...`...$..................@..@.rsrc....+.......,..................@..@.reloc..h...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000014001\gawdth.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	920382
Entropy (8bit):	6.472374354214049
Encrypted:	false
SSDEEP:	24576:juDXTIGaPhEYzUzA0aouDXTIGaPhEYzUzA0br:KDjlabwz9MDjlabwz93
MD5:	C02798B26BDAF8E27C1C48EF5DE4B2C3
SHA1:	BC59AB8827E13D1A9A1892EB4DA9CF2D7D62A615
SHA-256:	AF41B9AC95C32686BA1EF373929B54F49088E5C4F295FE828B43B32B5160AA78
SHA-512:	B541AEEDCC4DB6F8E0DB0788F2791339476A863C15EFC72AEF3DB916FC7C8AB41D84C0546C05B675BE4D7700C4F986DBAE5E2858D60ECD44B4FFBCAE2065CFC4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$.2.`.\.`.\.`.\..y..h.\..y....\..y..m.\.....b.\...X.r.\..._.j.\...Y.Y.\.i..i.\.i..b.\.i..g.\.`.].C.\..Y.R.\..\.a.\...a.\..^.a.\.Rich`.\.........PE..d...#.@f.........."....!.h.....................@..........................................`.............................................4......P.......\|.......l0..............p....6..T....................7..(......@....................... ....................text...ng.......h.................. ..`.rdata...(.......*...l..............@..@.data...\...........................@....pdata..l0.......2..................@..@.didat..`...........................@..._RDATA..\...........................@..@.rsrc...\|...........................@..@.reloc..p...........................@..B........................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000027001\buildred.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	311296
Entropy (8bit):	5.081451547709962
Encrypted:	false
SSDEEP:	3072:aq6EgY6igrUjsgMmwPPoDqeRFSCotTAbtAYKtJcZqf7D341eqiOLibBOU:ZqY6iXwPwuaFjGTARANJcZqf7DIfL
MD5:	4E0235942A9CDE99EE2EE0EE1A736E4F
SHA1:	D084D94DF2502E68EE0443B335DD621CD45E2790
SHA-256:	A0D7BC2CCF07AF7960C580FD43928B5FB02B901F9962EAFB10F607E395759306
SHA-512:	CFC4B7D58F662EE0789349B38C1DEC0C4E6DC1D2E660F5D92F8566D49C4850B2BF1D70E43EDF84DB7B21CB8E316E8BCC3E20B797E32D9668C69A029B15804E3F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\1000027001\buildred.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...G.................0.................. ... ....@.. ....................... ............@.................................P...O.... ..............................4................................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	698345
Entropy (8bit):	7.997561886372217
Encrypted:	true
SSDEEP:	12288:5wk6GCaxiTIOLg528uP754F2d+zKSMWHfiaGLfVc:MGATnD9OZP6aOfVc
MD5:	B4DE177E1C354BF84C33AE603A966BAD
SHA1:	F6F42C3963DD4A8B212C7C164E8CE90E084D1D2C
SHA-256:	FC8D27CFC5DE6A9F559B5D3813C2EF45845C361E66732ACAE775B0414CCAA5DC
SHA-512:	375031827C233C174DDE8C4C11BEE8595BF4A4C58A22D6BFE6749C06428AEC007C14D5F2DEE8E0D7D22475AD17E9A50AB56E55A138372C38A8C70E7E392DABE6
Malicious:	false
Preview:	PK........p..X................Browsers/PK........o..X................Wallets/PK........p..X._.............network_info.txt.....0.E.@..}.M.h..C..D(.N..O.m.I^....u...3.X.FtO.)I8...D..kDl.)..SpV....b[..F..8;{K8@C.a..O..8rV;...dN.ob...(..i./c..:87..#......u.......,\|.7PK........p..X......Hj......process_info.txt.]KO.I..G.? .OI.....6...M..D.#c.0..f.<..6..{.k......P].U_.;/_....~.y.....^o.m.W...~,..~....G/~/.u.....l....?/6.....}<..x.ZW.m....~.t..._<~g..P7...W.M.?...~{..G?....D...?.xD.}BJ#..%.}...o.....<s..Iv..{U.UOH...LJ.&..Z......&=A....}.j..t...Ksj.S.z...YWOH.'$-. ..]7..6M."T.eV...=.+I..$......!a.!]..q...U.....Wi...^4.~...=.b..\...+...%...U.......~......M.b...].N..5.....y........ tx...,.2...........@..3.2.Up..$..aNf.....X..)!..8.......HW...U(0../ ..qJfq...4.,e..#......HN...M{...f...+O...g!..,.3.s..b.v,P..0Y...`...SSL...I..!.q9........I9`t}f...(.2.r.7`YX`.g\...:....k.uwC..*.1..9b.....^0+\.C+....R&.6.lH.$.Rb..a3.U`...<!r..q....R.R.t....E.+o

C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Cookies.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.2968284166835025
Encrypted:	false
SSDEEP:	12:LmOkIz7EEQ074KcW1NOpFwUuQLHaU9WvH9:LIHEpTaOk6U9WvH9
MD5:	4C05FBCD3BFB98087FEDA7B59BF34CD3
SHA1:	FCD442B28284AAAA2285187BECA75A0A5BC2233A
SHA-256:	75E72DA4CA2F345A95DB8E8AF372CF5EC468EB5CE68F0D8E0389D568DF500A7F
SHA-512:	046D6CEFE52220D69F243C34ED1A4CC59FB9E452E6217C71F5FA519F89F0734E8BE7E5CDF8E260FCD299C256CEE79B69395F3A568CCE2CC615F7F1A48A3EB108
Malicious:	true
Preview:	----------------------https://t.me/monster_free_cloud----------------------..======================================================================...google.com.TRUE./.FALSE.13343492415760663.1P_JAR.2023-10-04-13...google.com.TRUE./.FALSE.13356711615760707.NID.511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4..

C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\Browsers\Firefox\History.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1176
Entropy (8bit):	5.11851650743489
Encrypted:	false
SSDEEP:	24:LIwrxsM0T/CrxsaQT/iWifT/QiRJT/TiCQERoT/WieroZiJbY:LR8mVcexFMwkcMsU
MD5:	812DFEF59F9CC4DDEB9A4F53C14E4D26
SHA1:	9F161FBA904E5D9B2BE6E54942B0888BF0DBAF5D
SHA-256:	E1868D717FEF8FD4D160FB673D249A2C6DE98827F4070576A7F22C2F25D26C7A
SHA-512:	588A1D165F921954943B73A7186EFB886AB1D23EEF87C13D9EE8E92288BE6B82E4A793F050B281E41678E989F2D3C91FF5D39731F7136BC81EA6A3CE4592B123
Malicious:	true
Preview:	----------------------https://t.me/monster_free_cloud----------------------..======================================================================..ID: 1 \| URL: https://support.mozilla.org/products/firefox \| Title: None \| Visit Count: 0 \| Last Visit Time: None..ID: 2 \| URL: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-browser&utm_medium=default-bookmarks&utm_campaign=customize \| Title: None \| Visit Count: 0 \| Last Visit Time: None..ID: 3 \| URL: https://www.mozilla.org/contribute/ \| Title: None \| Visit Count: 0 \| Last Visit Time: None..ID: 4 \| URL: https://www.mozilla.org/about/ \| Title: None \| Visit Count: 0 \| Last Visit Time: None..ID: 5 \| URL: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaign=new-users&utm_content=-global \| Title: None \| Visit Count: 0 \| Last Visit Time: None..ID: 6 \| URL: https://www.mozilla.org/privacy/firefox/ \| Title: None \| Visit Count: 1 \| Last Visit Time:

C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\network_info.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	271
Entropy (8bit):	4.2841041284959935
Encrypted:	false
SSDEEP:	3:111T8PtQfeLBIIIb9MHUXMRoL7N3U2bX5A3EwAyEY5HLWLASPVXqI:LmtQfzIIy0XnN3UuJA01K5CLpqI
MD5:	E9D4BC2A5D8089218C60A40899C14ED0
SHA1:	A5FA2DFAC2AE50356692E830C3D08E9E3B0405C3
SHA-256:	BCB18A1338CA288943C66763FBDB887985FEE563F7CBC564BF400ED6AEEADFCA
SHA-512:	87FAAD3E77F99E5C71CC51EB8B67A3DB1D2F89D8E099742CD4B436A1732153085F17EC804313F8F450C3F118E77BFB03F7B1C0C0E1821C979930D2BDE1E0C906
Malicious:	true
Preview:	----------------------https://t.me/monster_free_cloud----------------------..======================================================================..8.46.123.33..United States..New York..America/New_York..Level 3 CenturyLink Communications, LLC AS3356 Level 3 Parent, LLC

C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\process_info.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	27208
Entropy (8bit):	4.675119861193652
Encrypted:	false
SSDEEP:	384:SGNH7V8mdJa/yS0+RnGz9fZsDG0IgY/Rl2p9iBXM+M9PcEq/AYpJPG4b7Wdkxz6Q:V01Gq8Ei
MD5:	627B9B613427F313B280DD4F64AC37A9
SHA1:	588F7447FFFD2D13AB0D87FFBA4FF4284F6D08CB
SHA-256:	F61F799129570FB133A628200E709D11FCA84E7975500B208A94C767F6849DBC
SHA-512:	6EE3F4777405C6C53934A863C5F845207F1BBC21934F7358410D9C936D6A2150EFF3C59E5BE10CDB7318B5844563D746D0D910C36AE19230EABA149AB8675557
Malicious:	true
Preview:	----------------------https://t.me/monster_free_cloud----------------------..======================================================================.....Image Name: System Idle Process...PID: 0...Session Name: Services...Session#: 0...Mem Usage: 8 K......Image Name: System...PID: 4...Session Name: Services...Session#: 0...Mem Usage: 168 K......Image Name: Registry...PID: 92...Session Name: Services...Session#: 0...Mem Usage: 78'700 K......Image Name: smss.exe...PID: 332...Session Name: Services...Session#: 0...Mem Usage: 1'224 K......Image Name: csrss.exe...PID: 420...Session Name: Services...Session#: 0...Mem Usage: 5'284 K......Image Name: wininit.exe...PID: 496...Session Name: Services...Session#: 0...Mem Usage: 7'200 K......Image Name: csrss.exe...PID: 504...Session Name: Console...Session#: 1...Mem Usage: 6'060 K......Image Name: winlogon.exe...PID:

C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\system_info.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe
File Type:	Algol 68 source, ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	145680
Entropy (8bit):	4.359585806305431
Encrypted:	false
SSDEEP:	1536:hMRAMDGXTFkDumyoVYmiT8LPvdBG9thi0v5aABGnSvCLVGOjdGMddtfGknZdD238:hMF5GI
MD5:	7768D92DB81910E670ED388CDE6865F4
SHA1:	52A24B5CD8892B76ED454AFBA71D1D183C2BFD7D
SHA-256:	CF047C825C69A5A05721E3A69080CE252B70DDD52ABD53AACC746434F8D80B50
SHA-512:	FFFCA6071F5F6612020B95AB46084E157DD13329A36521B7ED8CCFC2DEA4F8882FB7F6B82E1921CE4B45929D59FD1BE05650168BD8DD493E77624CFF4C2D0FFF
Malicious:	true
Yara Hits:	Rule: JoeSecurity_MonsterStealer, Description: Yara detected Monster Stealer, Source: C:\Users\user\AppData\Local\Temp\2ED92742-89DC-DD72-92E8-869FA5A66493\system_info.txt, Author: Joe Security
Preview:	----------------------https://t.me/monster_free_cloud----------------------..======================================================================..####System Info#### ......Host Name: user-PC...OS Name: Microsoft Windows 10 Pro...OS Version: 10.0.19045 N/A Build 19045...OS Manufacturer: Microsoft Corporation...OS Configuration: Standalone Workstation...OS Build Type: Multiprocessor Free...Registered Owner: hardz...Registered Organization: ...Product ID: 00330-71388-77023-AAOEM...Original Install Date: 03/10/2023, 10:57:18...System Boot Time: 24/09/2023, 16:13:49...System Manufacturer: 7 kPZ3Zyk5Kvx1u...System Model: BFkN2aL8...System Type: x64-based PC...Processor(s): 2 Processor(s) Installed.... [01]: Intel64 Family 6 Model 143 Stepping 8 GenuineIntel ~2000 Mhz... [02

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Download File

Process:	C:\Users\userGCAFCAFHJJ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1922560
Entropy (8bit):	7.950908898530812
Encrypted:	false
SSDEEP:	49152:0/5azCrhk4Q8UTiDoqoxhloaHALny4G4217:0/5azt4Q8UTiDV2loXnxG9
MD5:	AC2D65E997C85BE5D4D2807C12BAB4E8
SHA1:	B766BBEC104FCAB185A79C79461BA7114BC1F4E8
SHA-256:	1C82687004957253FB6737FC4B6000C86257835C7D8C642BFE92FD420A015262
SHA-512:	CB22A70491A16E49DF693CEAACDB074FBF1D6C0E8A19507A578D1B51FC2F0E730301F49D63A388F4D027AA5DE0E3CF4ECF3456027C4C83B082BF59671B2F8CE4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f.............................@L...........@..........................pL......+....@.................................W...k............................&L..............................&L..................................................... . ............................@....rsrc...............................@....idata ............................@... .@+.........................@...rkxzdssx.@....1..:..................@...opdalfsp.....0L.....................@....taggant.0...@L.."...4..............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AutofillData.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Cookies.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DownloadData.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HistoryData.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Logins.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Web.db

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_03hci5ss.42y.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w1idcepj.q44.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\j18m2gel

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:qn:qn
MD5:	3F1D1D8D87177D3D8D897D7E421F84D6
SHA1:	DD082D742A5CB751290F1DB2BD519C286AA86D95
SHA-256:	F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
SHA-512:	2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
Malicious:	false
Preview:	blat

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_asyncio.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64424
Entropy (8bit):	6.124000794465739
Encrypted:	false
SSDEEP:	1536:r/p7Wh7XUagO7BR4SjavFHx8pIS5nWQ7Sy7o:r/tWhzUahBR4Sjahx8pIS5n5Fo
MD5:	6EB3C9FC8C216CEA8981B12FD41FBDCD
SHA1:	5F3787051F20514BB9E34F9D537D78C06E7A43E6
SHA-256:	3B0661EF2264D6566368B677C732BA062AC4688EF40C22476992A0F9536B0010
SHA-512:	2027707824D0948673443DD54B4F45BC44680C05C3C4A193C7C1803A1030124AD6C8FBE685CC7AAF15668D90C4CD9BFB93DE51EA8DB4AF5ABE742C1EF2DCD08B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.~[b...b...b...k..`.......`.......n.......j.......a.......a.......`...b..........c.......c.......c.......c...Richb...........PE..d....K.b.........." ... .T..........`...............................................^.....`.............................................P...P...d........................)...........w..T...........................@v..@............p.. ............................text....R.......T.................. ..`.rdata...I...p...J...X..............@..@.data...(...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_bz2.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83368
Entropy (8bit):	6.530099411242372
Encrypted:	false
SSDEEP:	1536:asRz7qNFcaO6ViD4fhaLRFc/a8kd7jzWHCxIStVs7Sywk:9RzGYYhaY9kd7jzWixIStVs+k
MD5:	A4B636201605067B676CC43784AE5570
SHA1:	E9F49D0FC75F25743D04CE23C496EB5F89E72A9A
SHA-256:	F178E29921C04FB68CC08B1E5D1181E5DF8CE1DE38A968778E27990F4A69973C
SHA-512:	02096BC36C7A9ECFA1712FE738B5EF8B78C6964E0E363136166657C153727B870A6A44C1E1EC9B81289D1AA0AF9C85F1A37B95B667103EDC2D3916280B6A9488
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........{..{..{...#.{......{....M.{......{......{......{......{..Z...{..{...{......{......{....O.{......{..Rich.{..........PE..d....K.b.........." ... .....^..............................................P......& ....`.........................................p...H............0....... .. ........)...@..........T...........................p...@............................................text...O........................... ..`.rdata..L>.......@..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_cffi_backend.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	181248
Entropy (8bit):	6.188683787528254
Encrypted:	false
SSDEEP:	3072:rZ1fKD8GVLHASq0TTjfQxnkVB0hcspEsHS7iiSTLkKetJb9Pu:rZNRGVb9TTCnaZsuMXiSTLLeD9
MD5:	EBB660902937073EC9695CE08900B13D
SHA1:	881537ACEAD160E63FE6BA8F2316A2FBBB5CB311
SHA-256:	52E5A0C3CA9B0D4FC67243BD8492F5C305FF1653E8D956A2A3D9D36AF0A3E4FD
SHA-512:	19D5000EF6E473D2F533603AFE8D50891F81422C59AE03BEAD580412EC756723DC3379310E20CD0C39E9683CE7C5204791012E1B6B73996EA5CB59E8D371DE24
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ih..-..C-..C-..C$qMC!..C.\|.B/..CKf#C)..C.\|.B&..C.\|.B%..C.\|.B)..Cfq.B)..C.\|.B...C-..C...C.\|.B)..C$qKC,..C.\|.B,..C.\|!C,..C.\|.B,..CRich-..C........PE..d.....e.........." .........@...............................................0............`..........................................g..l...\|g..................H............ .......M...............................M..8............................................text...h........................... ..`.rdata..l...........................@..@.data....\.......0...v..............@....pdata..H...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_ctypes.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122792
Entropy (8bit):	6.021506515932983
Encrypted:	false
SSDEEP:	3072:bsQx9bm+edYe3ehG+20t7MqfrSW08UficVISQPkFPR:QQxCOhGB0tgqfrSiUficrZ
MD5:	87596DB63925DBFE4D5F0F36394D7AB0
SHA1:	AD1DD48BBC078FE0A2354C28CB33F92A7E64907E
SHA-256:	92D7954D9099762D81C1AE2836C11B6BA58C1883FDE8EEEFE387CC93F2F6AFB4
SHA-512:	E6D63E6FE1C3BD79F1E39CB09B6F56589F0EE80FD4F4638002FE026752BFA65457982ADBEF13150FA2F36E68771262D9378971023E07A75D710026ED37E83D7B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T....ne..ne..ne......ne.p.d..ne.p.`..ne.p.a..ne.p.f..ne.t.d..ne...a..ne...d..ne...d..ne..nd..ne.t.h..ne.t.e..ne.t....ne.t.g..ne.Rich.ne.........PE..d....K.b.........." ... ............P[..............................................H.....`..........................................Q.......R...........................).......... ...T...............................@...............@............................text............................... ..`.rdata..nl.......n..................@..@.data...D>...p...8...^..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_decimal.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	250280
Entropy (8bit):	6.547354352688139
Encrypted:	false
SSDEEP:	6144:TogRj7JKM8c7N6FiFUGMKa3xB6Dhj9qWMa3pLW1A64WsqC:tPJKa7N6FEa3x4NlbqC
MD5:	10F7B96C666F332EC512EDADE873EECB
SHA1:	4F511C030D4517552979105A8BB8CCCF3A56FCEA
SHA-256:	6314C99A3EFA15307E7BDBE18C0B49BC841C734F42923A0B44AAB42ED7D4A62D
SHA-512:	CFE5538E3BECBC3AA5540C627AF7BF13AD8F5C160B581A304D1510E0CB2876D49801DF76916DCDA6B7E0654CE145BB66D6E31BD6174524AE681D5F2B49088419
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................7.......................................+.........c.........................[...........Rich...........PE..d....K.b.........." ... .p...:.......................................................^....`..........................................D..P...@E...................'.......)......@...p...T...........................0...@............................................text...]o.......p.................. ..`.rdata...............t..............@..@.data....)...`...$...L..............@....pdata...'.......(...p..............@..@.rsrc...............................@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61864
Entropy (8bit):	6.210920109899827
Encrypted:	false
SSDEEP:	768:aSz5iGzcowlJF+aSe3kuKUZgL4dqDswE9+B1fpIS5IHYiSyvc9eEdB:npWlJF+aYupZbdqDOgB1fpIS5IH7Sy+V
MD5:	49CE7A28E1C0EB65A9A583A6BA44FA3B
SHA1:	DCFBEE380E7D6C88128A807F381A831B6A752F10
SHA-256:	1BE5CFD06A782B2AE8E4629D9D035CBC487074E8F63B9773C85E317BE29C0430
SHA-512:	CF1F96D6D61ECB2997BB541E9EDA7082EF4A445D3DD411CE6FD71B0DFE672F4DFADDF36AE0FB7D5F6D1345FBD90C19961A8F35328332CDAA232F322C0BF9A1F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......zD.A>%..>%..>%..7]..:%..^_..<%..^_..2%..^_..6%..^_..=%..Z_..<%...W..<%...\..=%..>%...%..Z_..?%..Z_..?%..Z_..?%..Z_..?%..Rich>%..................PE..d....K.b.........." ... .P...z.......<..............................................Np....`............................................P...@............................)......X....l..T............................k..@............`..(............................text....N.......P.................. ..`.rdata..VM...`...N...T..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_lzma.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	158120
Entropy (8bit):	6.838169661977938
Encrypted:	false
SSDEEP:	3072:MeORg8tdLRrHn5Xp4znfI9mNoY6JCvyPZxsyTxISe1KmDd:M/Rgo1L5wwYOY6MixJKR
MD5:	B5FBC034AD7C70A2AD1EB34D08B36CF8
SHA1:	4EFE3F21BE36095673D949CCEAC928E11522B29C
SHA-256:	80A6EBE46F43FFA93BBDBFC83E67D6F44A44055DE1439B06E4DD2983CB243DF6
SHA-512:	E7185DA748502B645030C96D3345D75814BA5FD95A997C2D1C923D981C44D5B90DB64FAF77DDBBDC805769AF1BEC37DAF0ECEE0930A248B67A1C2D92B59C250C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........m....................................................<.........................................Rich...........................PE..d....L.b.........." ... .d...........8...............................................p....`.........................................0%..L...\|%..x....p.......P.......@...)......H.......T...........................`...@............................................text...^c.......d.................. ..`.rdata..............h..............@..@.data........@......................@....pdata.......P....... ..............@..@.rsrc........p.......4..............@..@.reloc..H............>..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_multiprocessing.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33192
Entropy (8bit):	6.3186201273933635
Encrypted:	false
SSDEEP:	768:Y3I65wgJ5xeSZg2edRnJ8ZISRtczYiSyvZCeEdP:gIgJ5Uqg2edRJ8ZISRtcz7Sy0b
MD5:	71AC323C9F6E8A174F1B308B8C036E88
SHA1:	0521DF96B0D622544638C1903D32B1AFF1F186B0
SHA-256:	BE8269C83666EAA342788E62085A3DB28F81512D2CFA6156BF137B13EBEBE9E0
SHA-512:	014D73846F06E9608525A4B737B7FCCBE2123D0E8EB17301244B9C1829498328F7BC839CC45A1563CF066668EA6E0C4E3A5A0821AB05C999A97C20AA669E9EDA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_.+.>.x.>.x.>.x.Fgx.>.x.D.y.>.x.D.y.>.x.D.y.>.x.D.y.>.x.D.y.>.x.>.x.>.xmL.y.>.x.D.y.>.x.D.y.>.x.D.x.>.x.D.y.>.xRich.>.x........................PE..d....K.b.........." ... .....<......0....................................................`.........................................0D..`....D..x....p.......`.......X...)...........4..T...........................p3..@............0...............................text............................... ..`.rdata..^....0... ..."..............@..@.data........P.......B..............@....pdata.......`.......H..............@..@.rsrc........p.......L..............@..@.reloc...............V..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_overlapped.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48552
Entropy (8bit):	6.319402195167259
Encrypted:	false
SSDEEP:	768:9i4KJKYCKlBj7gKxwfZQ7ZlYXF1SVMHE4ftISstDYiSyvM+eEd2:hKJfBuAA1SVWBftISstD7Syti
MD5:	7E6BD435C918E7C34336C7434404EEDF
SHA1:	F3A749AD1D7513EC41066AB143F97FA4D07559E1
SHA-256:	0606A0C5C4AB46C4A25DED5A2772E672016CAC574503681841800F9059AF21C4
SHA-512:	C8BF4B1EC6C8FA09C299A8418EE38CDCCB04AFA3A3C2E6D92625DBC2DE41F81DD0DF200FD37FCC41909C2851AC5CA936AF632307115B9AC31EC020D9ED63F157
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|.K{8.%(8.%(8.%(1..(<.%(X.$):.%(X. )4.%(X.!)0.%(X.&);.%(\.$):.%(8.$(N.%(.$)=.%(.!)9.%(\.()9.%(\.%)9.%(\..(9.%(\.')9.%(Rich8.%(........PE..d....K.b.........." ... .>...X...... ................................................o....`..........................................w..X...(x...........................)...... ....V..T............................U..@............P...............................text....<.......>.................. ..`.rdata...4...P...6...B..............@..@.data................x..............@....pdata..............................@..@.rsrc...............................@..@.reloc.. ...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_queue.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30632
Entropy (8bit):	6.41055734058478
Encrypted:	false
SSDEEP:	768:lez/Dt36r34krA4eVIS7UAYiSyvAEYeEdSiD:leDE34krA4eVIS7UA7Sy9YLD
MD5:	23F4BECF6A1DF36AEE468BB0949AC2BC
SHA1:	A0E027D79A281981F97343F2D0E7322B9FE9B441
SHA-256:	09C5FAF270FD63BDE6C45CC53B05160262C7CA47D4C37825ED3E15D479DAEE66
SHA-512:	3EE5B3B7583BE1408C0E1E1C885512445A7E47A69FF874508E8F0A00A66A40A0E828CE33E6F30DDC3AC518D69E4BB96C8B36011FB4EDEDF9A9630EF98A14893B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.~Zb...b...b...k..`.......`.......n.......j.......a.......a.......`...b...+.......c.......c.......c.......c...Richb...........................PE..d....K.b.........." ... .....8.......................................................F....`..........................................C..L....C..d....p.......`.......N...)..........`4..T........................... 3..@............0..(............................text............................... ..`.rdata..2....0......................@..@.data...x....P.......:..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc...............L..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_socket.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	77736
Entropy (8bit):	6.247935524153974
Encrypted:	false
SSDEEP:	1536:C6DucXZAuj19/s+S+pjtk/DDTaVISQwn7SyML:C6DPXSuj19/sT+ppk/XWVISQwneL
MD5:	E137DF498C120D6AC64EA1281BCAB600
SHA1:	B515E09868E9023D43991A05C113B2B662183CFE
SHA-256:	8046BF64E463D5AA38D13525891156131CF997C2E6CDF47527BC352F00F5C90A
SHA-512:	CC2772D282B81873AA7C5CBA5939D232CCEB6BE0908B211EDB18C25A17CBDB5072F102C0D6B7BC9B6B2F1F787B56AB1BC9BE731BB9E98885C17E26A09C2BEB90
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...ry..ry..ry..{.g.ty......py.......y......zy......qy......py..ry...y......uy......sy......sy......sy......sy..Richry..................PE..d....K.b.........." ... .l.......... &.......................................P.......Q....`.............................................P...P........0....... ..l........)...@.........T...............................@............................................text...Rj.......l.................. ..`.rdata...s.......t...p..............@..@.data...............................@....pdata..l.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_sqlite3.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	97704
Entropy (8bit):	6.173518585387285
Encrypted:	false
SSDEEP:	1536:GzgMWYDOavuvwYXGqijQaIrlIaiP9NbTp9c4L7ZJkyDpIS5Qux7Syce:NFYqDPSQaIrlI/DbLc2tJkyDpIS5QuxZ
MD5:	7F61EACBBBA2ECF6BF4ACF498FA52CE1
SHA1:	3174913F971D031929C310B5E51872597D613606
SHA-256:	85DE6D0B08B5CC1F2C3225C07338C76E1CAB43B4DE66619824F7B06CB2284C9E
SHA-512:	A5F6F830C7A5FADC3349B42DB0F3DA1FDDB160D7E488EA175BF9BE4732A18E277D2978720C0E294107526561A7011FADAB992C555D93E77D4411528E7C4E695A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........dQ...?...?...?..}....?..>...?......?..:...?..;...?..<...?..>...?.;w>...?...>...?..2...?..?...?......?..=...?.Rich..?.................PE..d....L.b.........." ... ............................................................4.....`.............................................P....................`.......T...)..............T...............................@...............`............................text...n........................... ..`.rdata...p.......r..................@..@.data...,....@......................@....pdata.......`.......2..............@..@.rsrc................F..............@..@.reloc...............P..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_ssl.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	159144
Entropy (8bit):	6.002098953253968
Encrypted:	false
SSDEEP:	3072:UhIDGtzShE3z/JHPUE0uev5J2oE/wu3rE923+nuI5Piev9muxISt710Y:UhIqtzShE3zhvyue5EMnuaF9mu3
MD5:	35F66AD429CD636BCAD858238C596828
SHA1:	AD4534A266F77A9CDCE7B97818531CE20364CB65
SHA-256:	58B772B53BFE898513C0EB264AE4FA47ED3D8F256BC8F70202356D20F9ECB6DC
SHA-512:	1CCA8E6C3A21A8B05CC7518BD62C4E3F57937910F2A310E00F13F60F6A94728EF2004A2F4A3D133755139C3A45B252E6DB76987B6B78BC8269A21AD5890356AD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........dI...'L..'L..'L.}.L..'L..&M..'L.."M..'L..#M..'L..$M..'L..&M..'Lz\|&M..'L..&Lt.'L)w&M..'L..M..'L..'M..'L...L..'L..%M..'LRich..'L................PE..d....K.b.........." ... ............l...................................................`............................................d...4........`.......P.......D...)...p..<.......T...............................@............................................text...x........................... ..`.rdata..J...........................@..@.data....j.......f..................@....pdata.......P....... ..............@..@.rsrc........`.......,..............@..@.reloc..<....p.......6..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\_uuid.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23976
Entropy (8bit):	6.5352541220575695
Encrypted:	false
SSDEEP:	384:I3AVpEWz6TPQxISewl4IYiSy1pCQXdW4i/8E9VFL2Utah:ISpENTQxISewLYiSyvNWeEdy
MD5:	13AA3AF9AED86CC917177AE1F41ACC9B
SHA1:	F5D95679AFDA44A6689DBB45E93EBE0E9CD33D69
SHA-256:	51DD1EA5E8CACF7EC4CADEFDF685334C7725FF85978390D0B3D67FC8C54FE1DB
SHA-512:	E1F5DBD6C0AFCF207DE0100CBA6F1344FEB0006A5C12DC92768AB2D24E3312F0852F3CD31A416AAFEB0471CD13A6C0408F0DA62956F7870B2E22D174A8B23C45
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&Gp.G)#.G)#.G)#.?.#.G)#.=(".G)#.=,".G)#.=-".G)#.=*".G)#.=(".G)#55(".G)#.G(#.G)#.=!".G)#.=)".G)#.=.#.G)#.=+".G)#Rich.G)#................PE..d....K.b.........." ... .....&...... ........................................p.......&....`.........................................`)..L....)..x....P.......@.......4...)...`..@...`#..T........................... "..@............ ..8............................text...h........................... ..`.rdata....... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..@....`.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\aiohttp\_helpers.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.643803278848021
Encrypted:	false
SSDEEP:	768:h215pzs3+QGgxzczNyg44MtWB2qnjSaQGFV1Mr4R:O43+QIzYg4jAB/BFV1
MD5:	D2BF6CA0DF56379F1401EFE347229DD2
SHA1:	95C6A524A9B64EC112C32475F06A0821FF7E79C9
SHA-256:	04D56D6AA727665802283B8ADF9B873C1DD76DFC7265A12C0F627528BA706040
SHA-512:	B4A2B9F71B156731AA071D13BF8DCFFEC4091D8D2FAB47AEA1FF47CD7ABFF13E28ACF1D9456A97EB7A5723DBFA166FC63DE11C63DC5CB63B13B4DF9930390377
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......${AT`./.`./.`./.ib..b./..f..b./.+b..b./..f.l./..f+.h./..f,.c./..o..c./.`...../..g'.a./..g/.a./..g..a./..g-.a./.Rich`./.................PE..d...H[!e.........." ...#.T...H......@X....................................................`.........................................p...`......d.......................................................................@............p...............................text...xS.......T.................. ..`.rdata......p...,...X..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\aiohttp\_http_parser.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	222208
Entropy (8bit):	6.10752062024038
Encrypted:	false
SSDEEP:	3072:S1KrrHFSNR6H/NOJR7Zk34mplHJS9tSP/IDqF0Lsqy9ldyANDR8BSobY:FrpuJoomplQeP/LdbNqBSo
MD5:	9642C0A5FB72DFE2921DF28E31FAA219
SHA1:	67A963157EE7FC0C30D3807E8635A57750CA0862
SHA-256:	580A004E93BED99820B1584DFFAF0C4CAA9FBBF4852CCDED3B2B99975299367B
SHA-512:	F84B7CDE87186665A700C3017EFCBCC6C19F5DC2C7B426D427DDDBCBDEC38B6189DD60CE03153FB14B6EA938D65AAB99DA33BDA63B48E3E9CE9E5D3555B50A04
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y~Hz.-Hz.-Hz.-A..-Lz.-...,Jz.-...,Jz.-...,Kz.-Hz.-.z.-...,Dz.-...,@z.-...,Kz.-...,Mz.-...,Iz.-...-Iz.-...,Iz.-RichHz.-................PE..d...G[!e.........." ...#............P.....................................................`......................................... ...h.......d.......................................................................@............... ............................text............................... ..`.rdata...}.......~..................@..@.data...hg... ...@..................@....pdata...............L..............@..@.rsrc................\..............@..@.reloc...............^..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\aiohttp\_http_writer.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.673090741023562
Encrypted:	false
SSDEEP:	768:WN5I/39NtGriNlBOd9IaLNl+wnxYjCPk:k5w93GriNlkZL7OjCPk
MD5:	E16A71FC322A3A718AEAEAEF0EEEAB76
SHA1:	78872D54D016590DF87208518E3E6515AFCE5F41
SHA-256:	51490359D8079232565187223517ECA99E1CE55BC97B93CF966D2A5C1F2E5435
SHA-512:	A9A7877AA77D000BA2DD7D96CF88A0E9AFB6F6DECB9530C1D4E840C270DD1805E73401266B1C8E17C1418EFFB823C1BD91B13F82DBFC6DBA455940E3E644DE54
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{.T^...^...^...Wb<.\....f..\....b..\....f..R....f..V....f..]....o..]...^........g.._....g.._....gP._....g.._...Rich^...................PE..d...H[!e.........." ...#.L...........P....................................................`.........................................Px..h....x..d....................................o...............................n..@............`...............................text....K.......L.................. ..`.rdata...&...`...(...P..............@..@.data....L...........x..............@....pdata...............~..............@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\aiohttp\_websocket.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23040
Entropy (8bit):	5.36172396663424
Encrypted:	false
SSDEEP:	384:ytkKmbdKYMnRtDiX45KMNFJfuFsNeuAbu63jJBnrKCXsgurE:BKmEYMZJvwscuAb/1R/K
MD5:	9358095A5DC2D4B25FC1C416EEA48D2D
SHA1:	FAAEE08C768E8EB27BC4B2B9D0BF63C416BB8406
SHA-256:	4A5C9F8C3BCA865DF94AC93355E3AD492DE03AE5FEA41C1FA82FA4360C592BA5
SHA-512:	C3D81DDBBE48A56530EA3E2500A78C396385F8CA820B3D71F8E5336AB0C6D484BC2B837AE0A2EDB39D0FE24C37815F1B0CCFE25235197F1AF19E936DDB41E594
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{AX^./.^./.^./.Wb..\./..f..\./..b..\./..f*.R./..f+.V./..f,.]./..o..]./.^...4./..g'._./..g/._./..g.._./..g-._./.Rich^./.........................PE..d...@[!e.........." ...#.(...4.......,....................................................`.........................................`R..d....R..d............p.......................K..............................pJ..@............@..0............................text....'.......(.................. ..`.rdata.......@... ...,..............@..@.data...8....`.......L..............@....pdata.......p.......R..............@..@.rsrc................V..............@..@.reloc...............X..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\charset_normalizer\md.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.675182011095312
Encrypted:	false
SSDEEP:	96:FL8Khp72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh3XQMtCFaiHrmHcX6g8cim1qeSC:Zj2HzzU2bRYoe4Hmcqgvimoe
MD5:	F33CA57D413E6B5313272FA54DBC8BAA
SHA1:	4E0CABE7D38FE8D649A0A497ED18D4D1CA5F4C44
SHA-256:	9B3D70922DCFAEB02812AFA9030A40433B9D2B58BCF088781F9AB68A74D20664
SHA-512:	F17C06F4202B6EDBB66660D68FF938D4F75B411F9FAB48636C3575E42ABAAB6464D66CB57BCE7F84E8E2B5755B6EF757A820A50C13DD5F85FAA63CD553D3FF32
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6..^W..^W..^W..W/..\W..K(..\W.../..\W..K(..UW..K(..VW..K(..]W.."..]W..^W..xW..g.._W..g.._W..g.a._W..g.._W..Rich^W..........PE..d....hAe.........." ...%.....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\charset_normalizer\md__mypyc.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120320
Entropy (8bit):	5.879886869577473
Encrypted:	false
SSDEEP:	3072:YKBCiXU2SBEUemE+OaOb3OEOz0fEDrF9pQKhN:YJZ2zOfdQKX
MD5:	494F5B9ADC1CFB7FDB919C9B1AF346E1
SHA1:	4A5FDDD47812D19948585390F76D5435C4220E6B
SHA-256:	AD9BCC0DE6815516DFDE91BB2E477F8FB5F099D7F5511D0F54B50FA77B721051
SHA-512:	2C0D68DA196075EA30D97B5FD853C673E28949DF2B6BF005AE72FD8B60A0C036F18103C5DE662CAC63BAAEF740B65B4ED2394FCD2E6DA4DFCFBEEF5B64DAB794
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........SRxr.Rxr.Rxr.[...Zxr.G.s.Pxr...s.Pxr.G.w._xr.G.v.Zxr.G.q.Qxr...s.Qxr.Rxs..xr.k.z.Sxr.k.r.Sxr.k...Sxr.k.p.Sxr.RichRxr.........................PE..d....hAe.........." ...%............02....................................... ............`.............................................d..........................................Px...............................w..@............@...............................text...X-.......................... ..`.rdata...X...@...Z...2..............@..@.data...8=.......0..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7227392
Entropy (8bit):	6.563567185000009
Encrypted:	false
SSDEEP:	49152:L7vWIDI8B92Fbq5Vv1Q3rBIU6ikGtlqQVwASOGRw8beAOmnDvghmCoADPDMBMXLq:pi2++POmnDIrPDMyGnTLQmD/
MD5:	F918173FBDC6E75C93F64784F2C17050
SHA1:	163EF51D4338B01C3BC03D6729F8E90AE39D8F04
SHA-256:	2C7A31DEC06DF4EEC6B068A0B4B009C8F52EF34ACE785C8B584408CB29CE28FD
SHA-512:	5405D5995E97805E68E91E1F191DC5E7910A7F2BA31619EB64AFF54877CBD1B3FA08B7A24B411D095EDB21877956976777409D3DB58D29DA32219BF578CE4EF2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)..m...m...m...d.@.....2..o...2..\|...2..e...2..i....2..o...m...L......\|...1......m.......1..l...1..l...Richm...........................PE..d....o_f.........." ...'..S.........D+R.......................................n...........`...........................................i.p.....i.\|............`j.DO............m......Lc.T....................Lc.(....Jc.@.............S..............................text.....S.......S................. ..`.rdata.......S.......S.............@..@.data....!...0i......"i.............@....pdata..DO...`j..P....j.............@..@.reloc........m......hm.............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\frozenlist\_frozenlist.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	5.9308989665858585
Encrypted:	false
SSDEEP:	1536:ZmwCw3vZ1w4vI1FxF6S2s0suvV81dvUflo6vp9862WhFo1emYU+:Z/CwxqC+bsNlflo6h93FiemYL
MD5:	911470750962640CEB3FD11E2AEECD14
SHA1:	AF797451D4028841D92F771885CB9D81AFBA3F96
SHA-256:	5C204F6966526AF4DC0C0D6D29909B6F088C4FA781464F2948414D833B03094D
SHA-512:	637043C20DC17FBC472613C0E4F576F0A2211B7916B3488806AEC30271CF1BD84BD790518335B88910662FD4844F8ED39FA75AA278577271A966756B8CD793F7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........._5..1f..1f..1f.f..1f..0g..1f..0g..1f..4g..1f..5g..1f..2g..1f..0g..1f..0fS.1f.q9g..1f.q1g..1f.q.f..1f.q3g..1fRich..1f........................PE..d.....{e.........." ...%.....t......p.....................................................`.........................................p6..h....6..x............p..4....................&...............................$..@...............(............................text............................... ..`.rdata...I.......J..................@..@.data...P....P.......2..............@....pdata..4....p.......@..............@..@.rsrc................L..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3439512
Entropy (8bit):	6.096012359425593
Encrypted:	false
SSDEEP:	98304:kw+jlHDGV+EafwAlViBksm1CPwDv3uFfJ1:1slHDG2fwAriXm1CPwDv3uFfJ1
MD5:	AB01C808BED8164133E5279595437D3D
SHA1:	0F512756A8DB22576EC2E20CF0CAFEC7786FB12B
SHA-256:	9C0A0A11629CCED6A064932E95A0158EE936739D75A56338702FED97CB0BAD55
SHA-512:	4043CDA02F6950ABDC47413CFD8A0BA5C462F16BCD4F339F9F5A690823F4D0916478CAB5CAE81A3D5B03A8A196E17A716B06AFEE3F92DEC3102E3BBC674774F2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........R.m.R.m.R.m.[...@.m.0.l.P.m.0.h.^.m.0.i.Z.m.0.n.V.m.R.l..m..l.Y.m...n.O.m...i.+.m...m.S.m....S.m...o.S.m.RichR.m.........................PE..d...`.0b.........." ......$...................................................5......4...`..........................................x/..h...:4.@....p4.\|....p2.8....\4.......4..O....,.8...........................`.,.@............04..............................text.....$.......$................. ..`.rdata........$.......$.............@..@.data...!z....1..,....1.............@....pdata.......p2.......1.............@..@.idata..^#...04..$....3.............@..@.00cfg..u....`4.......3.............@..@.rsrc...\|....p4.......3.............@..@.reloc...y....4..z....3.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\libffi-7.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32792
Entropy (8bit):	6.3566777719925565
Encrypted:	false
SSDEEP:	384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
MD5:	EEF7981412BE8EA459064D3090F4B3AA
SHA1:	C60DA4830CE27AFC234B3C3014C583F7F0A5A925
SHA-256:	F60DD9F2FCBD495674DFC1555EFFB710EB081FC7D4CAE5FA58C438AB50405081
SHA-512:	DC9FF4202F74A13CA9949A123DFF4C0223DA969F49E9348FEAF93DA4470F7BE82CFA1D392566EAAA836D77DDE7193FED15A8395509F72A0E9F97C66C0A096016
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....F...$.......I....................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\libssl-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	698784
Entropy (8bit):	5.533720236597082
Encrypted:	false
SSDEEP:	12288:waXWJ978LddzAPcWTWxYx2OCf2QmAr39Zu+DIpEpXKWRq0qwMUxQU2lvz:dddzAjKnD/QGXKzpwMUCU2lvz
MD5:	DE72697933D7673279FB85FD48D1A4DD
SHA1:	085FD4C6FB6D89FFCC9B2741947B74F0766FC383
SHA-256:	ED1C8769F5096AFD000FC730A37B11177FCF90890345071AB7FBCEAC684D571F
SHA-512:	0FD4678C65DA181D7C27B19056D5AB0E5DD0E9714E9606E524CDAD9E46EC4D0B35FE22D594282309F718B30E065F6896674D3EDCE6B3B0C8EB637A3680715C2C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{.T.?.:.?.:.?.:.6f..3.:.]f;.=.:..l;.=.:.]f?.3.:.]f>.7.:.]f9.;.:..g;.<.:.?.;...:..g>...:..g:.>.:..g.>.:..g8.>.:.Rich?.:.........PE..d.....0b.........." .....<...T......<................................................[....`.........................................00...N..HE..........s.......\|M..............h... ...8...............................@............0..H............................text....:.......<.................. ..`.rdata..:....P...0...@..............@..@.data...AM.......D...p..............@....pdata..dV.......X..................@..@.idata..PW...0...X..................@..@.00cfg..u............d..............@..@.rsrc...s............f..............@..@.reloc..a............n..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\multidict\_multidict.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.357116643624461
Encrypted:	false
SSDEEP:	768:l8hWKS6To1gSqIcLiRr4NMfDnXRkYcX9srM:lqlSfqIcLiRrnnhkYcth
MD5:	DDD4C0AE1E0D166C22449E9DCDCA20D7
SHA1:	FF0E3D889B4E8BC43B0F13AA1154776B0DF95700
SHA-256:	74EC52418C5D38A63ADD94228C6F68CF49519666AE8BCB7AC199F7D539D8612C
SHA-512:	C8464A77BA8B504BA9C7873F76499174095393C42DC85A9C1BE2875C3661CDA928851E37013E4AC95BA539EED984BF71C0FCC2CB599F3F0C4C1588D4A692BDFD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8T..V...V...V.......V...W...V..W...V...S...V...R...V...U...V.j.W...V...W...V...^...V...V...V.......V...T...V.Rich..V.........................PE..d......e.........." ...%.Z...^.......^....................................................`.........................................p...d......d...............................L.......................................@............p...............................text....Y.......Z.................. ..`.rdata...+...p...,...^..............@..@.data...p#..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..L...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\pyexpat.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	198568
Entropy (8bit):	6.360283939217406
Encrypted:	false
SSDEEP:	3072:rkPTemtXBsiLC/QOSL6XZIMuPbBV3Dy9zeL9ef93d1BVdOd8dVyio0OwUpz1RPoi:AKmVG/pxIMuPbBFEFDBwpp2W
MD5:	6BC89EBC4014A8DB39E468F54AAAFA5E
SHA1:	68D04E760365F18B20F50A78C60CCFDE52F7FCD8
SHA-256:	DBE6E7BE3A7418811BD5987B0766D8D660190D867CD42F8ED79E70D868E8AA43
SHA-512:	B7A6A383EB131DEB83EEE7CC134307F8545FB7D043130777A8A9A37311B64342E5A774898EDD73D80230AB871C4D0AA0B776187FA4EDEC0CCDE5B9486DBAA626
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O...........6...k.....k.....k.....k.....o............\|.o.....o.....o.Z...o.....Rich..................PE..d....K.b.........." ... ............0................................................0....`.........................................`...P................................)..........@6..T............................5..@............ ...............................text...K........................... ..`.rdata....... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\python3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64936
Entropy (8bit):	6.1037683983631625
Encrypted:	false
SSDEEP:	768:kD8LeBLeeFtp5V1BfO2yvSk70QZF1nEyjnskQkr/RFB1qucwdBeCw0myou6ZwJqL:kDwewnvtjnsfwaVISQ0a7SydEnn
MD5:	07BD9F1E651AD2409FD0B7D706BE6071
SHA1:	DFEB2221527474A681D6D8B16A5C378847C59D33
SHA-256:	5D78CD1365EA9AE4E95872576CFA4055342F1E80B06F3051CF91D564B6CD09F5
SHA-512:	DEF31D2DF95CB7999CE1F55479B2FF7A3CB70E9FC4778FC50803F688448305454FBBF82B5A75032F182DFF663A6D91D303EF72E3D2CA9F2A1B032956EC1A0E2A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f..A.e.A.e.A.e.%}m.@.e.%}e.@.e.%}..@.e.%}g.@.e.RichA.e.........................PE..d....K.b.........." ... ..................................................................`.........................................`...`................................)..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\python310.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4493736
Entropy (8bit):	6.465157771728023
Encrypted:	false
SSDEEP:	49152:5vL1txd/8sCmiAiPw+RxtLzli0Im3wOc+28Ivu31WfbF9PtF+FNDHaSclAaBlh7y:Dw7Ad07RmodacSeSHCMTbSp4PS
MD5:	C80B5CB43E5FE7948C3562C1FFF1254E
SHA1:	F73CB1FB9445C96ECD56B984A1822E502E71AB9D
SHA-256:	058925E4BBFCB460A3C00EC824B8390583BAEF0C780A7C7FF01D43D9EEC45F20
SHA-512:	FAA97A9D5D2A0BF78123F19F8657C24921B907268938C26F79E1DF6D667F7BEE564259A3A11022E8629996406CDA9FA00434BB2B1DE3E10B9BDDC59708DBAD81
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+.o...o...o.......m.......b.......c.......g.......k...f.`.u......f...o...3..............n.......n.......n...Richo...................PE..d....K.b.........." ... ..#...!.....\|!........................................E.....{.D...`..........................................G=.......>.\|.....E.......B......hD..)....E..t...Q%.T...........................`P%.@.............#.0............................text.....#.......#................. ..`.rdata...\....#..^....#.............@..@.data... ....0>.......>.............@....pdata........B.. ....A.............@..@PyRuntim`.....D.......C.............@....rsrc.........E.......C.............@..@.reloc...t....E..v....C.............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\select.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29096
Entropy (8bit):	6.4767692602677815
Encrypted:	false
SSDEEP:	384:rPxHeWt+twhCBsHqF2BMXR6VIS7GuIYiSy1pCQkyw24i/8E9VFL2Ut8JU:ZeS+twhC6HqwmYVIS7GjYiSyv7VeEdH
MD5:	ADC412384B7E1254D11E62E451DEF8E9
SHA1:	04E6DFF4A65234406B9BC9D9F2DCFE8E30481829
SHA-256:	68B80009AB656FFE811D680585FAC3D4F9C1B45F29D48C67EA2B3580EC4D86A1
SHA-512:	F250F1236882668B2686BD42E1C334C60DA7ABEC3A208EBEBDEE84A74D7C4C6B1BC79EED7241BC7012E4EF70A6651A32AA00E32A83F402475B479633581E0B07
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{?t..Q'..Q'..Q'.b.'..Q'.`P&..Q'.`T&..Q'.`U&..Q'.`R&..Q'.`P&..Q'..P'..Q'5hP&..Q'.`\&..Q'.`Q&..Q'.`.'..Q'.`S&..Q'Rich..Q'........................PE..d....K.b.........." ... .....2......................................................l.....`..........................................@..L....@..x....p.......`.......H...)......L....3..T............................2..@............0...............................text............................... ..`.rdata..H....0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\sqlite3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1445800
Entropy (8bit):	6.579172773828651
Encrypted:	false
SSDEEP:	24576:tU3g/eNVQHzcayG7b99ZSYR4eXj98nXMuVp+qbLKeq98srCIS:ck3hbEAp8X9Vp+2q2gI
MD5:	926DC90BD9FAF4EFE1700564AA2A1700
SHA1:	763E5AF4BE07444395C2AB11550C70EE59284E6D
SHA-256:	50825EA8B431D86EC228D9FA6B643E2C70044C709F5D9471D779BE63FF18BCD0
SHA-512:	A8703FF97243AA3BC877F71C0514B47677B48834A0F2FEE54E203C0889A79CE37C648243DBFE2EE9E1573B3CA4D49C334E9BFE62541653125861A5398E2FE556
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|{.............e.......g.......g.......g.......g......Po...............g.......g.......g.....g......Rich............PE..d....L.b.........." ... ..................................................... .......`....`..............................................!...................0...........)......\|...Pg..T............................f..@............ ..(............................text............................... ..`.rdata..D.... ......................@..@.data...0A.......8..................@....pdata.......0......................@..@.rsrc...............................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	18829824
Entropy (8bit):	6.2604094557703975
Encrypted:	false
SSDEEP:	98304:nDUU4oQ6L75bA1iOvW0t7n8SVeqhuCwSzfrSovvzjteF5RNfDwAgAT0Eoc0GFGzp:CCYfrSovyfuS0eTEJaKliweLOc002
MD5:	1CF17408048317FC82265ED6A1C7893D
SHA1:	9BFEC40D6EB339C5A6C2AD6E5FA7CEBC147654C5
SHA-256:	1352AD9860A42137B096D9675A7B8D578FBC596D965DE3CB352619CBE6AAF4E9
SHA-512:	66322D7CB5931017ACAA29970DA48642D03CE35007F130511B2848B67169C1DD4167F1E5A31E5E1DFE5F7122846482BDB878B5CD695AC58009033FD620813A0F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe, Author: Joe Security Rule: JoeSecurity_MonsterStealer, Description: Yara detected Monster Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...&..f...............)."...N... .............@..............................#.....w.....`......................................................;...`...oU......J............#..............................U..(....................................................text...H!......."..................`..`.data...0....@.......&..............@....rdata..............................@..@.eh_fram............................@....pdata...J.......L..................@..@.xdata..............................@..@.bss.... ................................idata...;.......<..................@....CRT....`....@......................@....tls.........P......................@....rsrc....oU..`...pU.................@..@.reloc........#......F..............@..B................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1121192
Entropy (8bit):	5.384501252071814
Encrypted:	false
SSDEEP:	12288:bMYYMmuZ63NoQCb5Pfhnzr0ql8L8koM7IRG5eeme6VZyrIBHdQLhfFE+uz9O:AYYuXZV0m8wMMREtV6Vo4uYz9O
MD5:	102BBBB1F33CE7C007AAC08FE0A1A97E
SHA1:	9A8601BEA3E7D4C2FA6394611611CDA4FC76E219
SHA-256:	2CF6C5DEA30BB0584991B2065C052C22D258B6E15384447DCEA193FDCAC5F758
SHA-512:	A07731F314E73F7A9EA73576A89CCB8A0E55E53F9B5B82F53121B97B1814D905B17A2DA9BD2EDA9F9354FC3F15E3DEA7A613D7C9BC98C36BBA653743B24DFC32
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(..F...F...F......F..G...F..C...F..B...F..E...F...G...F.C.G...F...G...F...K...F...F...F.......F...D...F.Rich..F.........................PE..d....K.b.........." ... .B...........*.......................................@......Y.....`.............................................X...(........ ...................)...0......@b..T............................a..@............`..x............................text....A.......B.................. ..`.rdata......`.......F..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	98736
Entropy (8bit):	6.474996871326343
Encrypted:	false
SSDEEP:	1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
MD5:	F12681A472B9DD04A812E16096514974
SHA1:	6FD102EB3E0B0E6EEF08118D71F28702D1A9067C
SHA-256:	D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8
SHA-512:	7D3ACCBF84DE73FB0C5C0DE812A9ED600D39CD7ED0F99527CA86A57CE63F48765A370E913E3A46FFC2CCD48EE07D823DAFDD157710EEF9E7CC1EB7505DC323A2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.&k..H8..H8..H8.I9..H8...8..H8..I8(.H8e.K9..H8e.L9..H8e.M9..H8e.H9..H8e..8..H8e.J9..H8Rich..H8................PE..d....9............" ... .....`......`.....................................................`A........................................0C..4...dK...............p..p....Z...'...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......B..............@....pdata..p....p.......F..............@..@_RDATA..\............R..............@..@.rsrc................T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\yarl\_quoting_c.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.94845436673918
Encrypted:	false
SSDEEP:	1536:2Kf5HiO/0ojuwGGZsV59LzaN9RIb8bx5OZ/WpJSY9OxtR3Dbdg:2Kxt/0ojkGZa4H+Ibvo/GJSYQxtR3Xd
MD5:	8B4CD87707F15F838B5DB8ED5B5021D2
SHA1:	BBC05580A181E1C03E0A53760C1559DC99B746FE
SHA-256:	EEFB46501EF97BAF29A93304F58674E70F5CCECAFB183F230E5CE7872A852F56
SHA-512:	6768CFF12FA22FE8540A3F6BDB350A5FCEC0B2A0F01531458EB23F77B24460620CD400078FD1EC63738884C2B78920E428126833953C26B8DC8AD8B7C069415D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........].@..@..@......@...A..@...A..@...E..@...D..@...C..@...A..@..A.f.@../H..@../@..@../...@../B..@.Rich.@.........................PE..d...mYpe.........." ...%............P.....................................................`.........................................PX..d....X..x...............4...............,...pG..............................0F..@............ ..`............................text............................... ..`.rdata...L... ...N..................@..@.data....6...p.......X..............@....pdata..4............d..............@..@.rsrc................p..............@..@.reloc..,............r..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\RoamingIDBGHDGHCG.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1897472
Entropy (8bit):	7.949701996348257
Encrypted:	false
SSDEEP:	49152:jBdwMerCYAiL+O4QL3rXc1gppowZocEZxbI:wMkCxiLzzrs1gp+JcCxM
MD5:	DFA220EFB513FE8F746AB0B1CD410F08
SHA1:	AEE474375A70F0C3076CBE90C0F536C77D8CFD93
SHA-256:	32FE15F8671860B82039D80651F5A7977D26A3CD1CB26BA87960EB723E675134
SHA-512:	7409C33205B0B39BA1AC2513904356974877156907FAF4DF56D7EA2CF3B981036C5C57FF1A47FE826C2A904AA04B18826F14569201FF5FEF2A30EEF16AFFDCC4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....A.f............................. K...........@..........................PK...........@.................................W...k.............................K.............................H.K..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...jnaccepv.....01.....................@...oirghrul......K.....................@....taggant.0... K.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Tasks\axplong.job

Download File

Process:	C:\Users\userGCAFCAFHJJ.exe
File Type:	data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	3.4168895143389393
Encrypted:	false
SSDEEP:	6:773bX45ZsUEZ+lX1lOJUPelkDdtFXqYEp5t/uy0l1XOEt0:3bDQ1lOmeeDNfXV1+Et0
MD5:	104B72A3C8319D88C5F39EE93D40E883
SHA1:	34057A9AEBEEF597FBBBC681FAC315D1BDE6AA07
SHA-256:	06F4133B076EC55843EF7DA7AE3A49892489D45466BC7FD05E641DB55CE7F0E4
SHA-512:	C9CC2741369A529FA53154F5DEA906B33BF453E051D384D5F56837C12AD3BF104B2CF3DE77ED9BC85425CB02D983CE4C3F68395789E0E3052D380C8D74336933
Malicious:	false
Preview:	......k...\C..WV..y.F.......<... .....s.......... ....................:.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.4.4.1.1.1.d.b.c.4.9.\.a.x.p.l.o.n.g...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0.................+.@3P.........................

C:\Windows\Tasks\explorti.job

Download File

Process:	C:\Users\user\AppData\RoamingIDBGHDGHCG.exe
File Type:	data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	3.436076322069211
Encrypted:	false
SSDEEP:	6:XHRjRXUG5ZsUEZ+lX1cI1l6lm6tFXqYEp5t/uy0l1XOEt0:XYQ1cagxfXV1+Et0
MD5:	44070D27B97BF8072E97EDFF8B49DFAD
SHA1:	0115E6C1D3B9277879E8FD5707AF85DE7E03231B
SHA-256:	EFD510754E961AF7B4C291E87B417BF02D65A74A4C03242D8E96813BF9B22CF2
SHA-512:	2F2D281CC7447575E8106E08147296CE372307A798C263205D61BC8558BA965388F581577A401B39D17978163E315F8F7AC0DB752C0F08AFAEF9BF8DA759816E
Malicious:	false
Preview:	.....(.....B.&..;4..F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.0.d.8.f.5.e.b.8.a.7.\.e.x.p.l.o.r.t.i...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0.................+.@3P.........................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.424082449272782
Encrypted:	false
SSDEEP:	6144:zSvfpi6ceLP/9skLmb0OTmWSPHaJG8nAgeMZMMhA2fX4WABlEnN90uhiTw:+vloTmW+EZMM6DFyz03w
MD5:	739851406E25394B8624B8D7F0F03C6A
SHA1:	35F13641C99FB6C428A02EE1CEC5AB65A765E1FE
SHA-256:	40E97A4B844765E512425D9614F6377D8F978F0C80C517136ABC863A140BE4BB
SHA-512:	F00BB8F57148B239F1335F1A1D22231B73E825866206724C5E509A339230D068E872767676BD296AB255742F483D8FC73CE37B87E3DEFAF696C3C3DE4CE6999E
Malicious:	false
Preview:	regf?...?....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmZ.It................................................................................................................................................................................................................................................................................................................................................I._@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\Null

Download File

Process:	C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	216
Entropy (8bit):	4.794411550938339
Encrypted:	false
SSDEEP:	6:C/Kj2RMQ60dsN+55nQPdF8VR9sNcaAJLfFHgzM:x2nW+TnQU79WFsHgw
MD5:	B6AE4872A5ED72005F10AB78243F9E2E
SHA1:	6C4EC8ADAB70B2C836161B298778769019B6B627
SHA-256:	0FD21C4B32577DB1C836ADF98AAA9CDA857E249B1EEE05A9F1EC992B784560EB
SHA-512:	34F83CD66113D52C51549F7CE68FD130FC96EEAFF3A8A46E8B345F4DC5BB60620398E007B1A156ADE7A8328FA24620220B63E7E67510BAE67ABFC171C4C9F3A9
Malicious:	false
Preview:	Anti Debugging Started...Anti Debug Succesfully Executed...Started startup injection...unsupported or unkown startup method!..Succesfully executed startup injection...The code executed on: 22.735697507858276 second..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.977391135328092
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	257'024 bytes
MD5:	d0fcc1d2ad23b05b53eefe1137594ddb
SHA1:	21b7f4bcae07c8c229035ef7f5b53be2a7febc54
SHA256:	367699d2c1f464b4c508846de8e1a760df77756492a2503c49a9086a374b5ef0
SHA512:	53e0f35c685d53e85c7dc824b284fd7eef3c26545bb4571f17354c3730b61ae8edbd760b0bddae8f6d9853ef2c66fba243061a3a179a68fa558e97b7ee10d48b
SSDEEP:	3072:wCOU4fRBfg3ENpgjcuGUSqhGerZg0F+DqV87clD4viAcs:rJ4frpG1PJLOqrDS
TLSH:	9C44BF5075A5D431E4EE043C88A8D1FE293ABDE2DA34D98B77483F1F7D712819A6432E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Tg.s... ... ... .pQ ... .pd ... .pP t.. .~i ... ... d.. .pU ... .p` ... .pg ... Rich... ........PE..L....3zd...................

File Icon


Icon Hash:	cd4d3d2e4e054d07

Static PE Info

General

Entrypoint:	0x4020e9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x647A33C5 [Fri Jun 2 18:24:05 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	227c2d4ce0274b95ccaadb855c19748d

Entrypoint Preview

Instruction
call 00007F0950E6B915h
jmp 00007F0950E67F3Eh
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword ptr [ebp+0Ch]
push esi
call 00007F0950E696C1h
mov dword ptr [ebp+0Ch], eax
mov eax, dword ptr [esi+0Ch]
pop ecx
test al, 82h
jne 00007F0950E680C9h
call 00007F0950E690AFh
mov dword ptr [eax], 00000009h
or dword ptr [esi+0Ch], 20h
or eax, FFFFFFFFh
jmp 00007F0950E681E4h
test al, 40h
je 00007F0950E680BFh
call 00007F0950E69094h
mov dword ptr [eax], 00000022h
jmp 00007F0950E68095h
push ebx
xor ebx, ebx
test al, 01h
je 00007F0950E680C8h
mov dword ptr [esi+04h], ebx
test al, 10h
je 00007F0950E6813Dh
mov ecx, dword ptr [esi+08h]
and eax, FFFFFFFEh
mov dword ptr [esi], ecx
mov dword ptr [esi+0Ch], eax
mov eax, dword ptr [esi+0Ch]
and eax, FFFFFFEFh
or eax, 02h
mov dword ptr [esi+0Ch], eax
mov dword ptr [esi+04h], ebx
mov dword ptr [ebp-04h], ebx
test eax, 0000010Ch
jne 00007F0950E680DEh
call 00007F0950E69259h
add eax, 20h
cmp esi, eax
je 00007F0950E680BEh
call 00007F0950E6924Dh
add eax, 40h
cmp esi, eax
jne 00007F0950E680BFh
push dword ptr [ebp+0Ch]
call 00007F0950E6C29Bh
pop ecx
test eax, eax
jne 00007F0950E680B9h
push esi
call 00007F0950E6C247h
pop ecx
test dword ptr [esi+0Ch], 00000108h
push edi
je 00007F0950E68136h
mov eax, dword ptr [esi+08h]
mov edi, dword ptr [esi]
lea ecx, dword ptr [eax+01h]
mov dword ptr [esi], ecx

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x258e4	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x204c000	0xb7b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2595c	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x253b0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x23000	0x1bc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x21800	0x21800	5ee1371f6e1605f3455fe98482529ad7	False	0.8948810634328358	data	7.8226282857662985	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x23000	0x32e8	0x3400	6849875db3b2a38f99a32cca96c8ba7f	False	0.35306490384615385	OpenPGP Public Key	4.956744327652811	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x27000	0x2022e8c	0xdc00	fbd7748953110379f3e597d411702190	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.maduco	0x204a000	0x2d3	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gubogus	0x204b000	0x400	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x204c000	0xb7b0	0xb800	7f935dd8e87d9e67ec993ee7186c212a	False	0.3783118206521739	data	4.464860766933643	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x2052d58	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.2953091684434968
RT_CURSOR	0x2053c00	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.46705776173285196
RT_CURSOR	0x20544a8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5361271676300579
RT_CURSOR	0x2054a40	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.26439232409381663
RT_CURSOR	0x20558e8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.3686823104693141
RT_CURSOR	0x2056190	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.49060693641618497
RT_ICON	0x204c4e0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	India	0.47334754797441364
RT_ICON	0x204c4e0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Tamil	Sri Lanka	0.47334754797441364
RT_ICON	0x204d388	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	India	0.5888989169675091
RT_ICON	0x204d388	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Tamil	Sri Lanka	0.5888989169675091
RT_ICON	0x204dc30	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.6497695852534562
RT_ICON	0x204dc30	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.6497695852534562
RT_ICON	0x204e2f8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	India	0.6979768786127167
RT_ICON	0x204e2f8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Tamil	Sri Lanka	0.6979768786127167
RT_ICON	0x204e860	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	India	0.3704356846473029
RT_ICON	0x204e860	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	Sri Lanka	0.3704356846473029
RT_ICON	0x2050e08	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Tamil	India	0.46224202626641653
RT_ICON	0x2050e08	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Tamil	Sri Lanka	0.46224202626641653
RT_ICON	0x2051eb0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Tamil	India	0.5405737704918033
RT_ICON	0x2051eb0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Tamil	Sri Lanka	0.5405737704918033
RT_ICON	0x2052838	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	India	0.6329787234042553
RT_ICON	0x2052838	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	Sri Lanka	0.6329787234042553
RT_STRING	0x2056988	0x452	data	Tamil	India	0.45479204339963836
RT_STRING	0x2056988	0x452	data	Tamil	Sri Lanka	0.45479204339963836
RT_STRING	0x2056de0	0x28e	data	Tamil	India	0.481651376146789
RT_STRING	0x2056de0	0x28e	data	Tamil	Sri Lanka	0.481651376146789
RT_STRING	0x2057070	0x73e	data	Tamil	India	0.4261057173678533
RT_STRING	0x2057070	0x73e	data	Tamil	Sri Lanka	0.4261057173678533
RT_ACCELERATOR	0x2052d18	0x40	data	Tamil	India	0.875
RT_ACCELERATOR	0x2052d18	0x40	data	Tamil	Sri Lanka	0.875
RT_GROUP_CURSOR	0x2054a10	0x30	data			0.9375
RT_GROUP_CURSOR	0x20566f8	0x30	data			0.9375
RT_GROUP_ICON	0x2052ca0	0x76	data	Tamil	India	0.6610169491525424
RT_GROUP_ICON	0x2052ca0	0x76	data	Tamil	Sri Lanka	0.6610169491525424
RT_VERSION	0x2056728	0x260	data			0.5361842105263158

Imports

DLL	Import
KERNEL32.dll	LocalCompact, EnumCalendarInfoW, SetEnvironmentVariableW, GetTickCount, CreateNamedPipeW, GetConsoleAliasesA, EnumResourceTypesA, GetConsoleCP, GlobalAlloc, SetFileShortNameW, LoadLibraryW, IsProcessInJob, FatalAppExitW, AssignProcessToJobObject, IsBadCodePtr, ReplaceFileW, GetModuleFileNameW, GetSystemDirectoryA, CreateFileW, GlobalUnlock, CreateJobObjectA, GetLastError, SetEndOfFile, VerLanguageNameW, LoadLibraryA, SetConsoleCtrlHandler, AddAtomW, HeapWalk, GetOEMCP, EnumDateFormatsA, GetModuleHandleA, GetProcessShutdownParameters, EnumResourceNamesA, GetFileTime, PeekConsoleInputA, GetDiskFreeSpaceExA, LCMapStringW, HeapSize, FlushFileBuffers, GetStringTypeW, WriteConsoleInputW, FindVolumeClose, GetProcAddress, HeapCompact, WriteConsoleW, HeapReAlloc, GetCommandLineW, HeapSetInformation, GetStartupInfoW, DecodePointer, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, TerminateProcess, GetCurrentProcess, HeapAlloc, HeapFree, EnterCriticalSection, LeaveCriticalSection, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, MultiByteToWideChar, ReadFile, GetModuleHandleW, ExitProcess, SetFilePointer, HeapCreate, WriteFile, FreeEnvironmentStringsW, GetEnvironmentStringsW, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, WideCharToMultiByte, GetConsoleMode, GetCPInfo, GetACP, IsValidCodePage, Sleep, RtlUnwind, SetStdHandle, IsProcessorFeaturePresent, CloseHandle
USER32.dll	GetMenu, CharUpperBuffW, SetCaretPos, GetMessageExtraInfo, DrawStateW, GetSysColorBrush
GDI32.dll	GetCharWidthI, CreateDCA, GetCharABCWidthsI
WINHTTP.dll	WinHttpOpen
MSIMG32.dll	AlphaBlend

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Target ID:	0
Start time:	19:41:55
Start date:	26/07/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	257'024 bytes
MD5 hash:	D0FCC1D2AD23B05B53EEFE1137594DDB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2443328439.00000000025ED000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2443697846.00000000040E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2443375443.0000000002607000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:42:15
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\AppData\RoamingIDBGHDGHCG.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:42:15
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:42:15
Start date:	26/07/2024
Path:	C:\Users\user\AppData\RoamingIDBGHDGHCG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\RoamingIDBGHDGHCG.exe"
Imagebase:	0x2e0000
File size:	1'897'472 bytes
MD5 hash:	DFA220EFB513FE8F746AB0B1CD410F08
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000003.2203716913.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000002.2245471234.00000000002E1000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:42:17
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\userGCAFCAFHJJ.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:42:17
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:42:17
Start date:	26/07/2024
Path:	C:\Users\userGCAFCAFHJJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\userGCAFCAFHJJ.exe"
Imagebase:	0x360000
File size:	1'922'560 bytes
MD5 hash:	AC2D65E997C85BE5D4D2807C12BAB4E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000008.00000002.2316104817.0000000000361000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000008.00000003.2225111532.0000000004B40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	19:42:18
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
Imagebase:	0xd50000
File size:	1'897'472 bytes
MD5 hash:	DFA220EFB513FE8F746AB0B1CD410F08
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000002.2282786078.0000000000D51000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000003.2242115500.00000000050D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	19:42:19
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6456 -s 2260
Imagebase:	0xb30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	19:42:19
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Imagebase:	0xd50000
File size:	1'897'472 bytes
MD5 hash:	DFA220EFB513FE8F746AB0B1CD410F08
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000D.00000002.2288695597.0000000000D51000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000D.00000003.2248436376.0000000005540000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	19:42:27
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Imagebase:	0x280000
File size:	1'922'560 bytes
MD5 hash:	AC2D65E997C85BE5D4D2807C12BAB4E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000003.2321675490.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000002.2362139356.0000000000281000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	19:43:00
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x280000
File size:	1'922'560 bytes
MD5 hash:	AC2D65E997C85BE5D4D2807C12BAB4E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000012.00000003.2646169494.00000000051A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000012.00000002.3262997504.0000000000281000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	19:43:00
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Imagebase:	0xd50000
File size:	1'897'472 bytes
MD5 hash:	DFA220EFB513FE8F746AB0B1CD410F08
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000003.2649838006.0000000005520000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000002.3262529236.0000000000D51000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	19:43:05
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe"
Imagebase:	0x400000
File size:	257'024 bytes
MD5 hash:	D0FCC1D2AD23B05B53EEFE1137594DDB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000014.00000002.2744587061.00000000025B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000014.00000002.2744921977.00000000025FD000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000014.00000002.2744968028.0000000002617000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	19:43:07
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7188 -s 1040
Imagebase:	0xb30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	19:43:10
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000017001\342db65350.exe"
Imagebase:	0xc0000
File size:	3'224'064 bytes
MD5 hash:	D5F5B683A3CC5C05E5B2CD1204CA5517
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	19:43:12
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000001001\build.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1000001001\build.exe"
Imagebase:	0x7ff698d50000
File size:	11'267'584 bytes
MD5 hash:	C8CF26425A6CE325035E6DA8DFB16C4E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MonsterStealer, Description: Yara detected Monster Stealer, Source: 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000018.00000003.2773862520.0000020780A2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 79%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	19:43:14
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1000001001\build.exe"
Imagebase:	0x7ff724e00000
File size:	18'829'824 bytes
MD5 hash:	1CF17408048317FC82265ED6A1C7893D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 00000019.00000000.2782464290.00007FF725AE6000.00000002.00000001.01000000.00000013.sdmp, Author: Joe Security Rule: JoeSecurity_MonsterStealer, Description: Yara detected Monster Stealer, Source: 00000019.00000000.2782464290.00007FF725AE6000.00000002.00000001.01000000.00000013.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000019.00000000.2782464290.00007FF725AE6000.00000002.00000001.01000000.00000013.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000019.00000002.3043239757.000002606E460000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 00000019.00000002.3102011990.00007FF725AE6000.00000002.00000001.01000000.00000013.sdmp, Author: Joe Security Rule: JoeSecurity_MonsterStealer, Description: Yara detected Monster Stealer, Source: 00000019.00000002.3102011990.00007FF725AE6000.00000002.00000001.01000000.00000013.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000019.00000002.3102011990.00007FF725AE6000.00000002.00000001.01000000.00000013.sdmp, Author: Joe Security Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe, Author: Joe Security Rule: JoeSecurity_MonsterStealer, Description: Yara detected Monster Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\onefile_3032_133665109925829724\stub.exe, Author: Joe Security
Antivirus matches:	Detection: 79%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	19:43:15
Start date:	26/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "ver"
Imagebase:	0x7ff79a5a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	19:43:15
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	19:43:15
Start date:	26/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff79a5a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	19:43:15
Start date:	26/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist"
Imagebase:	0x7ff79a5a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	19:43:15
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	19:43:15
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	19:43:15
Start date:	26/07/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist
Imagebase:	0x7ff784ba0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	19:43:15
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000002001\crypted.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000002001\crypted.exe"
Imagebase:	0x660000
File size:	967'168 bytes
MD5 hash:	371D606AA2FCD2945D84A13E598DA55F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000021.00000002.2793593184.00000000006FC000.00000004.00000001.01000000.00000032.sdmp, Author: Joe Security
Antivirus matches:	Detection: 88%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	19:43:15
Start date:	26/07/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff71c320000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	19:43:15
Start date:	26/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xe90000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000023.00000002.2992462261.00000000031F5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000023.00000002.2992462261.00000000031F5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000023.00000002.2956394415.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	19:43:16
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000016001\97a671ae5d.exe"
Imagebase:	0x400000
File size:	257'024 bytes
MD5 hash:	D0FCC1D2AD23B05B53EEFE1137594DDB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000024.00000002.2850300180.00000000026D0000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000024.00000002.2850361286.00000000026EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000024.00000002.2851004349.00000000040D0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	19:43:17
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000003001\5447jsX.exe"
Imagebase:	0x7f0000
File size:	401'920 bytes
MD5 hash:	5DD9C1FFC4A95D8F1636CE53A5D99997
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 79%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	19:43:18
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	19:43:18
Start date:	26/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe""
Imagebase:	0x7ff79a5a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	19:43:18
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	19:43:18
Start date:	26/07/2024
Path:	C:\Windows\System32\attrib.exe
Wow64 process (32bit):	false
Commandline:	attrib +h +s "C:\Users\user\AppData\Local\MonsterUpdateService\Monster.exe"
Imagebase:	0x7ff648c40000
File size:	23'040 bytes
MD5 hash:	5037D8E6670EF1D89FB6AD435F12A9FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	19:43:18
Start date:	26/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('%error_message%', 0, 'System Error', 0+16);close()""
Imagebase:	0x7ff79a5a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	19:43:18
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	19:43:18
Start date:	26/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
Imagebase:	0x7ff6a5670000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	19:43:18
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	19:43:18
Start date:	26/07/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /F /IM chrome.exe
Imagebase:	0x7ff68ade0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	19:43:18
Start date:	26/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x950000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000002F.00000002.3029002681.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000002F.00000002.3029002681.0000000000F0A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	19:43:19
Start date:	26/07/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7332 -s 1320
Imagebase:	0xb30000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	19:43:20
Start date:	26/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff79a5a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	19:43:20
Start date:	26/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
Imagebase:	0x7ff79a5a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	19:43:20
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	19:43:20
Start date:	26/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "chcp"
Imagebase:	0x7ff79a5a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	19:43:20
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	19:43:20
Start date:	26/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "chcp"
Imagebase:	0x7ff79a5a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	19:43:20
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	19:43:20
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	19:43:20
Start date:	26/07/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff784ba0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	19:43:20
Start date:	26/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe Get-Clipboard
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	19:43:20
Start date:	26/07/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp
Imagebase:	0x7ff6d2680000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	19:43:20
Start date:	26/07/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp
Imagebase:	0x7ff6d2680000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	19:43:21
Start date:	26/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
Imagebase:	0x7ff79a5a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	19:43:21
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	19:43:21
Start date:	26/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1000004001\crypteda.exe"
Imagebase:	0xd30000
File size:	1'464'832 bytes
MD5 hash:	04E90B2CF273EFB3F6895CFCEF1E59BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 79%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	19:43:21
Start date:	26/07/2024
Path:	C:\Windows\System32\systeminfo.exe
Wow64 process (32bit):	false
Commandline:	systeminfo
Imagebase:	0x7ff677f80000
File size:	110'080 bytes
MD5 hash:	EE309A9C61511E907D87B10EF226FDCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	19:43:21
Start date:	26/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
Imagebase:	0x7ff79a5a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	19:43:21
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	19:43:21
Start date:	26/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	19:43:22
Start date:	26/07/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	70
Start time:	19:43:22
Start date:	26/07/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profiles
Imagebase:	0x7ff7fadd0000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	19:43:24
Start date:	26/07/2024
Path:	C:\Windows\System32\HOSTNAME.EXE
Wow64 process (32bit):	false
Commandline:	hostname
Imagebase:	0x7ff6dad70000
File size:	14'848 bytes
MD5 hash:	33AFAA43B84BDEAB12E02F9DBD2B2EE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	19:43:24
Start date:	26/07/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic logicaldisk get caption,description,providername
Imagebase:	0x7ff71c320000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	40

Executed Functions

Function 004195E0 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,025E5A68), ref: 004195FD
GetProcAddress.KERNEL32(75900000,025E5AC8), ref: 00419615
GetProcAddress.KERNEL32(75900000,02606BA8), ref: 0041962E
GetProcAddress.KERNEL32(75900000,02606B90), ref: 00419646
GetProcAddress.KERNEL32(75900000,02606BD8), ref: 0041965E
GetProcAddress.KERNEL32(75900000,02606BF0), ref: 00419677
GetProcAddress.KERNEL32(75900000,025E9460), ref: 0041968F
GetProcAddress.KERNEL32(75900000,02606BC0), ref: 004196A7
GetProcAddress.KERNEL32(75900000,02606B30), ref: 004196C0
GetProcAddress.KERNEL32(75900000,02606B60), ref: 004196D8
GetProcAddress.KERNEL32(75900000,02606B78), ref: 004196F0
GetProcAddress.KERNEL32(75900000,025E5908), ref: 00419709
GetProcAddress.KERNEL32(75900000,025E5988), ref: 00419721
GetProcAddress.KERNEL32(75900000,025E5B08), ref: 00419739
GetProcAddress.KERNEL32(75900000,025E5B28), ref: 00419752
GetProcAddress.KERNEL32(75900000,02608D08), ref: 0041976A
GetProcAddress.KERNEL32(75900000,02608CC0), ref: 00419782
GetProcAddress.KERNEL32(75900000,025E90F0), ref: 0041979B
GetProcAddress.KERNEL32(75900000,025E5B88), ref: 004197B3
GetProcAddress.KERNEL32(75900000,02608CF0), ref: 004197CB
GetProcAddress.KERNEL32(75900000,02608CA8), ref: 004197E4
GetProcAddress.KERNEL32(75900000,02608CD8), ref: 004197FC
GetProcAddress.KERNEL32(75900000,02608C48), ref: 00419814
GetProcAddress.KERNEL32(75900000,025E5BC8), ref: 0041982D
GetProcAddress.KERNEL32(75900000,02608C60), ref: 00419845
GetProcAddress.KERNEL32(75900000,02608C78), ref: 0041985D
GetProcAddress.KERNEL32(75900000,02608C90), ref: 00419876
GetProcAddress.KERNEL32(75900000,02608AF8), ref: 0041988E
GetProcAddress.KERNEL32(75900000,02608A68), ref: 004198A6
GetProcAddress.KERNEL32(75900000,026089C0), ref: 004198BF
GetProcAddress.KERNEL32(75900000,02608C30), ref: 004198D7
GetProcAddress.KERNEL32(75900000,02608948), ref: 004198EF
GetProcAddress.KERNEL32(75900000,02608AC8), ref: 00419908
GetProcAddress.KERNEL32(75900000,025E8F58), ref: 00419920
GetProcAddress.KERNEL32(75900000,02608C18), ref: 00419938
GetProcAddress.KERNEL32(75900000,02608A08), ref: 00419951
GetProcAddress.KERNEL32(75900000,025E58C8), ref: 00419969
GetProcAddress.KERNEL32(75900000,02608A20), ref: 00419981
GetProcAddress.KERNEL32(75900000,025E5C28), ref: 0041999A
GetProcAddress.KERNEL32(75900000,02608B10), ref: 004199B2
GetProcAddress.KERNEL32(75900000,02608B40), ref: 004199CA
GetProcAddress.KERNEL32(75900000,025E5868), ref: 004199E3
GetProcAddress.KERNEL32(75900000,025E5C48), ref: 004199FB
LoadLibraryA.KERNEL32(02608B58,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A0D
LoadLibraryA.KERNEL32(02608B70,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A1E
LoadLibraryA.KERNEL32(02608B88,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A30
LoadLibraryA.KERNEL32(02608960,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A42
LoadLibraryA.KERNEL32(026089D8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A53
LoadLibraryA.KERNEL32(02608BA0,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A65
LoadLibraryA.KERNEL32(02608A50,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A77
LoadLibraryA.KERNEL32(02608BB8,?,00415783,?,00000034,00000064,004160A0,?,0000002C,00000064,00416040,?,00000030,00000064,Function_000155B0,?), ref: 00419A88
GetProcAddress.KERNEL32(75FD0000,025E5DC8), ref: 00419AAA
GetProcAddress.KERNEL32(75FD0000,02608A38), ref: 00419AC2
GetProcAddress.KERNEL32(75FD0000,025EBC48), ref: 00419ADA
GetProcAddress.KERNEL32(75FD0000,02608978), ref: 00419AF3
GetProcAddress.KERNEL32(75FD0000,025E5EA8), ref: 00419B0B
GetProcAddress.KERNEL32(73430000,025E93C0), ref: 00419B30
GetProcAddress.KERNEL32(73430000,025E5D88), ref: 00419B49
GetProcAddress.KERNEL32(73430000,025E9488), ref: 00419B61
GetProcAddress.KERNEL32(73430000,02608BD0), ref: 00419B79
GetProcAddress.KERNEL32(73430000,02608BE8), ref: 00419B92
GetProcAddress.KERNEL32(73430000,025E5DE8), ref: 00419BAA
GetProcAddress.KERNEL32(73430000,025E5E08), ref: 00419BC2
GetProcAddress.KERNEL32(73430000,02608AB0), ref: 00419BDB
GetProcAddress.KERNEL32(763B0000,025E5DA8), ref: 00419BFC
GetProcAddress.KERNEL32(763B0000,025E5F68), ref: 00419C14
GetProcAddress.KERNEL32(763B0000,02608A80), ref: 00419C2D
GetProcAddress.KERNEL32(763B0000,02608A98), ref: 00419C45
GetProcAddress.KERNEL32(763B0000,025E5F08), ref: 00419C5D
GetProcAddress.KERNEL32(750F0000,025E92F8), ref: 00419C83
GetProcAddress.KERNEL32(750F0000,025E9398), ref: 00419C9B
GetProcAddress.KERNEL32(750F0000,026089F0), ref: 00419CB3
GetProcAddress.KERNEL32(750F0000,025E5F48), ref: 00419CCC
GetProcAddress.KERNEL32(750F0000,025E5E88), ref: 00419CE4
GetProcAddress.KERNEL32(750F0000,025E93E8), ref: 00419CFC
GetProcAddress.KERNEL32(75A50000,02608AE0), ref: 00419D22
GetProcAddress.KERNEL32(75A50000,025E5C68), ref: 00419D3A
GetProcAddress.KERNEL32(75A50000,025EBE08), ref: 00419D52
GetProcAddress.KERNEL32(75A50000,02608B28), ref: 00419D6B
GetProcAddress.KERNEL32(75A50000,02608C00), ref: 00419D83
GetProcAddress.KERNEL32(75A50000,025E5C88), ref: 00419D9B
GetProcAddress.KERNEL32(75A50000,025E5FA8), ref: 00419DB4
GetProcAddress.KERNEL32(75A50000,02608990), ref: 00419DCC
GetProcAddress.KERNEL32(75A50000,026089A8), ref: 00419DE4
GetProcAddress.KERNEL32(75070000,025E5EC8), ref: 00419E06
GetProcAddress.KERNEL32(75070000,02609410), ref: 00419E1E
GetProcAddress.KERNEL32(75070000,02609458), ref: 00419E36
GetProcAddress.KERNEL32(75070000,02609428), ref: 00419E4F
GetProcAddress.KERNEL32(75070000,026093E0), ref: 00419E67
GetProcAddress.KERNEL32(74E50000,025E5F28), ref: 00419E88
GetProcAddress.KERNEL32(74E50000,025E5EE8), ref: 00419EA1
GetProcAddress.KERNEL32(75320000,025E5E28), ref: 00419EC2
GetProcAddress.KERNEL32(75320000,02609500), ref: 00419EDA
GetProcAddress.KERNEL32(6F080000,025E5D28), ref: 00419F00
GetProcAddress.KERNEL32(6F080000,025E5FC8), ref: 00419F18
GetProcAddress.KERNEL32(6F080000,025E5F88), ref: 00419F30
GetProcAddress.KERNEL32(6F080000,02609380), ref: 00419F49
GetProcAddress.KERNEL32(6F080000,025E5FE8), ref: 00419F61
GetProcAddress.KERNEL32(6F080000,025E5E48), ref: 00419F79
GetProcAddress.KERNEL32(6F080000,025E5E68), ref: 00419F92
GetProcAddress.KERNEL32(6F080000,025E5CA8), ref: 00419FAA
GetProcAddress.KERNEL32(6F080000,InternetSetOptionA), ref: 00419FC1
GetProcAddress.KERNEL32(6F080000,HttpQueryInfoA), ref: 00419FD7
GetProcAddress.KERNEL32(74E00000,026093B0), ref: 00419FF9
GetProcAddress.KERNEL32(74E00000,025EBD18), ref: 0041A011
GetProcAddress.KERNEL32(74E00000,026093C8), ref: 0041A029
GetProcAddress.KERNEL32(74E00000,026093F8), ref: 0041A042
GetProcAddress.KERNEL32(74DF0000,025E5CC8), ref: 0041A063
GetProcAddress.KERNEL32(6E0A0000,02609440), ref: 0041A084
GetProcAddress.KERNEL32(6E0A0000,025E5CE8), ref: 0041A09D
GetProcAddress.KERNEL32(6E0A0000,02609488), ref: 0041A0B5
GetProcAddress.KERNEL32(6E0A0000,02609350), ref: 0041A0CD

Strings

HttpQueryInfoA, xrefs: 00419FCC
InternetSetOptionA, xrefs: 00419FB5

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction ID: de404ee9f47513f53d28e8016dc56f999ad60f1515a6c9981bc8237813ea7153
Opcode Fuzzy Hash: 42a1c126b23ada8373e6c48d5b9de957363c63bf0e0344acec6b940ad07a1c70
Instruction Fuzzy Hash: 946243B5500E00AFC774DFA8EE88D1E3BABBB8C761750A51AE609C3674D7349443DBA4

Function 00404610 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404648
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,0041649B), ref: 00404657
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,0041649B), ref: 0040465E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040466C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404677
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404682
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 0040468D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 00404698
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046AC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046B7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046CD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,0041649B), ref: 004046D8
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404701
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040470C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404717
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404722
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472D
strlen.MSVCRT ref: 00404740
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404768
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404773
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040477E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404789
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404794
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047A4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047AF
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047BA
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047C5
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047D0
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 004047EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046FC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047C0

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: e597e8fc72bf404d1b85c08bbf82363fdc41d925fce3c21812b4f2230c6aabb6
Instruction ID: 04d817b79848fc48b59ba69504da24c7d1b3191c531f4b94b2025844f93bc58f
Opcode Fuzzy Hash: e597e8fc72bf404d1b85c08bbf82363fdc41d925fce3c21812b4f2230c6aabb6
Instruction Fuzzy Hash: E941BB79740624EBC71C9FE5EC89B987F71AB4C712BA0C062F90299190C7F9D5019B3D

Function 0040BCB0 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00420B17,00420B16,00000000,?,?,?,00421398,00420B0F), ref: 0040BD35
StrCmpCA.SHLWAPI(?,0042139C), ref: 0040BD8D
StrCmpCA.SHLWAPI(?,004213A0), ref: 0040BDA3
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040C5FF
FindClose.KERNEL32(000000FF), ref: 0040C611

Strings

Brave, xrefs: 0040BF42
Preferences, xrefs: 0040BF5E
Google Chrome, xrefs: 0040C474
\Brave\Preferences, xrefs: 0040C01B

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 167c024a988f99dbc550853319b372ac92a84e5277b2a532d4af21f5082d9901
Instruction ID: 367325ed2970f14afd5354ed5b858d96e390655a4ce51a4c817116a6e2d4185c
Opcode Fuzzy Hash: 167c024a988f99dbc550853319b372ac92a84e5277b2a532d4af21f5082d9901
Instruction Fuzzy Hash: 5142BB71901108A7CB14FBB1DC96EED733DAF84314F40456EF90A66191EF389B98CB9A

Function 6C5A35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C62F688,00001000), ref: 6C5A35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5A35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C5A35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5A363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5A369F
__aulldiv.LIBCMT ref: 6C5A36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C5A3773
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5A377E
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5A37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C5A37C4
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5A37CB
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5A3801
__aulldiv.LIBCMT ref: 6C5A3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C5A3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C5A3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C5A394C

Strings

AuthcAMDenti, xrefs: 6C5A3946
MOZ_TIMESTAMP_MODE, xrefs: 6C5A35DB
QPC, xrefs: 6C5A38FC
GenuntelineI, xrefs: 6C5A3639
GTC, xrefs: 6C5A3912

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 2c4448e7cb1090e5ad88f7fb1f6d1f98e8f0659bc47a31968e1b8cb9188a8460
Instruction ID: 58258d794846fcac44fbf7d8a36d5c5d9ce4a27c2b84679bf9037ea9a8444b09
Opcode Fuzzy Hash: 2c4448e7cb1090e5ad88f7fb1f6d1f98e8f0659bc47a31968e1b8cb9188a8460
Instruction Fuzzy Hash: C2B1D671B093109FDB08DF6AC884A1ABBF5FB8A704F04893DE499D7750D738D9058B8A

Function 004143F0 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 0041440C
FindFirstFileA.KERNEL32(?,?), ref: 00414423
StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
FindClose.KERNEL32(000000FF), ref: 00414672

Strings

%s\%s, xrefs: 00414484
%s\*, xrefs: 00414400
%s\%s, xrefs: 004144DB

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: f10b3ef63ac58111c52ea4a6e461e65bdbfa38dd07c4c5dfd894e8abc9a24d7a
Instruction ID: 93dd7dc702b7a0e0fded8c7806ce8f3795ba14a1618ae0d79b753d530a2b99d1
Opcode Fuzzy Hash: f10b3ef63ac58111c52ea4a6e461e65bdbfa38dd07c4c5dfd894e8abc9a24d7a
Instruction Fuzzy Hash: 11616571900618ABCB30EFA0DC49FEE737DBF48704F408599F50996151EB78AB858FA5

Function 004139B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004139D3
FindFirstFileA.KERNEL32(?,?), ref: 004139EA
StrCmpCA.SHLWAPI(?,00420F7C), ref: 00413A18
StrCmpCA.SHLWAPI(?,00420F80), ref: 00413A2E
FindNextFileA.KERNEL32(000000FF,?), ref: 00413B7C
FindClose.KERNEL32(000000FF), ref: 00413B91

Strings

%s\%s, xrefs: 004139C7

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 512713d9111bc43f0bbf9ba38dcfdbdb478c8eb3975ea046f1aaff3a3d924c13
Instruction ID: 0978cf4b12305aed0c6265f700eadee139911ff0226e3ee7039eca2cb0139609
Opcode Fuzzy Hash: 512713d9111bc43f0bbf9ba38dcfdbdb478c8eb3975ea046f1aaff3a3d924c13
Instruction Fuzzy Hash: EE5188B1900218ABCB24EF60DC45EEE777DBF44304F40858DB60996151EB749BC5CF98

Function 0040F4F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0042155C,00420D7E), ref: 0040F55E
StrCmpCA.SHLWAPI(?,00421560), ref: 0040F5AF
StrCmpCA.SHLWAPI(?,00421564), ref: 0040F5C5
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040F8F1
FindClose.KERNEL32(000000FF), ref: 0040F903

Strings

prefs.js, xrefs: 0040F652

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 0fa6beab0bfe238109d321ca42a8603b3a39ce42cd42066e1eefbb6c357fc549
Instruction ID: 51e7ee45db09aa5f39b002a0c415dffe3bc9b22f3a493195af03bb486277efdd
Opcode Fuzzy Hash: 0fa6beab0bfe238109d321ca42a8603b3a39ce42cd42066e1eefbb6c357fc549
Instruction Fuzzy Hash: 00B17571901108ABCB24FF61DC56FEE7379AF54314F0081BEA40A57191EF386B99CB9A

Function 00401710 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00425004,?,00401F6C,?,004250AC,?,?,00000000,?,00000000), ref: 00401963
StrCmpCA.SHLWAPI(?,00425154), ref: 004019B3
StrCmpCA.SHLWAPI(?,004251FC), ref: 004019C9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401D80
DeleteFileA.KERNEL32(00000000), ref: 00401E0A
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E60
FindClose.KERNEL32(000000FF), ref: 00401E72

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Strings

\*.*, xrefs: 00401831

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 43ba0db6ca9821de141a07defb777709061facd9e216ec36073d8ec29cc647e5
Instruction ID: 16b9519e73a2a048c1aa4c2f75882a05a68b4b793ed3d445f0fb30e7c05d6763
Opcode Fuzzy Hash: 43ba0db6ca9821de141a07defb777709061facd9e216ec36073d8ec29cc647e5
Instruction Fuzzy Hash: 83123F71911118ABCB15FB61CC96EEE7338AF54314F4041AEB50B62091EF786BD8CF9A

Function 0040D8C0 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00421454,00420B96), ref: 0040D92B
StrCmpCA.SHLWAPI(?,00421458), ref: 0040D973
StrCmpCA.SHLWAPI(?,0042145C), ref: 0040D989
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DC0C
FindClose.KERNEL32(000000FF), ref: 0040DC1E

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 4d2a5caa54ddd420dd00294a1bf56e100eeb49198da520900e70f3ec28c6a43c
Instruction ID: be130f63dcff9d07870f4f5a4cae658f80ac6a3b159c82c28f33fed987b29411
Opcode Fuzzy Hash: 4d2a5caa54ddd420dd00294a1bf56e100eeb49198da520900e70f3ec28c6a43c
Instruction Fuzzy Hash: 23914672900204A7CB14FBB1DC56DED737DAF94354F00866EF80A66191EE389B5C8B9B

Function 00405000 Relevance: 12.1, APIs: 8, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040501A
RtlAllocateHeap.NTDLL(00000000), ref: 00405021
InternetOpenA.WININET(00420DC7,00000000,00000000,00000000,00000000), ref: 0040503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405061
InternetReadFile.WININET(004159BB,?,00000400,00000000), ref: 00405091
memcpy.MSVCRT ref: 004050DA
InternetCloseHandle.WININET(004159BB), ref: 00405109
InternetCloseHandle.WININET(?), ref: 00405116

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: f41d2cb06437f678c138a8aab9bea3ed0b685f25b19439ba06f49e9e8cae6bb0
Instruction ID: 839bf57ea29f75d8981f3e40a03c3eb3ba9ac3aa2e1ac21d7b315b502f3c448d
Opcode Fuzzy Hash: f41d2cb06437f678c138a8aab9bea3ed0b685f25b19439ba06f49e9e8cae6bb0
Instruction Fuzzy Hash: 1D31E9B4A00618ABDB20CF54DD85BDDB7B5EF48304F5081E9BA09A7281C7746AC68F99

Function 0040E270 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420C1F), ref: 0040E2E2
StrCmpCA.SHLWAPI(?,0042149C), ref: 0040E332
StrCmpCA.SHLWAPI(?,004214A0), ref: 0040E348
FindNextFileA.KERNEL32(000000FF,?), ref: 0040EA1F

Strings

.@, xrefs: 0040EA35, 0040E42B, 0040E55C, 0040E69B, 0040E2F9, 0040E42E, 0040E55F, 0040E69E
\*.*, xrefs: 0040E28D

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: .@$\*.*
API String ID: 433455689-1178718010
Opcode ID: bdd47da061b7421e9227a2976377c029463a661f808bd4dfe55843610af881bf
Instruction ID: 20f818950e8166c8af1a449285f1ab07a785d4baccce5c5ed3abadeee2d63442
Opcode Fuzzy Hash: bdd47da061b7421e9227a2976377c029463a661f808bd4dfe55843610af881bf
Instruction Fuzzy Hash: BE125331911118ABCB14FB61DC5AEED7338AF54314F4045AEB90B62091EF786FD8CB9A

Function 00417630 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
LocalAlloc.KERNEL32(00000040,?), ref: 00417699
GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
LocalFree.KERNEL32(00000000), ref: 004177C2

Strings

/ , xrefs: 0041771F

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 2af955e06c54723e82a802fd37ed11a5747e996d7f98f2e68b98d8297d048985
Instruction ID: c1db32f68e501b8527b0747275b78d72b64e7f1ab46943026d097e8974929a8d
Opcode Fuzzy Hash: 2af955e06c54723e82a802fd37ed11a5747e996d7f98f2e68b98d8297d048985
Instruction Fuzzy Hash: 49418F71941118ABCB24DF94DC89FEEB374FB54314F2041DAE40A62191DB782F85CFA5

Function 004190A0 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004190BE
Process32First.KERNEL32(00420AB3,00000128), ref: 004190D2
Process32Next.KERNEL32(00420AB3,00000128), ref: 004190E7
StrCmpCA.SHLWAPI(?,00000000), ref: 004190FC
CloseHandle.KERNEL32(00420AB3), ref: 0041911A

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction ID: 54ad55f7a4b81502d496241441e07260b80a378e6eebdd4a9cd1ea64267145a6
Opcode Fuzzy Hash: 53cc5b1a25e9de08871f2f161f83c20120fe0a383d746f94447c3d4f9de0246b
Instruction Fuzzy Hash: 1E010875A00208FBDB20DFA4CD99BEEBBF9AF08700F104199E909A7250DB749E85DF55

Function 00409BB0 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
memcpy.MSVCRT ref: 00409C16
LocalFree.KERNEL32(?), ref: 00409C23

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction ID: 89a0ba0d6d0461e137ce63e6e87bc55d2f461512d11096c1476870e855060961
Opcode Fuzzy Hash: 7bf331572f1629f969e766ff9da9bf80e1d95d1acc3dba2254ec725ed3047747
Instruction Fuzzy Hash: 7111E8B8A00209DFCB04DF94D984AAEB7B6FF88300F108569E915A7390D730AE51CF65

Function 004174D0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,02608F48,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,02608F48,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,02608F48,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D
wsprintfA.USER32 ref: 00417557

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction ID: e353cc71a305f1a8f1a8746e49c408d3a80ec80c51124973b3d8e1cf6413b4f4
Opcode Fuzzy Hash: ebf191636fdab90f45f19ccd6af6600c11bec1d160f4b14778d2533b0a03f9df
Instruction Fuzzy Hash: 4111E1B1E05618EBEB20CF54DC45FA9B779FB00720F10039AF50A932D0C7785A85CB55

Function 004172F0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction ID: d97db1a59c4db881a004fd13fa95f43a4b4e799dc382b7b3ddd968380e0460c3
Opcode Fuzzy Hash: 964d200717a0df2f3f62487d6067e07b9107b608128a919957ff18d07be4aa47
Instruction Fuzzy Hash: B6F04FB1944648AFC710DF98DD45BAEBBB9FB08B21F10021AFA15A3690C7745545CBA1

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction ID: 6710e554edad90447a57410479f56be173a40300ace114c8cd68aa34356edfab
Opcode Fuzzy Hash: fb17d3f43d2abce587f83b1d922277e93116013ddf9f148f75be850ad6644e92
Instruction Fuzzy Hash: 17D05E74D0020CDBCB14DFE09A49ADDBB7AAB0D321F001656ED0572240DA305446CA65

Function 00407750 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00415CA4,?), ref: 00407764
RtlAllocateHeap.NTDLL(00000000,?,00415CA4,?), ref: 0040776B
lstrcat.KERNEL32(?,025E00F0), ref: 0040791B
lstrcat.KERNEL32(?,?), ref: 0040792F
lstrcat.KERNEL32(?,?), ref: 00407943
lstrcat.KERNEL32(?,?), ref: 00407957
lstrcat.KERNEL32(?,02609098), ref: 0040796B
lstrcat.KERNEL32(?,02609128), ref: 0040797F
lstrcat.KERNEL32(?,02609170), ref: 00407992
lstrcat.KERNEL32(?,02609188), ref: 004079A6
lstrcat.KERNEL32(?,025E02E0), ref: 004079BA
lstrcat.KERNEL32(?,?), ref: 004079CE
lstrcat.KERNEL32(?,?), ref: 004079E2
lstrcat.KERNEL32(?,?), ref: 004079F6
lstrcat.KERNEL32(?,02609098), ref: 00407A09
lstrcat.KERNEL32(?,02609128), ref: 00407A1D
lstrcat.KERNEL32(?,02609170), ref: 00407A31
lstrcat.KERNEL32(?,02609188), ref: 00407A44
lstrcat.KERNEL32(?,025E1DD8), ref: 00407A58
lstrcat.KERNEL32(?,?), ref: 00407A6C
lstrcat.KERNEL32(?,?), ref: 00407A80
lstrcat.KERNEL32(?,?), ref: 00407A94
lstrcat.KERNEL32(?,02609098), ref: 00407AA8
lstrcat.KERNEL32(?,02609128), ref: 00407ABB
lstrcat.KERNEL32(?,02609170), ref: 00407ACF
lstrcat.KERNEL32(?,02609188), ref: 00407AE3
lstrcat.KERNEL32(?,02606C08), ref: 00407AF6
lstrcat.KERNEL32(?,?), ref: 00407B0A
lstrcat.KERNEL32(?,?), ref: 00407B1E
lstrcat.KERNEL32(?,?), ref: 00407B32
lstrcat.KERNEL32(?,02609098), ref: 00407B46
lstrcat.KERNEL32(?,02609128), ref: 00407B5A
lstrcat.KERNEL32(?,02609170), ref: 00407B6D
lstrcat.KERNEL32(?,02609188), ref: 00407B81
lstrcat.KERNEL32(?,02606C70), ref: 00407B95
lstrcat.KERNEL32(?,?), ref: 00407BA9
lstrcat.KERNEL32(?,?), ref: 00407BBD
lstrcat.KERNEL32(?,?), ref: 00407BD1
lstrcat.KERNEL32(?,02609098), ref: 00407BE4
lstrcat.KERNEL32(?,02609128), ref: 00407BF8
lstrcat.KERNEL32(?,02609170), ref: 00407C0C
lstrcat.KERNEL32(?,02609188), ref: 00407C1F
lstrcat.KERNEL32(?,02606CD8), ref: 00407C33
lstrcat.KERNEL32(?,?), ref: 00407C47
lstrcat.KERNEL32(?,?), ref: 00407C5B
lstrcat.KERNEL32(?,?), ref: 00407C6F
lstrcat.KERNEL32(?,02609098), ref: 00407C83
lstrcat.KERNEL32(?,02609128), ref: 00407C96
lstrcat.KERNEL32(?,02609170), ref: 00407CAA
lstrcat.KERNEL32(?,02609188), ref: 00407CBE

Part of subcall function 00407610: lstrcat.KERNEL32(35426020,004217A0), ref: 00407646
Part of subcall function 00407610: lstrcat.KERNEL32(35426020,00000000), ref: 00407688
Part of subcall function 00407610: lstrcat.KERNEL32(35426020, : ), ref: 0040769A
Part of subcall function 00407610: lstrcat.KERNEL32(35426020,00000000), ref: 004076CF
Part of subcall function 00407610: lstrcat.KERNEL32(35426020,004217A8), ref: 004076E0
Part of subcall function 00407610: lstrcat.KERNEL32(35426020,00000000), ref: 00407713
Part of subcall function 00407610: lstrcat.KERNEL32(35426020,004217AC), ref: 0040772D
Part of subcall function 00407610: task.LIBCPMTD ref: 0040773B

lstrcat.KERNEL32(?,025EBED8), ref: 00407E4B
lstrcat.KERNEL32(?,026098F8), ref: 00407E5E
lstrlenA.KERNEL32(35426020), ref: 00407E6B
lstrlenA.KERNEL32(35426020), ref: 00407E7B

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 182ae1ed2f8d26e872c664b2479cf3bc4cd865b6e3a7470a54644f0512f235c0
Instruction ID: 1e9b08135f7dcdfaa8f2c2dd520ea7fbbb4c73797e410f6fed26cf7179196423
Opcode Fuzzy Hash: 182ae1ed2f8d26e872c664b2479cf3bc4cd865b6e3a7470a54644f0512f235c0
Instruction Fuzzy Hash: 8B3264B2C00615ABCB25EBA0DC89DDE773DAB48704F444A9DF60962090EE79E7C5CF64

Function 00410090 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

strtok_s.MSVCRT ref: 0041015B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DA6,00420DA3,00420DA2,00420D9F), ref: 004101A2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004101A9
StrStrA.SHLWAPI(00000000,<Host>), ref: 004101C5
lstrlenA.KERNEL32(00000000), ref: 004101D3

Part of subcall function 00418380: malloc.MSVCRT ref: 00418388
Part of subcall function 00418380: strncpy.MSVCRT ref: 004183A3

StrStrA.SHLWAPI(00000000,<Port>), ref: 0041020F
lstrlenA.KERNEL32(00000000), ref: 0041021D
StrStrA.SHLWAPI(00000000,<User>), ref: 00410259
lstrlenA.KERNEL32(00000000), ref: 00410267
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 004102A3
lstrlenA.KERNEL32(00000000), ref: 004102B5
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 00410342
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041035A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410372
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041038A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 004103A2
lstrcat.KERNEL32(?,profile: null), ref: 004103B1
lstrcat.KERNEL32(?,url: ), ref: 004103C0
lstrcat.KERNEL32(?,00000000), ref: 004103D3
lstrcat.KERNEL32(?,0042161C), ref: 004103E2
lstrcat.KERNEL32(?,00000000), ref: 004103F5
lstrcat.KERNEL32(?,00421620), ref: 00410404
lstrcat.KERNEL32(?,login: ), ref: 00410413
lstrcat.KERNEL32(?,00000000), ref: 00410426
lstrcat.KERNEL32(?,0042162C), ref: 00410435
lstrcat.KERNEL32(?,password: ), ref: 00410444
lstrcat.KERNEL32(?,00000000), ref: 00410457
lstrcat.KERNEL32(?,0042163C), ref: 00410466
lstrcat.KERNEL32(?,00421640), ref: 00410475
strtok_s.MSVCRT ref: 004104B9
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420D9E), ref: 004104CE
memset.MSVCRT ref: 0041051D

Strings

browser: FileZilla, xrefs: 00410399
profile: null, xrefs: 004103A8
login: , xrefs: 0041040A
password: , xrefs: 0041043B
<Host>, xrefs: 004101BC
url: , xrefs: 004103B7
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 004100E4
<Port>, xrefs: 00410206
<Pass encoding="base64">, xrefs: 0041029A
<User>, xrefs: 00410250

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$ChangeCloseCreateFindFolderFreeNotificationPathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1266801029-555421843
Opcode ID: 07093b7a916175c20f6978c6d9a3266773ad134aeebba12c47f7873bda49044c
Instruction ID: f2c119995f801d95b771d97b8d40ebd85ad32e2919b54f786426441ea9706e1a
Opcode Fuzzy Hash: 07093b7a916175c20f6978c6d9a3266773ad134aeebba12c47f7873bda49044c
Instruction Fuzzy Hash: BBD1A571A00108ABCB04EBF1DC4AEEE7739AF54314F50851EF103A7191DF78AA95CB69

Function 00419270 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,025ECDB0), ref: 004192B1
GetProcAddress.KERNEL32(75900000,025ECCF0), ref: 004192CA
GetProcAddress.KERNEL32(75900000,026069B0), ref: 004192E2
GetProcAddress.KERNEL32(75900000,026069C8), ref: 004192FA
GetProcAddress.KERNEL32(75900000,02606AD0), ref: 00419313
GetProcAddress.KERNEL32(75900000,025E64F0), ref: 0041932B
GetProcAddress.KERNEL32(75900000,025E5A48), ref: 00419343
GetProcAddress.KERNEL32(75900000,025E5B68), ref: 0041935C
GetProcAddress.KERNEL32(75900000,02606860), ref: 00419374
GetProcAddress.KERNEL32(75900000,02606908), ref: 0041938C
GetProcAddress.KERNEL32(75900000,026069F8), ref: 004193A5
GetProcAddress.KERNEL32(75900000,02606890), ref: 004193BD
GetProcAddress.KERNEL32(75900000,025E5888), ref: 004193D5
GetProcAddress.KERNEL32(75900000,02606878), ref: 004193EE
GetProcAddress.KERNEL32(75900000,02606A10), ref: 00419406
GetProcAddress.KERNEL32(75900000,025E5A28), ref: 0041941E
GetProcAddress.KERNEL32(75900000,02606938), ref: 00419437
GetProcAddress.KERNEL32(75900000,026069E0), ref: 0041944F
GetProcAddress.KERNEL32(75900000,025E58E8), ref: 00419467
GetProcAddress.KERNEL32(75900000,02606B00), ref: 00419480
GetProcAddress.KERNEL32(75900000,025E5968), ref: 00419498
LoadLibraryA.KERNEL32(026068D8,?,004164A0), ref: 004194AA
LoadLibraryA.KERNEL32(02606A28,?,004164A0), ref: 004194BB
LoadLibraryA.KERNEL32(02606968,?,004164A0), ref: 004194CD
LoadLibraryA.KERNEL32(02606AB8,?,004164A0), ref: 004194DF
LoadLibraryA.KERNEL32(026068C0,?,004164A0), ref: 004194F0
GetProcAddress.KERNEL32(75070000,026068A8), ref: 00419512
GetProcAddress.KERNEL32(75FD0000,02606A88), ref: 00419533
GetProcAddress.KERNEL32(75FD0000,02606830), ref: 0041954B
GetProcAddress.KERNEL32(75A50000,02606848), ref: 0041956D
GetProcAddress.KERNEL32(74E50000,025E5928), ref: 0041958E
GetProcAddress.KERNEL32(76E80000,025E6500), ref: 004195AF
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 004195C6

Strings

NtQueryInformationProcess, xrefs: 004195BA

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction ID: 826a308167d33dd6e89c68d84aa8ae535e40b86c028b310e96c4c1ecb1cfdbe7
Opcode Fuzzy Hash: 3c4f576e88d1023c8c64455e8d299a229b8a4e9f9ed258e654ba581a00c5eb17
Instruction Fuzzy Hash: D3A171B5500A00EFC764DF68ED88E1E3BBBBB4C361B50A51AEA05C3674D7349843DBA5

Function 00405150 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

lstrlenA.KERNEL32(00000000), ref: 004051E3

Part of subcall function 00418940: CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000), ref: 00418960

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405257
StrCmpCA.SHLWAPI(?,0260ABD8), ref: 00405275
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405390
HttpOpenRequestA.WININET(00000000,0260ABE8,?,0260A348,00000000,00000000,00400100,00000000), ref: 004053F4

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,0260AC28,00000000,?,025E8E68,00000000,?,00421980,00000000,?,00414CAF), ref: 00405787
lstrlenA.KERNEL32(00000000), ref: 0040579B
GetProcessHeap.KERNEL32(00000000,?), ref: 004057AC
HeapAlloc.KERNEL32(00000000), ref: 004057B3
lstrlenA.KERNEL32(00000000), ref: 004057C8
memcpy.MSVCRT ref: 004057DF
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057F9
memcpy.MSVCRT ref: 00405806
lstrlenA.KERNEL32(00000000), ref: 00405818
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405831
memcpy.MSVCRT ref: 00405841
lstrlenA.KERNEL32(00000000,?,?), ref: 0040585E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405872
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040589D
InternetCloseHandle.WININET(00000000), ref: 00405901
InternetCloseHandle.WININET(00000000), ref: 0040590E
InternetCloseHandle.WININET(00000000), ref: 00405918

Strings

", xrefs: 004054D2
", xrefs: 00405614
------, xrefs: 00405549
------, xrefs: 004052E7
------, xrefs: 0040568B
------, xrefs: 00405407
", xrefs: 00405756
--, xrefs: 004052D0

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandlememcpy$HeapHttpOpenRequestlstrcat$??2@AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 811081172-2774362122
Opcode ID: 0d369a11fc9b38d55fd53a3e980d49d376e96a41a52c2b8b6124bad2d8ceecea
Instruction ID: 1d52745d65e853cf4120aa405e943018ad764f54ae2154c0ea3196726ecd4ecf
Opcode Fuzzy Hash: 0d369a11fc9b38d55fd53a3e980d49d376e96a41a52c2b8b6124bad2d8ceecea
Instruction Fuzzy Hash: 8E325071921118ABCB14EBA1DC55FEEB338BF54314F40419EF50662192EF782B98CF6A

Function 004059B0 Relevance: 46.0, APIs: 19, Strings: 7, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405A48
StrCmpCA.SHLWAPI(?,0260ABD8), ref: 00405A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405BE3
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0260ACE8,00000000,?,025E8E68,00000000,?,004219C0), ref: 00405EC1
lstrlenA.KERNEL32(00000000), ref: 00405ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00405EE3
HeapAlloc.KERNEL32(00000000), ref: 00405EEA
lstrlenA.KERNEL32(00000000), ref: 00405EFF
memcpy.MSVCRT ref: 00405F16
lstrlenA.KERNEL32(00000000), ref: 00405F28
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405F41
memcpy.MSVCRT ref: 00405F4E
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F9C
InternetCloseHandle.WININET(00000000), ref: 00406000
InternetCloseHandle.WININET(00000000), ref: 0040600D
HttpOpenRequestA.WININET(00000000,0260ABE8,?,0260A348,00000000,00000000,00400100,00000000), ref: 00405C48

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00406017

Strings

------, xrefs: 00405C5B
", xrefs: 00405E66
XA, xrefs: 00405A0F, 004060B7, 00405A97, 00405AA0, 00405B0E, 00405B85, 00405C83, 00405DC4, 00405B11, 00405B88, 00405C86, 00405DC7
------, xrefs: 00405D9C
XA, xrefs: 004060CA
", xrefs: 00405D25
------, xrefs: 00405AE6

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$??2@AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$XA$XA
API String ID: 1710586764-2501203334
Opcode ID: eb9ee7726ba9a78ad6c703366f93d7dca1b92c3ea7fb48d8e811fe363b87fc34
Instruction ID: fd4032899b6f210ca5ed4ade58f42d7f74ab7cfcec1a01a64090ede90c3e384c
Opcode Fuzzy Hash: eb9ee7726ba9a78ad6c703366f93d7dca1b92c3ea7fb48d8e811fe363b87fc34
Instruction Fuzzy Hash: 4C123F71921118ABCB14EBA1DC95FEEB338BF14314F40419EF50662191EF782B99CF69

Function 0040A6C0 Relevance: 32.0, APIs: 21, Instructions: 494
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040A9F2
RtlAllocateHeap.NTDLL(00000000), ref: 0040A9F9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A7DA

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,025E6510,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrcat.KERNEL32(?,00000000), ref: 0040AB3A
lstrcat.KERNEL32(?,004212C4), ref: 0040AB49
lstrcat.KERNEL32(?,00000000), ref: 0040AB5C
lstrcat.KERNEL32(?,004212C8), ref: 0040AB6B
lstrcat.KERNEL32(?,00000000), ref: 0040AB7E
lstrcat.KERNEL32(?,004212CC), ref: 0040AB8D
lstrcat.KERNEL32(?,00000000), ref: 0040ABA0
lstrcat.KERNEL32(?,004212D0), ref: 0040ABAF
lstrcat.KERNEL32(?,00000000), ref: 0040ABC2
lstrcat.KERNEL32(?,004212D4), ref: 0040ABD1
lstrcat.KERNEL32(?,00000000), ref: 0040ABE4
lstrcat.KERNEL32(?,004212D8), ref: 0040ABF3

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrcat.KERNEL32(?,00000000), ref: 0040AC3C
lstrcat.KERNEL32(?,004212DC), ref: 0040AC56
lstrlenA.KERNEL32(?), ref: 0040AC95
lstrlenA.KERNEL32(?), ref: 0040ACA4
memset.MSVCRT ref: 0040ACF3

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

DeleteFileA.KERNEL32(00000000), ref: 0040AD1F

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessmemcmp
String ID:
API String ID: 2228671196-0
Opcode ID: 817110dbf6369b10d743006ff494239070760aaa47c84b2c744768fcda3b79f6
Instruction ID: db3bf564d8a269597709baab17c241dc92c2864a2a44399f5d1cb95b81495e87
Opcode Fuzzy Hash: 817110dbf6369b10d743006ff494239070760aaa47c84b2c744768fcda3b79f6
Instruction Fuzzy Hash: 13029371901108ABCB14EBA1DC96EEE7339BF54314F10416EF507B20A1DF786E99CB6A

Function 0040CD30 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,025E8E98,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CDC3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040CF07
RtlAllocateHeap.NTDLL(00000000), ref: 0040CF0E
lstrcat.KERNEL32(?,00000000), ref: 0040D048
lstrcat.KERNEL32(?,0042141C), ref: 0040D057
lstrcat.KERNEL32(?,00000000), ref: 0040D06A
lstrcat.KERNEL32(?,00421420), ref: 0040D079
lstrcat.KERNEL32(?,00000000), ref: 0040D08C
lstrcat.KERNEL32(?,00421424), ref: 0040D09B
lstrcat.KERNEL32(?,00000000), ref: 0040D0AE
lstrcat.KERNEL32(?,00421428), ref: 0040D0BD
lstrcat.KERNEL32(?,00000000), ref: 0040D0D0
lstrcat.KERNEL32(?,0042142C), ref: 0040D0DF
lstrcat.KERNEL32(?,00000000), ref: 0040D0F2
lstrcat.KERNEL32(?,00421430), ref: 0040D101
lstrcat.KERNEL32(?,00000000), ref: 0040D114
lstrcat.KERNEL32(?,00421434), ref: 0040D123

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,025E6510,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

lstrlenA.KERNEL32(?), ref: 0040D16A
lstrlenA.KERNEL32(?), ref: 0040D179
memset.MSVCRT ref: 0040D1C8

Part of subcall function 0041A440: StrCmpCA.SHLWAPI(00000000,00421414,0040CFE2,00421414,00000000), ref: 0041A45F

DeleteFileA.KERNEL32(00000000), ref: 0040D1F4

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: c8949976f589e4e98a292bf423720625dbd2cf614d98710a518b00b33f6a1f88
Instruction ID: ed6c437cbd46477d92e2fdf931dfcacd4144c719bc88927133304dc8b30d11c2
Opcode Fuzzy Hash: c8949976f589e4e98a292bf423720625dbd2cf614d98710a518b00b33f6a1f88
Instruction Fuzzy Hash: 25E1A271901108ABCB14EBA0DC9AEEE7339AF54314F50415EF507B30A1DF786E99CB6A

Function 00414850 Relevance: 30.1, APIs: 10, Strings: 10, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00414867

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414890
lstrcat.KERNEL32(?,\.azure\), ref: 004148AD

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

memset.MSVCRT ref: 004148F3
lstrcat.KERNEL32(?,00000000), ref: 0041491C
lstrcat.KERNEL32(?,\.aws\), ref: 00414939

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

memset.MSVCRT ref: 0041497F
lstrcat.KERNEL32(?,00000000), ref: 004149A8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 004149C5

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,025EBED8), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576
Part of subcall function 004143F0: CopyFileA.KERNEL32(?,?,00000001), ref: 0041458C
Part of subcall function 004143F0: DeleteFileA.KERNEL32(?), ref: 00414611

memset.MSVCRT ref: 00414A0B

Strings

Azure\.azure, xrefs: 004148B3
*.*, xrefs: 00414944
Z\A, xrefs: 004148D1, 0041495D, 004149E9, 00414A14, 004148D4, 00414960, 004149EC
msal.cache, xrefs: 004149D0
Azure\.IdentityService, xrefs: 004149CB
\.azure\, xrefs: 004148A1
*.*, xrefs: 004148B8
\.aws\, xrefs: 0041492D
\.IdentityService\, xrefs: 004149B9
Azure\.aws, xrefs: 0041493F

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$Z\A$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 4017274736-156850865
Opcode ID: f34b073d0bf326703eae5c88095b007a67f86f5416a0e6d2b15adf88e4e4de52
Instruction ID: 646ecaa1659512b06866923d8f1ff883aab6ee332b32f164b7e7d78f354b44b8
Opcode Fuzzy Hash: f34b073d0bf326703eae5c88095b007a67f86f5416a0e6d2b15adf88e4e4de52
Instruction Fuzzy Hash: C741FC75A4021867CB20F760EC4BFDD773C5B54704F404459B64AA60D2EEFC57C98BAA

Function 004048D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404965
StrCmpCA.SHLWAPI(?,0260ABD8), ref: 0040498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404B0A
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DC3,00000000,?,?,00000000,?,",00000000,?,0260ACF8), ref: 00404E38
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E99
InternetCloseHandle.WININET(00000000), ref: 00404EFD
InternetCloseHandle.WININET(00000000), ref: 00404F15
HttpOpenRequestA.WININET(00000000,0260ABE8,?,0260A348,00000000,00000000,00400100,00000000), ref: 00404B65

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

InternetCloseHandle.WININET(00000000), ref: 00404F1F

Strings

------, xrefs: 00404CB9
", xrefs: 00404D83
------, xrefs: 00404A0D
------, xrefs: 00404B78
", xrefs: 00404C42

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$??2@ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 594634378-2180234286
Opcode ID: 8ad05db282345aa7a287dd439d150f75172824685b1d48d249f31657a4bb7b2f
Instruction ID: 96828d9d4da3c69e3e13a7d192eb2c0d5cb14303612463eff3b0a86b38ab5adb
Opcode Fuzzy Hash: 8ad05db282345aa7a287dd439d150f75172824685b1d48d249f31657a4bb7b2f
Instruction Fuzzy Hash: 7B124E71912118AACB14EB91DC96FEEB339AF14314F50419EF50662091EF782F98CF6A

Function 00417DC0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

RegOpenKeyExA.KERNEL32(00000000,025EC448,00000000,00020019,00000000,004205A6), ref: 00417E44
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
RegCloseKey.ADVAPI32(00000000), ref: 00417F2C
RegCloseKey.ADVAPI32(00000000), ref: 00417F39

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

%s\%s, xrefs: 00417EED
?, xrefs: 00417E1A
- , xrefs: 00418043

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 229a34cb7c2866d69f95cdc4ddc0229c6f5f61782d3d7cea4faf0875c4498218
Instruction ID: 7e933c005afce5063b6ac28d37290dd0de40035e7daa9b78ce1efab2f7c43410
Opcode Fuzzy Hash: 229a34cb7c2866d69f95cdc4ddc0229c6f5f61782d3d7cea4faf0875c4498218
Instruction Fuzzy Hash: 3581197191111CABDB28DB54CC85FEAB7B9BF08314F0082D9E10AA6190DF756BC9CFA5

Function 004062D0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
StrCmpCA.SHLWAPI(?,0260ABD8), ref: 00406353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
HttpOpenRequestA.WININET(00000000,GET,?,0260A348,00000000,00000000,00400100,00000000), ref: 004063D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 0040644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004064BD
InternetCloseHandle.WININET(00000000), ref: 0040653F
InternetCloseHandle.WININET(00000000), ref: 00406549
InternetCloseHandle.WININET(00000000), ref: 00406553

Strings

GET, xrefs: 004063CC
ERROR, xrefs: 00406457
ERROR, xrefs: 00406519

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$??2@ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3871519372-2509457195
Opcode ID: 4793de62a783022f6add9531db72223dbc22faa443d9ea50feaba0d17c8c1570
Instruction ID: cbac5eee591d607aa173065357eefb87c001816e051c1cde1c99a9b9dc38779b
Opcode Fuzzy Hash: 4793de62a783022f6add9531db72223dbc22faa443d9ea50feaba0d17c8c1570
Instruction Fuzzy Hash: AA719F71A00218EBDB24DFA0DC49FEEB775AF44704F1080AAF50A6B1D0DBB86A85CF55

Function 00414FF0 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,025E6510,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415124
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415181
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415337

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00414CD0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00414DA0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00414DF8
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E0F
Part of subcall function 00414DA0: StrStrA.SHLWAPI(00000000,00000000), ref: 00414E44
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E63
Part of subcall function 00414DA0: strtok.MSVCRT ref: 00414E7E
Part of subcall function 00414DA0: lstrlenA.KERNEL32(00000000), ref: 00414E8E

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0041526B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415420
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004154EC
Sleep.KERNEL32(0000EA60), ref: 004154FB

Strings

ERROR, xrefs: 00415412
ERROR, xrefs: 00415329
ERROR, xrefs: 00415116
ERROR, xrefs: 00415173
ERROR, xrefs: 004154DE
ERROR, xrefs: 0041525D

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: afd7b18e7da7be5832bfcd89e85e0c627a10a1a91c8b1c6a2b00d68955edf770
Instruction ID: 47717806d02ab2b23084bb80b202f8eeb65c1f88a6bcad5d58c416e3f74fe27f
Opcode Fuzzy Hash: afd7b18e7da7be5832bfcd89e85e0c627a10a1a91c8b1c6a2b00d68955edf770
Instruction Fuzzy Hash: 1FE1A671901104AACB14FBB1EC57EED7339AF94314F40852EB40666192EF3C6B9DCB9A

Function 00412940 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

ShellExecuteEx.SHELL32(0000003C), ref: 00412CD5
ShellExecuteEx.SHELL32(0000003C), ref: 00412E6D
ShellExecuteEx.SHELL32(0000003C), ref: 00412FFA

Strings

C:\Windows\system32\rundll32.exe, xrefs: 00412E42
/passive, xrefs: 00412F6B
/i ", xrefs: 00412EF4
C:\Windows\system32\msiexec.exe, xrefs: 00412FCF
.msi, xrefs: 00412EA8
.dll, xrefs: 00412CF5
<, xrefs: 00412FA0
"" , xrefs: 00412BAA

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: b7c63ecea3e2443de4d2a98bb923b4dc32e07c7f52cf34bc1d50df9fbfcb7183
Instruction ID: f1658c825a9884a12c356146fd8d4c6d848a61a952cd10e5c69c9f5a52c1d3c9
Opcode Fuzzy Hash: b7c63ecea3e2443de4d2a98bb923b4dc32e07c7f52cf34bc1d50df9fbfcb7183
Instruction Fuzzy Hash: FA121F71811108AACB14FBA1DC96FDEB778AF14314F40415EF40666192EF782BD9CFAA

Function 00401310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
Part of subcall function 004012A0: RegCloseKey.ADVAPI32(?), ref: 004012FF

lstrcat.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcat.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,025E8E98,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401465

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

DeleteFileA.KERNEL32(00000000), ref: 004014EF
memset.MSVCRT ref: 00401516

Strings

wallet_path, xrefs: 00401330
SOFTWARE\monero-project\monero-core, xrefs: 00401335
.keys, xrefs: 0040136B
\Monero\wallet.keys, xrefs: 0040138D

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseHeapLocallstrlenmemset$ChangeCopyCreateDeleteFindFreeNotificationOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3420786452-218353709
Opcode ID: f36938298e6ac6d1107e037b94d9d151851b59f4a54a2b2fcecb02b3479b55f0
Instruction ID: b5eb1e2d9a8a1e3cf56e2c34e54d9e93e9a372b4459d7a8870c797c8d4c08f80
Opcode Fuzzy Hash: f36938298e6ac6d1107e037b94d9d151851b59f4a54a2b2fcecb02b3479b55f0
Instruction Fuzzy Hash: AB5184B1D501186BCB14EB61DC96FED733CAF50314F4041ADB60A62092EE785BD9CBAA

Function 004060F0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 0040483A
Part of subcall function 00404800: ??_U@YAPAXI@Z.MSVCRT ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

InternetOpenA.WININET(00420DE2,00000001,00000000,00000000,00000000), ref: 0040615F
StrCmpCA.SHLWAPI(?,0260ABD8), ref: 00406197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 004061DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406203
InternetReadFile.WININET(q&A,?,00000400,?), ref: 0040622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406299
InternetCloseHandle.WININET(q&A), ref: 004062A3
InternetCloseHandle.WININET(00000000), ref: 004062B0

Strings

q&A, xrefs: 00406100, 004061CF, 004062B6, 00406174, 00406103
q&A, xrefs: 0040629F, 00406228, 0040622B, 004062A2

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$??2@CrackCreateReadWritelstrcpylstrlen
String ID: q&A$q&A
API String ID: 449328342-3681770271
Opcode ID: b38a372bbf65ac042d1d72ff4a219f04d22188d0fd19f0ac0b6a98b30744770e
Instruction ID: 439f38139d03757dc0e639f6b6df0271613160f362a72270d2c4ade6ce016e72
Opcode Fuzzy Hash: b38a372bbf65ac042d1d72ff4a219f04d22188d0fd19f0ac0b6a98b30744770e
Instruction Fuzzy Hash: C15161B1A00218ABDB20EF50CD49FEE7779AF44305F1081ADB606B71C1DB786A95CF99

Function 00407610 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407310: memset.MSVCRT ref: 00407354
Part of subcall function 00407310: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
Part of subcall function 00407310: RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
Part of subcall function 00407310: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
Part of subcall function 00407310: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
Part of subcall function 00407310: HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

lstrcat.KERNEL32(35426020,004217A0), ref: 00407646
lstrcat.KERNEL32(35426020,00000000), ref: 00407688
lstrcat.KERNEL32(35426020, : ), ref: 0040769A
lstrcat.KERNEL32(35426020,00000000), ref: 004076CF
lstrcat.KERNEL32(35426020,004217A8), ref: 004076E0
lstrcat.KERNEL32(35426020,00000000), ref: 00407713
lstrcat.KERNEL32(35426020,004217AC), ref: 0040772D
task.LIBCPMTD ref: 0040773B

Strings

: , xrefs: 0040768E

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: f6f97187ff320098b1ee5d80db1305ab38950e625d8bdd35c4946a325c88a42b
Instruction ID: 05ed671df160738881f441edec20510396de118aefbcae7eba62044a73751e2f
Opcode Fuzzy Hash: f6f97187ff320098b1ee5d80db1305ab38950e625d8bdd35c4946a325c88a42b
Instruction Fuzzy Hash: FC318476D00509EBCB14EBA0DD45DEF7779AF94304F14402EF502772A0CA38A946CFA9

Function 00407310 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407354
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CD0), ref: 0040737A
RegEnumValueA.ADVAPI32(00407CD0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004073F1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040744D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407492
HeapFree.KERNEL32(00000000,?,?,?,?,00407CD0,80000001,00415CA4,?,?,?,?,?,00407CD0,?), ref: 00407499

Part of subcall function 00409290: vsprintf_s.MSVCRT ref: 004092AB

task.LIBCPMTD ref: 00407595

Strings

Password, xrefs: 00407441

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction ID: 975b1f2fff90f96d03099a1470760af69fc6b50b1064dc5ad3510b71ddc5061f
Opcode Fuzzy Hash: e183b5279ab9e6df2eb167b03a4cc02d75207c5ff0d2bc4bafbb891a8174e7a2
Instruction Fuzzy Hash: 52613DB5D041689BDB24DF50CC41BDAB7B8BF48304F0081EAE689A6181DFB46BC9CF95

Function 00416FA0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
HeapAlloc.KERNEL32(00000000), ref: 004170AA
wsprintfA.USER32 ref: 004170E0

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Strings

C, xrefs: 00416FEC
\, xrefs: 00417000
:, xrefs: 00416FFC

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: 11e96b5f598d36b5145eb5ca339976e7cb65ddbe81ead056b2f3bcd54bd5f766
Instruction ID: 54c0e4e4c236f1d7f0585d8ba6b1fa909b8b3bfc40374ef6a46e6daa0de72561
Opcode Fuzzy Hash: 11e96b5f598d36b5145eb5ca339976e7cb65ddbe81ead056b2f3bcd54bd5f766
Instruction Fuzzy Hash: 1341B1B1D04248EBDB20DFA4CC45BEEBBB8AF08714F14009DF50967281D7786A84CBA9

Function 00417BA0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,026090C8,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,026090C8,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
__aulldiv.LIBCMT ref: 00417C12
__aulldiv.LIBCMT ref: 00417C20
wsprintfA.USER32 ref: 00417C4C

Strings

@, xrefs: 00417BED
%d MB, xrefs: 00417C43

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction ID: f6ead53c39b4582a22ff827f4f83d0c2aee1884270de42e44796eba59a74ffdb
Opcode Fuzzy Hash: a22fd26a20c89c12fe6cfaaf614cf5a2958407047c3d7a896a6bd652d51aa950
Instruction Fuzzy Hash: AD218CF1E44218ABDB10DFD8CC49FAEB7B9FB08B14F104509F605BB280D77869018BA9

Function 00416B70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 00416B7E

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

OpenProcess.KERNEL32(001FFFFF,00000000,00416DAD,004205AD), ref: 00416BBC
memset.MSVCRT ref: 00416C0A
??_V@YAXPAX@Z.MSVCRT ref: 00416D5E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00416C2C

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: 8cb234f84e8b83e8fecd2546670217cd2adfa58d08d9f56a902dc95043d76619
Instruction ID: 7f38ab3eb3b1a919a3e5ec0c0fab515e305e32cb9f2de8b47bf31e49bfe0b2e9
Opcode Fuzzy Hash: 8cb234f84e8b83e8fecd2546670217cd2adfa58d08d9f56a902dc95043d76619
Instruction Fuzzy Hash: 285162B0D002189BDB24EB95DC45BEEB774AF44318F5041AEE50566281EB78AEC8CF5D

Function 0040B8E0 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040BADD

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BB0B
lstrlenA.KERNEL32(00000000), ref: 0040BBE3
lstrlenA.KERNEL32(00000000), ref: 0040BBF7

Strings

AccountTokens, xrefs: 0040B9A9
AccountTokens, xrefs: 0040B91A
AccountId, xrefs: 0040BB02
SELECT service, encrypted_token FROM token_service, xrefs: 0040BA4B

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 2910778473-1079375795
Opcode ID: 38172e53a39d95c7688669d4e42b63d85f4b19af0b9e37c1e672f12de7c9c328
Instruction ID: 210edd3ff24f1e31e7376af0b8f6dc5aafa9379f597eea4b8f30950ff7929db6
Opcode Fuzzy Hash: 38172e53a39d95c7688669d4e42b63d85f4b19af0b9e37c1e672f12de7c9c328
Instruction Fuzzy Hash: 32A16271911108ABCF14FBA1DC56EEE7339AF54318F40416EF40772191EF786A98CBAA

Function 00416490 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,025ECDB0), ref: 004192B1
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,025ECCF0), ref: 004192CA
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,026069B0), ref: 004192E2
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,026069C8), ref: 004192FA
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,02606AD0), ref: 00419313
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,025E64F0), ref: 0041932B
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,025E5A48), ref: 00419343
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,025E5B68), ref: 0041935C
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,02606860), ref: 00419374
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,02606908), ref: 0041938C
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,026069F8), ref: 004193A5
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,02606890), ref: 004193BD
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,025E5888), ref: 004193D5
Part of subcall function 00419270: GetProcAddress.KERNEL32(75900000,02606878), ref: 004193EE

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004164B7,00420ADA), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416210: GetUserDefaultLangID.KERNEL32(?,?,004164C6,00420ADA), ref: 00416214

GetUserDefaultLangID.KERNEL32 ref: 004164C6

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,025E6510,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,025E6510,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseDefaultEventHandleLangName__aulldiv$ComputerCreateCurrentGlobalInfoMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 1125299040-0
Opcode ID: b0b9960d20af4d68d915563efb49f39e3c975c1103b7c7d82c9cd59156a88510
Instruction ID: 0c3fac6cf7b50bea5c1f94bc3db5f65e3227356296d56eb517008ea5f4118e6e
Opcode Fuzzy Hash: b0b9960d20af4d68d915563efb49f39e3c975c1103b7c7d82c9cd59156a88510
Instruction Fuzzy Hash: 03317130941108BACB14FBF2DC56BEE7739AF18318F50452EF513A6092DFBC6985C66A

Function 00417E7C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
wsprintfA.USER32 ref: 00417EF9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
RegCloseKey.ADVAPI32(00000000), ref: 00417F2C
RegCloseKey.ADVAPI32(00000000), ref: 00417F39

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

RegQueryValueExA.KERNEL32(00000000,02608F18,00000000,000F003F,?,00000400), ref: 00417F8C
lstrlenA.KERNEL32(?), ref: 00417FA1
RegQueryValueExA.KERNEL32(00000000,02609038,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B24), ref: 00418039
RegCloseKey.KERNEL32(00000000), ref: 004180A8
RegCloseKey.ADVAPI32(00000000), ref: 004180BA

Strings

%s\%s, xrefs: 00417EED

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 59d830b7fe34aa01cb39e0cbca92bd7d37a3181ffda65cf720781bd3ca839efc
Instruction ID: 0d61fbe7999a289fff57b0559f919f0328d455d47faa6f76a7bc41a93025e826
Opcode Fuzzy Hash: 59d830b7fe34aa01cb39e0cbca92bd7d37a3181ffda65cf720781bd3ca839efc
Instruction Fuzzy Hash: 2B211971A0021CABDB24DF54DC85FD9B7B9FB48714F00C199A609A6280DF756AC6CF98

Function 00404800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 0040483A
??_U@YAPAXI@Z.MSVCRT ref: 00404851
??2@YAPAXI@Z.MSVCRT ref: 00404868
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Strings

<, xrefs: 00404819

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ??2@CrackInternetlstrlen
String ID: <
API String ID: 184842949-4251816714
Opcode ID: 6654e7a5d908528a77a448fb9e6f9b7e308e562f8bcdcf50e074e0bef5e7dcb8
Instruction ID: 93cf72731df314aae8b190796811ac6c8ed605cccc68025416595ba5c6ffb16c
Opcode Fuzzy Hash: 6654e7a5d908528a77a448fb9e6f9b7e308e562f8bcdcf50e074e0bef5e7dcb8
Instruction Fuzzy Hash: 0A2129B1D00208ABDF14DFA5E849ADD7B75FF44364F108229F926A72D0DB706A05CF95

Function 00417130 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
HeapAlloc.KERNEL32(00000000), ref: 0041714B
RegOpenKeyExA.KERNEL32(80000002,025E9AD8,00000000,00020119,00000000), ref: 0041717D
RegQueryValueExA.KERNEL32(00000000,02609008,00000000,00000000,?,000000FF), ref: 0041719E
RegCloseKey.ADVAPI32(00000000), ref: 004171A8

Strings

Windows 11, xrefs: 0041715D

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction ID: 198b37f2a351322ee600fb862932720b373255b2f394089b4190a5419862cb8c
Opcode Fuzzy Hash: 7e52da74aeff6e087cb32fc56a687b6502875dfd8540e0d42b3236aa97f07f61
Instruction Fuzzy Hash: 4C018F74A40208BFEB10DFE4DD49FAE7779EB08710F104098FA0997290D6749A428B64

Function 004171C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004171D4
HeapAlloc.KERNEL32(00000000), ref: 004171DB
RegOpenKeyExA.KERNEL32(80000002,025E9AD8,00000000,00020119,00417159), ref: 004171FB
RegQueryValueExA.KERNEL32(00417159,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041721A
RegCloseKey.ADVAPI32(00417159), ref: 00417224

Strings

CurrentBuildNumber, xrefs: 00417211

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction ID: 00cad297c96af00baba5933f046dbcc6cd847f8af16dedc1aa1025fe7f1f3d79
Opcode Fuzzy Hash: 6c07f27ec60b8ac9df4e5178828e9d35e6ab3eda5138c8e540781496da3810dc
Instruction Fuzzy Hash: EE014FB9A40708BFDB10DFE0DC4AFAEB779EB08704F104558FA05A7291D674AA418B55

Function 00413BC0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00413BE5
RegOpenKeyExA.KERNEL32(80000001,02609678,00000000,00020119,?), ref: 00413C04
RegQueryValueExA.ADVAPI32(?,0260A198,00000000,00000000,00000000,000000FF), ref: 00413C28
RegCloseKey.ADVAPI32(?), ref: 00413C32
lstrcat.KERNEL32(?,00000000), ref: 00413C57
lstrcat.KERNEL32(?,0260A318), ref: 00413C6B

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: d4db36429f90b718e22daca015467a858ebeea603ee9fe30967bea3d45dd3f7a
Instruction ID: 29de2a712fc1e2dfcbf32ad4341a25eb625067ccdef54b7492a2b75d077fe01c
Opcode Fuzzy Hash: d4db36429f90b718e22daca015467a858ebeea603ee9fe30967bea3d45dd3f7a
Instruction Fuzzy Hash: 1841B8B69001086BDB24EBA0DC46FEE733DAB88304F00895DB619561D1FEB957CC8BD5

Function 00413070 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00413098

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

strtok_s.MSVCRT ref: 004131E1

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,025E6510,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 74c2f0421cc1b6554e966d90acdc48de0050edb133c9c5499aa201bdf71f5c31
Instruction ID: 79a306a9ddce9c6cdb539d8aaa48a82ffdeeeca754e5da37ea89086183b8fd1c
Opcode Fuzzy Hash: 74c2f0421cc1b6554e966d90acdc48de0050edb133c9c5499aa201bdf71f5c31
Instruction Fuzzy Hash: 87416371E01108ABCB04EFE5DC89AEEB774BF44314F00801EE51677251DB78AA95CF9A

Function 00409A10 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
LocalFree.KERNEL32(00410127), ref: 00409AE0
FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID:
API String ID: 1815715184-0
Opcode ID: 24062bcf7953aa6561ef9c9ca184d407a98801e1446d194c55f86fab29cae21b
Instruction ID: 9a616c59c25f48dda5b41b64f2eda75996ce8e2783f016847e561ac14b63f668
Opcode Fuzzy Hash: 24062bcf7953aa6561ef9c9ca184d407a98801e1446d194c55f86fab29cae21b
Instruction Fuzzy Hash: 5D310AB4A00209EFDB24CF95C895BAE7BB5BF48314F108169E911A73D0D778AD41CFA5

Function 00414260 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,026090F8), ref: 004142BB

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 004142E1
lstrcat.KERNEL32(?,?), ref: 00414300
lstrcat.KERNEL32(?,?), ref: 00414314
lstrcat.KERNEL32(?,025E9140), ref: 00414327
lstrcat.KERNEL32(?,?), ref: 0041433B
lstrcat.KERNEL32(?,02609838), ref: 0041434F

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00418830: GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Part of subcall function 00414050: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00414060
Part of subcall function 00414050: HeapAlloc.KERNEL32(00000000), ref: 00414067
Part of subcall function 00414050: wsprintfA.USER32 ref: 00414086
Part of subcall function 00414050: FindFirstFileA.KERNEL32(?,?), ref: 0041409D

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 167551676-0
Opcode ID: 738d5c332b5bb9dd34b9086ecc3846439f983ca80c620d24e331862ba9bdc026
Instruction ID: 4fb66fc9f0e99d4a69d4435a00fe4e0f35192ff1271240cc59f29c1c24f4a50f
Opcode Fuzzy Hash: 738d5c332b5bb9dd34b9086ecc3846439f983ca80c620d24e331862ba9bdc026
Instruction Fuzzy Hash: 663188B290021CA7CB24FBA0DC85EDD773DAB58708F40459EB60596091EE7897C9CFA8

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction ID: 3a295e2926d3a661784167dae5cc93d3585e5da9a2cb48fc087cd8b2851d2611
Opcode Fuzzy Hash: ea570c17900da72c0ff61e466dfdba6c639ea0a5e55046902d87947f1e012f1f
Instruction Fuzzy Hash: 8601FBB0D40308BAEB10EBE4DD49B9EBB78AB14705F20809EEA05B62D0D7785585875D

Function 00409D30 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D89

Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B3F
Part of subcall function 00409B10: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 00409B51
Part of subcall function 00409B10: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 00409B7A
Part of subcall function 00409B10: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 00409B8F

memcmp.MSVCRT ref: 00409DE2

Part of subcall function 00409BB0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BD4
Part of subcall function 00409BB0: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409BF3
Part of subcall function 00409BB0: memcpy.MSVCRT ref: 00409C16
Part of subcall function 00409BB0: LocalFree.KERNEL32(?), ref: 00409C23

Strings

DPAPI, xrefs: 00409DD9
"encrypted_key":", xrefs: 00409D80
, xrefs: 00409E11

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 596995583-738592651
Opcode ID: fa9bdf9742bd87f3e8e335158cdf23c75818d23cdb30ad435ed4cb8e7a37a11d
Instruction ID: 7f392d33d6ad21de2d61bb21213a98381b23072c845d074b64d64ac31095145a
Opcode Fuzzy Hash: fa9bdf9742bd87f3e8e335158cdf23c75818d23cdb30ad435ed4cb8e7a37a11d
Instruction Fuzzy Hash: 7A3150B5D00108ABCB04DBE4DC45AEF77B8AF48304F44856AE915B3282E7789E44CBA5

Function 6C5BC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C5BC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C5BC969
GetSystemInfo.KERNEL32(?), ref: 6C5BC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C5BC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C5BC9E2

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: c25a419378f0307c4cc3593511087e2d48e8c7a017ecbf304a149edabb2da990
Instruction ID: ee57ad9629ccca4bbce986a2f7b66707ca0dbbf25c9cb405b823373fd64a2c64
Opcode Fuzzy Hash: c25a419378f0307c4cc3593511087e2d48e8c7a017ecbf304a149edabb2da990
Instruction Fuzzy Hash: 1721D731741218ABEB14AA29CCD4BAE77B9EB86744F50051EF943B7A40EB707C04879D

Function 004178A0 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
HeapAlloc.KERNEL32(00000000), ref: 004178DE
RegOpenKeyExA.KERNEL32(80000002,025E9B10,00000000,00020119,?), ref: 004178FE
RegQueryValueExA.KERNEL32(?,02609898,00000000,00000000,000000FF,000000FF), ref: 0041791F
RegCloseKey.ADVAPI32(?), ref: 00417932

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction ID: 7b98265181db112957e654b40feb51e707849e62a0e01f8308d40af4a82c50e7
Opcode Fuzzy Hash: d4f8544a164a9437c7f2146de9882181f67f3b24d4450b32dfc713e681060546
Instruction Fuzzy Hash: EB11C1B1A04605AFDB10CF84DD4AFBFBB79FB48B10F10411AF605A7280D7785805CBA5

Function 004012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
RegCloseKey.ADVAPI32(?), ref: 004012FF

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction ID: 190bc7a1a7c8d7045dc387aced5cbf31aaec2b72b8248f43f4a0638ea244b090
Opcode Fuzzy Hash: b8563e144584e458f87bf561f54c88dffa2f1145a5d88f54fd71737305c450da
Instruction Fuzzy Hash: 34013179A40208BFDB10DFE0DC49FAEB779FF48710F108158FA05A7290D6709A05CB50

Function 00410580 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,025EBF78), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,025EBF28), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,025EBFD8), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410880, 00410894, 00410643, 0041075B, 00410646, 0041075E, 00410883

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: e5e6d05936cbfe87ef19f3cb694ab05cc694b4ee81eedbad7fef124ad5156c7d
Instruction ID: dd73e37cf26ee0a5b727ab7f8fa236140303cf2c4538d3aa2ff7e25b79bad790
Opcode Fuzzy Hash: e5e6d05936cbfe87ef19f3cb694ab05cc694b4ee81eedbad7fef124ad5156c7d
Instruction Fuzzy Hash: E6917775B002089FCB28EF65D995FED7775BF94304F00812EE8099F291DB349A59CB86

Function 004105A5 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,025EBF78), ref: 004105DA
StrCmpCA.SHLWAPI(00000000,025EBF28), ref: 004106A6
StrCmpCA.SHLWAPI(00000000,025EBFD8), ref: 004107DD

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Strings

@ZA, xrefs: 00410643, 0041075B, 00410646, 0041075E

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy
String ID: @ZA
API String ID: 3722407311-3461648394
Opcode ID: c2987a7c8463179a39b9aa31202bb4872507f5a00c321b44e8cf82fdd20e60fb
Instruction ID: 4e5c4e7109811dd04489307e57989d734427ebddea2fc0f69e8a4a25ed86313c
Opcode Fuzzy Hash: c2987a7c8463179a39b9aa31202bb4872507f5a00c321b44e8cf82fdd20e60fb
Instruction Fuzzy Hash: 82819775B002089FCB28EF65D995EEDB7B5FF94304F10812DE8099F251DB34AA45CB86

Function 00409FF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(025EBD78,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A00D
LoadLibraryA.KERNEL32(026096B8,?,?,?,?,?,?,?,?,?,?,?,0040FF93), ref: 0040A096

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,025E6510,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

SetEnvironmentVariableA.KERNEL32(025EBD78,00000000,00000000,?,00421290,?,0040FF93,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00420AE6), ref: 0040A082

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A002, 0040A016, 0040A02C

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-4027016359
Opcode ID: c92f3ef0754e8e06c571adbb1cf53134e9cee1a260c4ad050b19090381f6b1c0
Instruction ID: 756634b6078292b8205bba75648758324288abb3cd7bb3e0efd9893355994f5a
Opcode Fuzzy Hash: c92f3ef0754e8e06c571adbb1cf53134e9cee1a260c4ad050b19090381f6b1c0
Instruction Fuzzy Hash: 8D41E471804604AFC724EFB4EC56BAE3776BF48324F15512EF405A32A0D7B85986CB97

Function 0040A1B0 Relevance: 6.4, APIs: 4, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,025E8E98,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A231
lstrlenA.KERNEL32(00000000), ref: 0040A5EA

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000,00000000), ref: 0040A32D
DeleteFileA.KERNEL32(00000000), ref: 0040A671

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTimememcmpmemset
String ID:
API String ID: 3258613111-0
Opcode ID: 54ccf06c2f84e2484ed4416688423d44f762688d14018cb429c06268bb8d3c87
Instruction ID: babd7ff3150fa9bd4e199d5026f054df416ea87c2dc191fa558e2381e0c2d671
Opcode Fuzzy Hash: 54ccf06c2f84e2484ed4416688423d44f762688d14018cb429c06268bb8d3c87
Instruction Fuzzy Hash: 17D12472811108AACB14FBA5DC96EEE7338AF14314F50815EF51772091EF786A9CCB7A

Function 0040D5C0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00418600: GetSystemTime.KERNEL32(?,025E8E98,0042059E,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418626

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D641
lstrlenA.KERNEL32(00000000), ref: 0040D7DF
lstrlenA.KERNEL32(00000000), ref: 0040D7F3
DeleteFileA.KERNEL32(00000000), ref: 0040D872

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: e1e31f3c7bf6a40d42de38d9514d518e336aa20a0ca70a830722187b105dc452
Instruction ID: b9a8a4b288ee9f939e53bd87e1647cffb120ee14b7120403b064e1d16f2d4ef2
Opcode Fuzzy Hash: e1e31f3c7bf6a40d42de38d9514d518e336aa20a0ca70a830722187b105dc452
Instruction Fuzzy Hash: DC814472911108ABCB14FBB1DC96EEE7339AF54318F40452EF40772091EF786A58CB6A

Function 0040F2E0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 00409A10: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00409A3C
Part of subcall function 00409A10: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00409A61
Part of subcall function 00409A10: LocalAlloc.KERNEL32(00000040,?), ref: 00409A81
Part of subcall function 00409A10: ReadFile.KERNEL32(000000FF,?,00000000,00410127,00000000), ref: 00409AAA
Part of subcall function 00409A10: LocalFree.KERNEL32(00410127), ref: 00409AE0
Part of subcall function 00409A10: FindCloseChangeNotification.KERNEL32(000000FF), ref: 00409AEA

Part of subcall function 004188D0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421524,00420D7A), ref: 0040F38C
lstrlenA.KERNEL32(00000000), ref: 0040F3AB

Strings

^userContextId=4294967295, xrefs: 0040F3DC
moz-extension+++, xrefs: 0040F3ED

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$ChangeCloseCreateFindFreeNotificationReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 2768692033-3310892237
Opcode ID: 6c7441594b583aae64c9c6b87d702af936af8a6ea6ed9fc01f81efef045a3d77
Instruction ID: 29c62e45bd112fa8e6d3d1c16e218030d21c495d55cc38802304d1b40baba72e
Opcode Fuzzy Hash: 6c7441594b583aae64c9c6b87d702af936af8a6ea6ed9fc01f81efef045a3d77
Instruction Fuzzy Hash: D2513175D01108AACB04FBB1DC56DEE7338AF94314F40812EF81767191EE7C6A58CB6A

Function 00418120 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041816A
Process32First.KERNEL32(?,00000128), ref: 0041817E
Process32Next.KERNEL32(?,00000128), ref: 00418193

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

FindCloseChangeNotification.KERNEL32(?), ref: 00418201

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 3491751439-0
Opcode ID: 422835a0e47b9432128fcaa1d324b79c1426fd4dbdf7d334460413ace93119df
Instruction ID: 6084a3a81ad9197a86b05fcc5bdad381a42aa545a74b9a2169b69cd5b8afd334
Opcode Fuzzy Hash: 422835a0e47b9432128fcaa1d324b79c1426fd4dbdf7d334460413ace93119df
Instruction Fuzzy Hash: 8E319E71902218ABCB24EF95DC45FEEB778EF04710F10419EE50AA21A0DF386E85CFA5

Function 00416593 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,025E6510,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 0041656A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416588
CloseHandle.KERNEL32(00000000), ref: 00416599
Sleep.KERNEL32(00001770), ref: 004165A4
CloseHandle.KERNEL32(?,00000000,?,025E6510,?,004210DC,?,00000000,?,004210E0,?,00000000,00420ADA), ref: 004165BA
ExitProcess.KERNEL32 ref: 004165C2

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: e67069b7a25109c1f103972856e5ff06790c1bc0ba95d107da3788f3134d6b09
Instruction ID: a64f93d993f1e87f951aacd978fe42101be04856bc676c4d6d5bcee74d417e49
Opcode Fuzzy Hash: e67069b7a25109c1f103972856e5ff06790c1bc0ba95d107da3788f3134d6b09
Instruction Fuzzy Hash: F0F08230900605FFEB20ABA0EC09BFE7736AF04715F11441BB916A51D5CBF89582CA6E

Function 00414CD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DE6,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,0260ABD8), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,0260A348,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00414D08

Strings

ERROR, xrefs: 00414D53
ERROR, xrefs: 00414CFA

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 6c70da6f997ea1a07a0ff223df1852c905d3c1e48a96d4920ed4292aefcaea07
Instruction ID: 9b7a9698bb488a37f3de611b15de8acf20b28e6af01427a962a44d236a29daab
Opcode Fuzzy Hash: 6c70da6f997ea1a07a0ff223df1852c905d3c1e48a96d4920ed4292aefcaea07
Instruction Fuzzy Hash: 7F113330901108B7CB14FF61DC56AED7338AF50354F90816EF80B5A5A2EF786B95C75A

Function 00414A20 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414A5A
lstrcat.KERNEL32(?,00421040), ref: 00414A77
lstrcat.KERNEL32(?,025EBEC8), ref: 00414A8B
lstrcat.KERNEL32(?,00421044), ref: 00414A9D

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 209cc3fcd535cf035b472f204658cf99d7fece6c6bbc77ec1900bdc619610b5d
Instruction ID: 8dbf70b05384144c92fb0b395b2fe843caac1dc39a8cdd365ca80c12b48963c0
Opcode Fuzzy Hash: 209cc3fcd535cf035b472f204658cf99d7fece6c6bbc77ec1900bdc619610b5d
Instruction Fuzzy Hash: B6214F76A002086BC724FBA0EC42EDD373DAF94304F40845EB94A571D1EE7856C98BA5

Function 00414690 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 004146CA
lstrcat.KERNEL32(?,02609858), ref: 004146E8

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FAC), ref: 00414451
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414467
Part of subcall function 004143F0: FindNextFileA.KERNEL32(000000FF,?), ref: 0041465D
Part of subcall function 004143F0: FindClose.KERNEL32(000000FF), ref: 00414672

Part of subcall function 004143F0: wsprintfA.USER32 ref: 00414490
Part of subcall function 004143F0: StrCmpCA.SHLWAPI(?,004208BA), ref: 004144A5
Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144C2
Part of subcall function 004143F0: PathMatchSpecA.SHLWAPI(?,?), ref: 004144FE
Part of subcall function 004143F0: lstrcat.KERNEL32(?,025EBED8), ref: 0041452A
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FC8), ref: 0041453C
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414550
Part of subcall function 004143F0: lstrcat.KERNEL32(?,00420FCC), ref: 00414562
Part of subcall function 004143F0: lstrcat.KERNEL32(?,?), ref: 00414576
Part of subcall function 004143F0: CopyFileA.KERNEL32(?,?,00000001), ref: 0041458C
Part of subcall function 004143F0: DeleteFileA.KERNEL32(?), ref: 00414611

Part of subcall function 004143F0: wsprintfA.USER32 ref: 004144E7

Strings

5\A, xrefs: 0041470F, 00414744, 0041477A, 004147AF, 004147E5, 0041481A, 0041483F, 00414712, 00414747, 0041477D, 004147B2, 004147E8, 0041481D

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: 5\A
API String ID: 2104210347-3392445751
Opcode ID: 780a4e91eb43c6b829e4cdc1526a44519fec9ac62d95e5b0dbb15233ee45dd38
Instruction ID: 53e7b7cde32fa2def73dba0ef3da04c4d4f6f11e0d96676858e1097c5765331f
Opcode Fuzzy Hash: 780a4e91eb43c6b829e4cdc1526a44519fec9ac62d95e5b0dbb15233ee45dd38
Instruction Fuzzy Hash: 1441EBB660010467CB64FB64EC83EEE333DAB84304F40855EB94997191ED795ACD8BE6

Function 00417380 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction ID: 42712b1d228129e2e67f3f866f9c43061177fb5da2658b34d54d74d13c44c576
Opcode Fuzzy Hash: 9cad883e92767d667f7a3bd3c491df47bdb8f8355287bf46401cfbf98ae607a3
Instruction Fuzzy Hash: BC0181B1A08608EBC710CF99DD45BEEBBB8FB04721F20021AF905E3690D7785945CBA5

Function 6C5A3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C5A3095

Part of subcall function 6C5A35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C62F688,00001000), ref: 6C5A35D5
Part of subcall function 6C5A35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C5A35E0
Part of subcall function 6C5A35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C5A35FD
Part of subcall function 6C5A35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C5A363F
Part of subcall function 6C5A35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C5A369F
Part of subcall function 6C5A35A0: __aulldiv.LIBCMT ref: 6C5A36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5A309F

Part of subcall function 6C5C5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B85
Part of subcall function 6C5C5B50: EnterCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B90
Part of subcall function 6C5C5B50: LeaveCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5BD8
Part of subcall function 6C5C5B50: GetTickCount64.KERNEL32 ref: 6C5C5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C5A30BE

Part of subcall function 6C5A30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C5A3127
Part of subcall function 6C5A30F0: __aulldiv.LIBCMT ref: 6C5A3140

Part of subcall function 6C5DAB2A: __onexit.LIBCMT ref: 6C5DAB30

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 7652b2b07070b95f457e38f3c29b51b2d7fdcefa6832b054756fe781511fc3f7
Instruction ID: 28c5886c79c98ed68545528f8921f23ad7d5b28c6b54648bcd6eb66a00b02b5d
Opcode Fuzzy Hash: 7652b2b07070b95f457e38f3c29b51b2d7fdcefa6832b054756fe781511fc3f7
Instruction Fuzzy Hash: 2DF0F932E20754D6CB10DF7A8CC1AEAB370EFAB118F511719E84563511FB2465D8838B

Function 00418F10 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
CloseHandle.KERNEL32(00000000), ref: 00418F4F

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 904f881645263b8d6980a0d5e63786ab633fa25ddeb60b9bffeff93c14b2dbd8
Instruction ID: 429e76ffcb292cc7325fe34a8c967f3e8a19cc1fb06d1469951f90a9fbb0bdee
Opcode Fuzzy Hash: 904f881645263b8d6980a0d5e63786ab633fa25ddeb60b9bffeff93c14b2dbd8
Instruction Fuzzy Hash: 29F05E74A0020CFBDB14DFA4DD4AFEE7779AB08700F004498BB0997290D6B0AE85CB94

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004164BC), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,004164BC), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction ID: 0e2e6d3d2f445679f77a7861b9af8e0e8f55b174cdb9f0aa425208459b8dc1b3
Opcode Fuzzy Hash: 678cf5f3e7197d72abcfc3c147a4750855ebb5e345b53b76b616ef84aefebb1b
Instruction Fuzzy Hash: 3DE08670945308FBE7205FA09C0AB4D76689B04B05F105056F708BA1E0C6B82501865C

Function 00411520 Relevance: 3.9, APIs: 2, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00416FA0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00416FE2
Part of subcall function 00416FA0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041701F
Part of subcall function 00416FA0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004170A3
Part of subcall function 00416FA0: HeapAlloc.KERNEL32(00000000), ref: 004170AA

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 00417130: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417144
Part of subcall function 00417130: HeapAlloc.KERNEL32(00000000), ref: 0041714B

Part of subcall function 00417260: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,02609758,00000000,?), ref: 00417292
Part of subcall function 00417260: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041D5B0,000000FF,?,004117A9,00000000,?,02609758,00000000,?), ref: 00417299

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 00417420: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DD0,00000000,?), ref: 00417450
Part of subcall function 00417420: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DD0,00000000,?), ref: 00417457
Part of subcall function 00417420: GetLocalTime.KERNEL32(?,?,?,?,?,00420DD0,00000000,?), ref: 00417464
Part of subcall function 00417420: wsprintfA.USER32 ref: 00417493

Part of subcall function 004174D0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,02608F48,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 00417503
Part of subcall function 004174D0: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,02608F48,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041750A
Part of subcall function 004174D0: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,02608F48,00000000,?,00420DE0,00000000,?,00000000,00000000,?), ref: 0041751D

Part of subcall function 004175A0: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,02608F48,00000000,?,00420DE0,00000000,?,00000000,00000000), ref: 004175D5

Part of subcall function 00417630: GetKeyboardLayoutList.USER32(00000000,00000000,0042059F), ref: 00417681
Part of subcall function 00417630: LocalAlloc.KERNEL32(00000040,?), ref: 00417699
Part of subcall function 00417630: GetKeyboardLayoutList.USER32(?,00000000), ref: 004176AD
Part of subcall function 00417630: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417702
Part of subcall function 00417630: LocalFree.KERNEL32(00000000), ref: 004177C2

Part of subcall function 00417820: GetSystemPowerStatus.KERNEL32(?), ref: 0041784D

GetCurrentProcessId.KERNEL32(00000000,?,026098D8,00000000,?,00420DF4,00000000,?,00000000,00000000,?,02608F78,00000000,?,00420DF0,00000000), ref: 00411B8E

Part of subcall function 00418F10: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00418F24
Part of subcall function 00418F10: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00418F45
Part of subcall function 00418F10: CloseHandle.KERNEL32(00000000), ref: 00418F4F

Part of subcall function 004178A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178D7
Part of subcall function 004178A0: HeapAlloc.KERNEL32(00000000), ref: 004178DE
Part of subcall function 004178A0: RegOpenKeyExA.KERNEL32(80000002,025E9B10,00000000,00020119,?), ref: 004178FE
Part of subcall function 004178A0: RegQueryValueExA.KERNEL32(?,02609898,00000000,00000000,000000FF,000000FF), ref: 0041791F
Part of subcall function 004178A0: RegCloseKey.ADVAPI32(?), ref: 00417932

Part of subcall function 00417A00: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00417A69
Part of subcall function 00417A00: GetLastError.KERNEL32 ref: 00417A78

Part of subcall function 00417970: GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
Part of subcall function 00417970: wsprintfA.USER32 ref: 004179B6

Part of subcall function 00417BA0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,026090C8,00000000,?,00420DFC,00000000,?,00000000), ref: 00417BD0
Part of subcall function 00417BA0: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,026090C8,00000000,?,00420DFC,00000000,?,00000000,00000000), ref: 00417BD7
Part of subcall function 00417BA0: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00417BF8
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C12
Part of subcall function 00417BA0: __aulldiv.LIBCMT ref: 00417C20
Part of subcall function 00417BA0: wsprintfA.USER32 ref: 00417C4C

Part of subcall function 00418260: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DF8,00000000,?), ref: 004182CF
Part of subcall function 00418260: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DF8,00000000,?), ref: 004182D6
Part of subcall function 00418260: wsprintfA.USER32 ref: 004182F0

Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,025EC448,00000000,00020019,00000000,004205A6), ref: 00417E44

Part of subcall function 00417DC0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00417EC6
Part of subcall function 00417DC0: wsprintfA.USER32 ref: 00417EF9
Part of subcall function 00417DC0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00417F1B
Part of subcall function 00417DC0: RegCloseKey.ADVAPI32(00000000), ref: 00417F2C
Part of subcall function 00417DC0: RegCloseKey.ADVAPI32(00000000), ref: 00417F39

Part of subcall function 00418120: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0041816A
Part of subcall function 00418120: Process32First.KERNEL32(?,00000128), ref: 0041817E
Part of subcall function 00418120: Process32Next.KERNEL32(?,00000128), ref: 00418193
Part of subcall function 00418120: FindCloseChangeNotification.KERNEL32(?), ref: 00418201

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041216B

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$Process$Alloc$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ChangeComputerCreateDefaultDirectoryEnumErrorFileFindFirstFreeGlobalHandleLastLogicalMemoryModuleNextNotificationPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID:
API String ID: 869194160-0
Opcode ID: 8da63ec0273cbfdc4571dd0fa90f7488fd45b667a45c1e88d357ca05aac93766
Instruction ID: a9f6d0abc10a802bc737c54d14ff6b9d5e6ee0272f4c656d6212d3eaa4757419
Opcode Fuzzy Hash: 8da63ec0273cbfdc4571dd0fa90f7488fd45b667a45c1e88d357ca05aac93766
Instruction Fuzzy Hash: 8472A071851018AACB19FB91DC96EDEB33CAF24314F5042DFB51762051EF782B98CB6A

Function 00406C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(E9FC458B,087400FC,00000040,00000040), ref: 00406CEF

Strings

@, xrefs: 00406CC9

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction ID: a97aeec014860b7bcefe5a819602e0a11eb2ce5ea612e9d10357849f9a661301
Opcode Fuzzy Hash: 867edc3f7feb9bd756791c0b70ce9cc7864d6ccfd6d1b0176bf07496b986d28b
Instruction Fuzzy Hash: 3E213174A04208EFEB04CF89D544BAEBBB1FF48304F1181AAD456AB381D3799A91DF85

Function 00406D90 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction ID: 456806d1e879ecad470b616e27b80e03465aa0a519357bc85acbc9acecad2077
Opcode Fuzzy Hash: f8b28877c224b251f10175a9abca519b7fa48fc2f12a49a1c36a71eedd802e18
Instruction Fuzzy Hash: 116127B4900209DFCB14DF94E944BEEB7B0BB48304F1185AAE80677380D779AEA5DF95

Function 00414BE0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A1F0: lstrlenA.KERNEL32(00000000,?,?,00415634,00420AC3,00420AC2,?,?,004165B6,00000000,?,025E6510,?,004210DC,?,00000000), ref: 0041A1FB
Part of subcall function 0041A1F0: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A255

lstrlenA.KERNEL32(00000000,00000000,00420AB3,?,?,?,?,?,?,00415BEB,?), ref: 00414C0A

Strings

steam_tokens.txt, xrefs: 00414C1F

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: d19869e9ee21e98ce74e6ba28bdc72e146db7fe72b8a7f6212176cc5f604e5af
Instruction ID: 43ba9c4e7b772c09295c3d1ddd3f4580462a4fb142283e9dc1187fbec7936fd0
Opcode Fuzzy Hash: d19869e9ee21e98ce74e6ba28bdc72e146db7fe72b8a7f6212176cc5f604e5af
Instruction Fuzzy Hash: 48F01271D1110876CB04F7B2EC579ED733CAE54358F90426EF41662092EF78665886AB

Function 00417970 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420DFC), ref: 004179A0
wsprintfA.USER32 ref: 004179B6

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction ID: e5f7882cf5308591a3a92d8d4ad10ccbd8a019f3ce2acafa6204cd8ee8253483
Opcode Fuzzy Hash: b67a8d3803bdbcef095136fe51fb218f504635533fc880d72ddeb760f53951d8
Instruction Fuzzy Hash: 2DF0C2B1A00618EBCB10CF88ED45FAAB7BDFB08724F50066AF50492280D7785904CB94

Function 0040B370 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Part of subcall function 00409E60: memcmp.MSVCRT ref: 00409E7B
Part of subcall function 00409E60: memset.MSVCRT ref: 00409EAE
Part of subcall function 00409E60: LocalAlloc.KERNEL32(00000040,?), ref: 00409EFE

lstrlenA.KERNEL32(00000000), ref: 0040B820
lstrlenA.KERNEL32(00000000), ref: 0040B834

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmpmemset
String ID:
API String ID: 4023347672-0
Opcode ID: 57b946637f6b0d3fc9b9e605637c64e562fdcdea12cd199cb348b86b6e6bd926
Instruction ID: 12fecfe212cb7392b3f17e260ebd7fbbf5924c22592aec839546a7360daeb2af
Opcode Fuzzy Hash: 57b946637f6b0d3fc9b9e605637c64e562fdcdea12cd199cb348b86b6e6bd926
Instruction Fuzzy Hash: 5DE12272911118ABCB14EBA1CC96EEE7339BF14314F40415EF507721A1EF786B98CB6A

Function 0040AD70 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040AFEA
lstrlenA.KERNEL32(00000000), ref: 0040AFFE

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 7a32fd16661a00ecb6da22790568fba7b8ce1ec3cd347d4ff2ab8961cf702281
Instruction ID: 4b138641442dd51730d9762ac92e0d5652ebadbf156882a2c3fe3545aa946475
Opcode Fuzzy Hash: 7a32fd16661a00ecb6da22790568fba7b8ce1ec3cd347d4ff2ab8961cf702281
Instruction Fuzzy Hash: 98915572911108ABCF14FBA1DC96EEE7339AF54314F40416EF40772191EF786A98CB6A

Function 0040B0B0 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Part of subcall function 0041A380: lstrlenA.KERNEL32(?,004210E0,?,00000000,00420ADA), ref: 0041A395
Part of subcall function 0041A380: lstrcpy.KERNEL32(00000000), ref: 0041A3D4
Part of subcall function 0041A380: lstrcat.KERNEL32(00000000,00000000), ref: 0041A3E2

Part of subcall function 0041A2F0: lstrcpy.KERNEL32(00000000,?), ref: 0041A342
Part of subcall function 0041A2F0: lstrcat.KERNEL32(00000000), ref: 0041A352

Part of subcall function 0041A270: lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

lstrlenA.KERNEL32(00000000), ref: 0040B2AE
lstrlenA.KERNEL32(00000000), ref: 0040B2C2

Part of subcall function 0041A170: lstrcpy.KERNEL32(?,00000000), ref: 0041A1B6

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: f194bd07cfb6621efba2fe465599d8ee65c11842eef219b4756db892ab7a18e3
Instruction ID: d2f8e92f06f21ad00195b851541a0fca05b03a5e78dc2554d63ff73f5d8ac6c5
Opcode Fuzzy Hash: f194bd07cfb6621efba2fe465599d8ee65c11842eef219b4756db892ab7a18e3
Instruction Fuzzy Hash: A9717371911108ABCF14FBA1DC56EEE7339BF54314F40412EF403A2191EF786A58CBAA

Function 004066B0 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406E0E,00406E0E,00003000,00000040), ref: 00406756
VirtualAlloc.KERNEL32(00000000,00406E0E,00003000,00000040), ref: 004067A3

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction ID: 4499aa19cc86b02a1bac446f32e864e245a0bde13e44bf0a480e22725e368a89
Opcode Fuzzy Hash: badb7cecddd27d9e1aa55144c1fc7f4ba9690274eb5e83060997e099dbd08bd4
Instruction Fuzzy Hash: 2B41F334A00208EFCB44CF58C494BADBBB1FF44314F1486A9E94AAB385C735EA91CF84

Function 00414B30 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418880: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

lstrcat.KERNEL32(?,00000000), ref: 00414B6A
lstrcat.KERNEL32(?,026091A0), ref: 00414B88

Part of subcall function 004143F0: wsprintfA.USER32 ref: 0041440C
Part of subcall function 004143F0: FindFirstFileA.KERNEL32(?,?), ref: 00414423

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 0ea1cf1f72fc9817da23206f9e352bb5a837bc8796f2f49e4f6748ccf4e38754
Instruction ID: 3c3433cccd63aeccdbe2a936e698fd88f8205579aacfd307105c0296dbc1629e
Opcode Fuzzy Hash: 0ea1cf1f72fc9817da23206f9e352bb5a837bc8796f2f49e4f6748ccf4e38754
Instruction Fuzzy Hash: 8B01967690021C67CB24FB60DC46EDE733C9B64304F40415EBA4A57191FEB8AAC98BE5

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,004164BC), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,004164BC), ref: 004010F7

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction ID: f48f966fb8dbc32d8d9482a6eca9c47ea769ab036d71d5fa6551aa32425d7b68
Opcode Fuzzy Hash: f9d4902d87d53e064eb978b4b4efccb4618282ab89b9805507bbfbdb43c54504
Instruction Fuzzy Hash: 62F02771641218BBE7149BA4AD49FAFB7DCE705B08F304459F940E3390D5719F00DA64

Function 00418830 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0040FF57,?,00000000,?,00000000,00420D97,00420D96), ref: 0041883F

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 5dcc78a5cc27097ef1636bcd701a0ccd9cdf880fccf382115659857e781034d6
Instruction ID: 05b335d21f22619e77aa966aeb7f376ddd46b9d978e537c949d5f100d696e3dd
Opcode Fuzzy Hash: 5dcc78a5cc27097ef1636bcd701a0ccd9cdf880fccf382115659857e781034d6
Instruction Fuzzy Hash: 70F01570C0020CEFCB04EFA5C9496DDBB75EB00324F50859EE82AA7281DBB85B95CB85

Function 00418880 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 004188AB

Part of subcall function 0041A110: lstrcpy.KERNEL32(00420ADA,00000000), ref: 0041A158

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 51571f28d6a7ed4813964dc8c522bdbe61ee22cda778a467bc1242f5a69e0a37
Instruction ID: 7b71b80bc5ec6c4d76f30a423bf4d75a71df8f4b6dd8708b5fa25dfbbe6c75fa
Opcode Fuzzy Hash: 51571f28d6a7ed4813964dc8c522bdbe61ee22cda778a467bc1242f5a69e0a37
Instruction Fuzzy Hash: 7AE01A31A4034C7BDB55EBA0CC96FEE736CAB44B15F004299BA0C5B1C0EE74AB858B91

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00417380: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004164CB), ref: 004173B0
Part of subcall function 00417380: HeapAlloc.KERNEL32(00000000,?,?,?,004164CB), ref: 004173B7
Part of subcall function 00417380: GetComputerNameA.KERNEL32(?,00000104), ref: 004173CF

Part of subcall function 004172F0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417320
Part of subcall function 004172F0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417327
Part of subcall function 004172F0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0041733F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction ID: 84cbab3e625f5c703ca2aee7bdcd0b4d96e9050e400d57d2133d1b743e823249
Opcode Fuzzy Hash: 0dde54e68933c144dc9d433c77b62f5ff363c8b2548fcf823f9b9f06c0cc5b37
Instruction Fuzzy Hash: 8EE0C27190070222DB2033B66C06B6B329D0B1435DF00052EFA08D7252FE3CF81182AC

Function 0041A270 Relevance: 1.3, APIs: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,00420ADA), ref: 0041A2D5

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: c2fc4e1fd4be9ef044dbc11c0819e19b14df2fb30b2739993815bf0de72bef61
Instruction ID: 2a78e701e35aec36e6769ce11f212970ab7c3b82bc423fc04febfee158968705
Opcode Fuzzy Hash: c2fc4e1fd4be9ef044dbc11c0819e19b14df2fb30b2739993815bf0de72bef61
Instruction Fuzzy Hash: 08112D74A00208EFC705CF94D590A9AB3B2FF89304F2080E8E8095B391C736AE51DB54

Function 004188D0 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 004188F2

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 69e24b86b28bd7b079a6e9cca7457a077172f38b64f4847235a515cc131b290b
Instruction ID: 18df4f3d1847af864b4cf5612dd8d404a1e3ff34582bf4e0d6244d1823b45961
Opcode Fuzzy Hash: 69e24b86b28bd7b079a6e9cca7457a077172f38b64f4847235a515cc131b290b
Instruction Fuzzy Hash: B301FBB491420CEBCB14CF98D585BEC7BB5EF04308F248089D9456B350C7785F84DB4A

Function 004098D0 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 004098D8

Memory Dump Source

Source File: 00000000.00000002.2441600215.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2441600215.000000000043C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000046A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000493000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000049F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000004FD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000500000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.0000000000587000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2441600215.000000000063E000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction ID: 85591d8b2077324c158e0d5cdc0cd752fc6e9f2d8541dbcaab8872a49f7b11e9
Opcode Fuzzy Hash: 1aee106081fe82a84b5a838b5431766f4324473991f19cdffcfc85f73d7ea574
Instruction Fuzzy Hash: CFF054B4D00208FBDB00EFA5C946B9EB7B4AB08304F1085A9FD05A7381E6749B00CB95

Non-executed Functions

Function 6C5B5440 Relevance: 140.6, APIs: 54, Strings: 26, Instructions: 587threadtimeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C5B5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5B54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5B54BE
__Init_thread_footer.LIBCMT ref: 6C5B54DB

Part of subcall function 6C5DAB3F: EnterCriticalSection.KERNEL32(6C62E370,?,?,6C5A3527,6C62F6CC,?,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB49
Part of subcall function 6C5DAB3F: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A3527,6C62F6CC,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DAB7C

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

GetCurrentThreadId.KERNEL32 ref: 6C5B54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C5B5516
GetCurrentThreadId.KERNEL32 ref: 6C5B556A
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5B5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C5B5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C5B5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C5B55E6
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5B5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B5616

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

GetCurrentThreadId.KERNEL32 ref: 6C5B563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5B5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C5B567C
free.MOZGLUE(?), ref: 6C5B56AE

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C5B56E8
GetCurrentThreadId.KERNEL32 ref: 6C5B5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C5B570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C5B5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C5B574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C5B576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C5B5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C5B57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C5B57CA

Strings

[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C5B584E
Q^, xrefs: 6C5B57BC
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C5B5717
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C5B5D24
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5B54B9
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5B54A3
GeckoMain, xrefs: 6C5B5554, 6C5B55D5
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C5B5749
MOZ_BASE_PROFILER_HELP, xrefs: 6C5B5511
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C5B5BBE
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C5B5B38
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5B548D
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C5B5D2B
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5B5766
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C5B5CF9
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C5B5D01
[I %d/%d] profiler_init, xrefs: 6C5B564E
MOZ_PROFILER_STARTUP, xrefs: 6C5B55E1
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C5B5D1C
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5B57C5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C5B5AC9
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C5B5C56
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C5B56E3
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C5B57AE
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5B5791
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5B5724

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$Q^$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-2639675677
Opcode ID: fd061fc5e527c0860552363f74d15eb5ff6ba75276c03acde24cd4c4d08f0231
Instruction ID: b04d8da1ab57f41e6c74f865e98f57f7aeb7a2e9e97ec03ddeb5d4d242474f7d
Opcode Fuzzy Hash: fd061fc5e527c0860552363f74d15eb5ff6ba75276c03acde24cd4c4d08f0231
Instruction Fuzzy Hash: 1C2258B0A047009FE7049F75CCA465ABBB4FF86348F844A29E846A7B41E739D845CF5B

Function 6C5B6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727encryptionfileCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5B6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5B6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C5B6D26

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C5B6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C5B6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C5B6D73
free.MOZGLUE(00000000), ref: 6C5B6D80
CertGetNameStringW.CRYPT32 ref: 6C5B6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C5B6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5B6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C5B6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C5B6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C5B6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C5B6E34
CreateFileW.KERNEL32 ref: 6C5B6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C5B6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C5B6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C5B709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C5B7103
free.MOZGLUE(00000000), ref: 6C5B7153
CloseHandle.KERNEL32(?), ref: 6C5B7176
__Init_thread_footer.LIBCMT ref: 6C5B7209
__Init_thread_footer.LIBCMT ref: 6C5B723A
__Init_thread_footer.LIBCMT ref: 6C5B726B
__Init_thread_footer.LIBCMT ref: 6C5B729C
__Init_thread_footer.LIBCMT ref: 6C5B72DC
__Init_thread_footer.LIBCMT ref: 6C5B730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5B73C2
VerSetConditionMask.NTDLL ref: 6C5B73F3
VerSetConditionMask.NTDLL ref: 6C5B73FF
VerSetConditionMask.NTDLL ref: 6C5B7406
VerSetConditionMask.NTDLL ref: 6C5B740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C5B741A
moz_xmalloc.MOZGLUE(?), ref: 6C5B755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5B7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C5B7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C5B7598
free.MOZGLUE(00000000), ref: 6C5B75AC

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

Strings

(, xrefs: 6C5B768A
wintrust.dll, xrefs: 6C5B72CD
SHA256, xrefs: 6C5B6EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6C5B72C8

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: e9db18788376b837c45a8869f1589a6bef62bfba74220a25de14ae13e22b8532
Instruction ID: 5cee9659d234a717aa3a9afd9e7d910aa488b0cbc3a0cfb4499815407a786f80
Opcode Fuzzy Hash: e9db18788376b837c45a8869f1589a6bef62bfba74220a25de14ae13e22b8532
Instruction Fuzzy Hash: 1652F871A003149FEB21DF25CC94BAABBB8EF85704F104599E909A7640DB38AF85CF65

Function 6C5E0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5E0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C5E0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C5E0FB7
EnterCriticalSection.KERNEL32(?), ref: 6C5E0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C5E1031
LeaveCriticalSection.KERNEL32(?), ref: 6C5E10D0
EnterCriticalSection.KERNEL32(?), ref: 6C5E117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C5E1C39
EnterCriticalSection.KERNEL32(6C62E744), ref: 6C5E3391
LeaveCriticalSection.KERNEL32(6C62E744), ref: 6C5E33CD
LeaveCriticalSection.KERNEL32(?), ref: 6C5E3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5E3437

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5E3559, 6C5E382D, 6C5E3848
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5E37D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5E37BD
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C5E3793
MOZ_CRASH(), xrefs: 6C5E3950
: (malloc) Unsupported character in malloc options: ', xrefs: 6C5E3A02
<jemalloc>, xrefs: 6C5E3941, 6C5E39F1
MALLOC_OPTIONS, xrefs: 6C5E35FE
Compile-time page size does not divide the runtime one., xrefs: 6C5E3946
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5E37A8

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 834a93480f465204020fb9a3d153ab3dc3bf58be406ef50491b0408c13afe876
Instruction ID: 5f342d523127de6c28f03d1c147bdb87026a286910bcf43042b90002f6730f0d
Opcode Fuzzy Hash: 834a93480f465204020fb9a3d153ab3dc3bf58be406ef50491b0408c13afe876
Instruction Fuzzy Hash: 10538F71A057028FD304CF29C940616FBE1FF89328F29C66DE8A99B7A5D775E841CB81

Function 6C6034A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6035BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6035E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6036CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6038BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6039EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C603EE2

Part of subcall function 6C606180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C6061DD
Part of subcall function 6C606180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C60622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6040F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C604157

Part of subcall function 6C606180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C606250
Part of subcall function 6C606180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C606292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C60441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C604448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C60484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C604863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C604878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C604896
free.MOZGLUE ref: 6C60489F

Strings

, xrefs: 6C604CD2

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: a77a4636c5e8f496d2a7e7b3d54850f007eb2ebb50ed04f86416adf89aa6c806
Instruction ID: 514d5fe999441bd1159f5f7daad6de1aa1c71b464e0b6611e837ccad0285a7c9
Opcode Fuzzy Hash: a77a4636c5e8f496d2a7e7b3d54850f007eb2ebb50ed04f86416adf89aa6c806
Instruction Fuzzy Hash: 1DF24C74908780CFC735CF29C18469AFBF1BF9A304F118A5ED989A7711DB719886CB46

Function 6C5B64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C5B64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C5B64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C5B6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C5B6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5B652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C5B671C
GetCurrentProcess.KERNEL32 ref: 6C5B6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5B672F
GetCurrentProcess.KERNEL32 ref: 6C5B6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C5B6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C5B6A80
GetSystemInfo.KERNEL32(?), ref: 6C5B6ABE
__Init_thread_footer.LIBCMT ref: 6C5B6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5B6AF7

Strings

_etoured.dll, xrefs: 6C5B64ED
nvdxgiwrap.dll, xrefs: 6C5B6513
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C5B6798
user32.dll, xrefs: 6C5B6526
detoured.dll, xrefs: 6C5B64DA
nvd3d9wrap.dll, xrefs: 6C5B6500

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: ca73a7093b382ed83c723d16b3df9c4f2fe0bca1bb134f73bcd6d5722b58a9e1
Instruction ID: 3dcb60dd157ef0e3dbc2a2d1f6c18e361f17a726a44e9985278faabe34b19c1f
Opcode Fuzzy Hash: ca73a7093b382ed83c723d16b3df9c4f2fe0bca1bb134f73bcd6d5722b58a9e1
Instruction Fuzzy Hash: B2F10370901319DFDB24CF25CD98B9ABBB4EF46308F1442A9D809B3681DB31AE85CF95

Function 6C60C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C60C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C60C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C60C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C60CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C60DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C60DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C60DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C60E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C60E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C60E472

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 2c7d1c6d4816fe76778441dcd124f1e2505c097f0f07b9a79c0e974577a1b578
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 8F33CD71E0021A8FCB08CFA8C9806EDBBF2FF49314F288269D955BB755D730A945CB94

Function 6C5CED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C5CEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C5CEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C5D1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5D16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C5D1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C5D1A3E

Strings

~qZl, xrefs: 6C5CED13
~qZl, xrefs: 6C5CED10

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qZl$~qZl
API String ID: 3693777188-2831360158
Opcode ID: 6969a3cee5a71fbaaebc56d22ff509a48d1ccc792ea821724c4cc7dcc0244bf7
Instruction ID: cea532c1ebe75ec635563a2b362f4b4f0176a330ab7091d48d541b744f5a5c13
Opcode Fuzzy Hash: 6969a3cee5a71fbaaebc56d22ff509a48d1ccc792ea821724c4cc7dcc0244bf7
Instruction Fuzzy Hash: E8B31871E04219CFCB14CFA8C890A9DB7B2FF89314F2582A9D459AB745D730AD86CF94

Function 6C5BFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E7B8), ref: 6C5BFF81
LeaveCriticalSection.KERNEL32(6C62E7B8), ref: 6C5C022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5C0240
EnterCriticalSection.KERNEL32(6C62E768), ref: 6C5C025B
LeaveCriticalSection.KERNEL32(6C62E768), ref: 6C5C027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5BFE99, 6C5BFEB7, 6C5BFED3, 6C5C0DB8, 6C5C0DD3, 6C5C19B4
: (malloc) Error in VirtualFree(), xrefs: 6C5C0D67, 6C5C0D7B, 6C5C0DAC
<jemalloc>, xrefs: 6C5C0D62, 6C5C0D76, 6C5C0DA7

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 3e16fa8d7864c07d71a9d5fe97c1b70828a7f3cda412137e557a9a1b902cc4c2
Instruction ID: bd5e4adfcc1269b3fa71f80519889a20ebebb11ddeefda2e8d7b17063dc2815e
Opcode Fuzzy Hash: 3e16fa8d7864c07d71a9d5fe97c1b70828a7f3cda412137e557a9a1b902cc4c2
Instruction Fuzzy Hash: 32C2AB71B057418FD714CF69C880716BBE1AFC5328F28CA6DE4AA8B795D775E801CB82

Function 6C5E3E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C607770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>^l,?,?,?,6C5E3E7D,?,?), ref: 6C60777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C5E3F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C5E3F5C
VerSetConditionMask.NTDLL ref: 6C5E3F8D
VerSetConditionMask.NTDLL ref: 6C5E3F99
VerSetConditionMask.NTDLL ref: 6C5E3FA0
VerSetConditionMask.NTDLL ref: 6C5E3FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C5E3FB4

Strings

nvinit.dll, xrefs: 6C5E4479
nvd3d9wrap.dll, xrefs: 6C5E4466
C>^l, xrefs: 6C5E3E93

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>^l$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-824577501
Opcode ID: 95ebb9ac353a88cf6e96b721d1307f9bebc059f1070ab2c6694063e86a18f340
Instruction ID: 830f487e22a20854b4bdcf881081af94df7f89769472e088442cdca2fcdb7ae2
Opcode Fuzzy Hash: 95ebb9ac353a88cf6e96b721d1307f9bebc059f1070ab2c6694063e86a18f340
Instruction Fuzzy Hash: BF522271614B488FD711DF74CCD0AAB7BE9AF84208F44492DD5A29BB82DB74F909CB60

Function 6C5BFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E7B8), ref: 6C5BFF81
LeaveCriticalSection.KERNEL32(6C62E7B8), ref: 6C5C022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C5C0240
EnterCriticalSection.KERNEL32(6C62E768), ref: 6C5C025B
LeaveCriticalSection.KERNEL32(6C62E768), ref: 6C5C027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5BFE99, 6C5BFEB7, 6C5BFED3, 6C5C0DB8, 6C5C0DD3, 6C5C19B4, 6C5C1A10
MOZ_CRASH(), xrefs: 6C5C0CA7

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: db724cea44ad0edde6daec61943cf64cf0c1b144844c3e96c852a5751d8fe328
Instruction ID: b7722316f7f8b11ac73ac9901a6f709d107469c9796cf0c6c0e83585abe21524
Opcode Fuzzy Hash: db724cea44ad0edde6daec61943cf64cf0c1b144844c3e96c852a5751d8fe328
Instruction Fuzzy Hash: 56B2BC717057418FD714CF69C990716BBE1BF85328F28CA6DE86A8B795C774E840CB82

Function 6C5F5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

data, xrefs: 6C5F6131
expected a Time entry, xrefs: 6C5F5CB6
name, xrefs: 6C5F5E79, 6C5F5E8F
expected a Count entry, xrefs: 6C5F5AC3
schema, xrefs: 6C5F606D
ProfileBuffer parse error: %s, xrefs: 6C5F5AC8, 6C5F5CBB

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: bebfe88e693bff66a8ed05683d053d4dd6be823f51c6927c82a8019a4f190da4
Instruction ID: 1537a568d05ee02c999aa3b86a9febbb8827f14098fd70b351eb7e192b891d6f
Opcode Fuzzy Hash: bebfe88e693bff66a8ed05683d053d4dd6be823f51c6927c82a8019a4f190da4
Instruction Fuzzy Hash: 90923C716083418FD728CF18C89075ABBE1BFC5308F55891DE5AA9B751DB30E94ACF92

Function 6C5F2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C5F2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C5F2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5F3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5F36BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C5F378D
get , xrefs: 6C5F3205
set , xrefs: 6C5F36EC

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: a103138ac29b8f29655c7509789b3c3037d6f134c8fe433de5e3c338fd85ae12
Instruction ID: 1dd297eb1b2b79828b1d152e5bb2653aefe833080a7bc1f2fb80730835ded342
Opcode Fuzzy Hash: a103138ac29b8f29655c7509789b3c3037d6f134c8fe433de5e3c338fd85ae12
Instruction Fuzzy Hash: 62324EB02083818FD769CF24C8906AEB7E2AFC9218F548C1DE5A987751DB30D94ACF57

Function 6C5E7E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6C5E8280, 6C5E83E1
name, xrefs: 6C5E7ECF, 6C5E8335
schema, xrefs: 6C5E81E3, 6C5E8311
(pre-xul), xrefs: 6C5E7E88
vbl, xrefs: 6C5E8207

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vbl
API String ID: 3412268980-3299618421
Opcode ID: 50d0b56aba3fc2e26aab11ac4f7d6543053b5b6871bed52e6459001306bb12f5
Instruction ID: a1b437141be5dac922db1edcd1149e5d75ca01fef05616cee452cba8cc63c2c9
Opcode Fuzzy Hash: 50d0b56aba3fc2e26aab11ac4f7d6543053b5b6871bed52e6459001306bb12f5
Instruction Fuzzy Hash: 4FE19FB1A043408FC710CF69885165BFBE9BFD9314F14492DE899E7B80DBB5DC098B92

Function 6C5C5E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2
memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C5C7652

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5C7BCD, 6C5C7C1F, 6C5C7C34, 6C5C80FD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5C730D
ew`l, xrefs: 6C5C5E9C, 6C5C5F22, 6C5C61ED
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5C72F8
MOZ_CRASH(), xrefs: 6C5C7BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5C72E3

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ew`l
API String ID: 2613674957-3284534115
Opcode ID: 0eb2f5d1eac8144c8dc0a26fb7c9cc57f2e1d263fa4e5e476b23e3c9fa4fe581
Instruction ID: 93e0d18dc5b735f1175636cdc2c193fcc3228e1f689290c03a4c01b83a1b6579
Opcode Fuzzy Hash: 0eb2f5d1eac8144c8dc0a26fb7c9cc57f2e1d263fa4e5e476b23e3c9fa4fe581
Instruction Fuzzy Hash: F2337D717057018FC304CF69C990625BBE2FF85368F29C6ADE9698BBA5D731E841CB42

Function 6C5CD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD4F2
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD50B

Part of subcall function 6C5ACFE0: EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5ACFF6
Part of subcall function 6C5ACFE0: LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5AD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD52E
EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5CD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CD6A6
LeaveCriticalSection.KERNEL32(6C62E7DC), ref: 6C5CD712
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CD7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C5CD82C
<jemalloc>, xrefs: 6C5CD827

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: d29315c21f819302edc94ff9605a0aa35722c51b6b87dbc11c76b2282769ebf9
Instruction ID: b70a81f91e4c0ef53031cb780c280b10301117b476674437399d1e57aa31c196
Opcode Fuzzy Hash: d29315c21f819302edc94ff9605a0aa35722c51b6b87dbc11c76b2282769ebf9
Instruction Fuzzy Hash: BF91DE71B447018FD714CFB9C89076AB7E1EB89314F15893EE49AC7A81D738E845CB86

Function 6C604EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C604EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C604F2E
moz_xmalloc.MOZGLUE ref: 6C604F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C604F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6052B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C6052E6
Sleep.KERNEL32(00000010), ref: 6C605481
free.MOZGLUE(?), ref: 6C605498

Strings

(, xrefs: 6C605250

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 5c593d2faf7809f03efcff2bf2579bf411bce8eae0de8c22617e9788faa5ceca
Instruction ID: 39158aa9930defee7f6f2410cd12d6e3ea26330b2d5a9aa2321b8e55e89a3b3c
Opcode Fuzzy Hash: 5c593d2faf7809f03efcff2bf2579bf411bce8eae0de8c22617e9788faa5ceca
Instruction Fuzzy Hash: A0F1C471A18B508FC716CF39C89062BB7F5AFE6384F058B2EF846A7651DB31D4428B85

Function 6C5C9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5C9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C5C9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5C9F34
LeaveCriticalSection.KERNEL32(?), ref: 6C5CA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5CA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5CA8B1, 6C5CA8D4, 6C5CA8EF

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: ae4ca745ea65f1ba15a3a0a723ee8c080cdc3be4442e1b30eabcab41ef43afa3
Instruction ID: 1fa50fc0e4c5f8589d2fcea6b4355c3d6b18af737ba4e5161772e2fe09930924
Opcode Fuzzy Hash: ae4ca745ea65f1ba15a3a0a723ee8c080cdc3be4442e1b30eabcab41ef43afa3
Instruction Fuzzy Hash: 39727A72A056118FD704CF68C980215FFE1BF89328F29C76DE8699B791D375E842CB82

Function 6C5F2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C5F2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C5F2C61

Part of subcall function 6C5A4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5A4E5A
Part of subcall function 6C5A4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5A4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5F2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5F2E2D

Part of subcall function 6C5B81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C5B81DE

Strings

(root), xrefs: 6C5F354F
expected a Time entry, xrefs: 6C5F2E36
ProfileBuffer parse error: %s, xrefs: 6C5F2E3B

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 87563e9266fa5d9563851134e896654ca26429316ed0db3640f8f8dd36d38ba5
Instruction ID: 0505b8a4d4f82c47b004136eb30c6ac387f42898893907f90401523c696e4f8a
Opcode Fuzzy Hash: 87563e9266fa5d9563851134e896654ca26429316ed0db3640f8f8dd36d38ba5
Instruction Fuzzy Hash: 0591C0B06087808FD728DF28C89069EB7E1AFC9358F50491DE9AA87751DB30D94ACF57

Function 6C609E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C609F3D
__aulldiv.LIBCMT ref: 6C609F77
__aullrem.LIBCMT ref: 6C609F8C
__aulldiv.LIBCMT ref: 6C60A023

Strings

NaN, xrefs: 6C609EAB
-Infinity, xrefs: 6C609E60, 6C609E7B

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 08fe296fd98c543bd08ddaf4f9fb7262684944f89363a70c6d1e94d342d46ebf
Instruction ID: 3903b1d65cf20848c713342c61e83fb4e205740b53b16c797599721de9d6bb7c
Opcode Fuzzy Hash: 08fe296fd98c543bd08ddaf4f9fb7262684944f89363a70c6d1e94d342d46ebf
Instruction Fuzzy Hash: 29C1AD71B04318CBDB18CFA8C9907DEB7B6AF84348F144529D406BBB82DB71AD49CB95

Function 6C5AD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

9, xrefs: 6C5ADE7F
, xrefs: 6C5ADA88
@, xrefs: 6C5ADAF6
-, xrefs: 6C5AD7DD
0, xrefs: 6C5ADC7F
0, xrefs: 6C5AD852
1, xrefs: 6C5ADBDD
8, xrefs: 6C5ADC08

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 0469f94be94e5154d43afb35b44d633da74d80ede508b27f3299f66545a9d1f3
Instruction ID: ce249c2d85c15ab09f3eef36ed71f8285139c425f59ba3cebf0aee1566210d87
Opcode Fuzzy Hash: 0469f94be94e5154d43afb35b44d633da74d80ede508b27f3299f66545a9d1f3
Instruction Fuzzy Hash: F162CF7150C3458FD705EE9AC89075EBBF2AF8A318F184A0DECE54BA51D335D986CB82

Function 6C61545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C618A4B

Strings

~qZl, xrefs: 6C615740, 6C619459, 6C61921F, 6C6156C7, 6C619269, 6C615703, 6C61948F

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset
String ID: ~qZl
API String ID: 2221118986-4224160377
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: f3e47a8d9a74a4474d5a803e9fdfebcbba9b27d2980a759e6adc3b010f372e4b
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 46B1D772E0821A8FDB14CF6CCC917E9B7B2EF85314F1902A9C549DBB91D730A985CB94

Function 6C61542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C6188F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C61925C

Strings

~qZl, xrefs: 6C615740, 6C619459, 6C61921F, 6C6156C7, 6C619269, 6C615703, 6C61948F

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset
String ID: ~qZl
API String ID: 2221118986-4224160377
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: a8bd9fab5e846487c4916218042354b369f0e030be6045cf2dedb52953ff0e03
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 77B1C572E0820A8FDB14CF6CCC816EDB7B2AF85314F190279C549DBB95D730A989CB94

Function 6C5ABEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5AC1CB
__aulldiv.LIBCMT ref: 6C5AC24C
__aulldiv.LIBCMT ref: 6C5AC348
__aullrem.LIBCMT ref: 6C5AC365
__aulldiv.LIBCMT ref: 6C5AC37D

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 245de6b99100109a57bad00e34f5c3793610824de2aaf491627289bb8ed5cf52
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 98322732B046118FC718DE6DC89065ABBE6AFC9310F09867DE495CB395D731ED06CB91

Function 6C5E6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C5E6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5E6E1E

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 9e467d996098dfdbd152d872459069a59b024ef965ec3c3f6f8f7c3185252de0
Instruction ID: aba1f1f3467fbc824ed1d48b9b1324115ea66d09b32d871feaab0bfb83725fb3
Opcode Fuzzy Hash: 9e467d996098dfdbd152d872459069a59b024ef965ec3c3f6f8f7c3185252de0
Instruction Fuzzy Hash: 72A18B70618384CFDB15CF25C8907AEBBE2BFC9348F04491DE99A87751DB70A949CB82

Function 6C5C4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C5C4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C5C5585, 6C5C55A8, 6C5C55C3, 6C5C5624

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 94c493745be54d2caecbc7ef721dd874cab3cc5c37c4124f75219da864b38e96
Instruction ID: 552be4bf32a83cc4ebc5c9010f34cddcdac87935008786bab9075b186aa3e047
Opcode Fuzzy Hash: 94c493745be54d2caecbc7ef721dd874cab3cc5c37c4124f75219da864b38e96
Instruction Fuzzy Hash: D8B28F71B056018FD308CF99C990725BBE2BFC5328B29C76DE4698B7A5D771E841CB82

Function 6C6085F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C608C7C
__aulldiv.LIBCMT ref: 6C608DD7

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: be2a872b49d769d3c629b90ada2b01e3486ff575f3cbb3d8df408d88d4d594d9
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 63328F31F101198BDF1CCE9CC9A17AEB7B6FB88304F16853AD406BB7A0DA349D458B95

Function 6C6176E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qZl, xrefs: 6C617796, 6C6179C0, 6C617B0B, 6C6179FB, 6C617E0B, 6C61793C

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ~qZl
API String ID: 0-4224160377
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: a3cc26e547993f11bc2f97b632f64410c61ae1d9ae32e34ce59531f6f6a9e01d
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 62320A71E046198FCB14CF99C890AADFBF2FF88308F648169C549A7B45D731A986CF94

Function 6C616E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qZl, xrefs: 6C6179C0, 6C617B0B, 6C6179FB, 6C617E0B, 6C617C72, 6C61793C, 6C617C03

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: ~qZl
API String ID: 0-4224160377
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 19bda37819bdebe1013a50c67d88af55cd5de13f1e8fae335f1313da59a29b9d
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: F1220975E042198FCB14CF98C880AADF7F2FF88304F6485AAC549A7B45D731A986CF94

Function 6C5E5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C5B4A63,?,?), ref: 6C5E5F06

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 3e6af2682fed1e7a33fa9948a7535c47f6cff07a4a126e9056dcb77546a16cd9
Instruction ID: 20a62045daa545c748688c10d1c00a7ab334133c17567e59010db0afb843842a
Opcode Fuzzy Hash: 3e6af2682fed1e7a33fa9948a7535c47f6cff07a4a126e9056dcb77546a16cd9
Instruction Fuzzy Hash: E7C1D275D012098BCB04CF99C9906EEBBF2FF8A318FA8415DD8556BB45D732A906CF90

Function 6C5D0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 6b274da699a51902576afb2007428f7aa8669ff043b9c833f60765cb011d3446
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: BE221671E00619CFCB14CF98C890AADF7B2FF88314F55869AD44AA7705D731A986CF84

Function 6C61AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33cb064bc30959da60377ddd9f4483401e727ff62f8445e899514d13fa10c4bd
Instruction ID: b42411a1024763ab42fed08c8b48809b8ea30ec380ff29545556e980984c3241
Opcode Fuzzy Hash: 33cb064bc30959da60377ddd9f4483401e727ff62f8445e899514d13fa10c4bd
Instruction Fuzzy Hash: B7F13971A0C7454FD700CE2CC8913AAB7E2AFC531AF158A2DE4D487F92E774988D8796

Function 6C5AC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 4d7c41bfe003d8dcb3dbffc77e1c1a09eb23f250caaf566cdf5819a47df85da6
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 4BA1A171F0021A8FDB08CEA9C8913AEB7F2AFC9354F188129D915E7791D7356C068BD0

Function 6C6055F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32,?,6C5DE1A5), ref: 6C605606
LoadLibraryW.KERNEL32(gdi32,?,6C5DE1A5), ref: 6C60560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C605633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C60563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C60566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C60567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C605696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C6056B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C6056CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C6056E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C6056FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C605716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C60572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C605748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C605761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C60577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C605793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C6057A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C6057BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C6057D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C6057EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C6057FF

Strings

GetWindowDC, xrefs: 6C605710
SetWindowLongPtrW, xrefs: 6C6057B7
StretchDIBits, xrefs: 6C6057CC
ReleaseDC, xrefs: 6C605742
EnableNonClientDpiScaling, xrefs: 6C605666
GetThreadDpiAwarenessContext, xrefs: 6C60562D
GetSystemMetricsForDpi, xrefs: 6C605677
FillRect, xrefs: 6C605729
ShowWindow, xrefs: 6C6056DE
MonitorFromWindow, xrefs: 6C60578D
AreDpiAwarenessContextsEqual, xrefs: 6C605637
CreateWindowExW, xrefs: 6C6056C5
RegisterClassW, xrefs: 6C6056AC
user32, xrefs: 6C605601
DeleteObject, xrefs: 6C6057F9
SetWindowPos, xrefs: 6C6056F7
CreateSolidBrush, xrefs: 6C6057E4
GetDpiForWindow, xrefs: 6C605690
GetMonitorInfoW, xrefs: 6C6057A2
gdi32, xrefs: 6C60560A
LoadCursorW, xrefs: 6C605774
LoadIconW, xrefs: 6C60575B

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 5f31fe26e2d003e74035fbced6d182f54367423d02501a6350efa2aa51eff81e
Instruction ID: e1c1dbc385d333ab9905a20563842b1352d83a7447740f029dd45e8d96408e9b
Opcode Fuzzy Hash: 5f31fe26e2d003e74035fbced6d182f54367423d02501a6350efa2aa51eff81e
Instruction Fuzzy Hash: 7F512F707153239BDB049F368E9492A3AFCFF46385B144425AD62F2A55EB7CC8018F6D

Function 6C5ECC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C5B582D), ref: 6C5ECC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C5B582D), ref: 6C5ECC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C61FE98,?,?,?,?,?,6C5B582D), ref: 6C5ECC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5B582D), ref: 6C5ECCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C5ECCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C5ECCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C5ECCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C5ECCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C5ECD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C5ECD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C5ECD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C5ECDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C5ECDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C5ECDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C5ECDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C5ECE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C5ECE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C5ECE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C5ECE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C5ECE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C5ECE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C5ECE8A

Strings

Q^, xrefs: 6C5ECD25
cpuallthreads, xrefs: 6C5ECE16
screenshots, xrefs: 6C5ECCD4
unregisteredthreads, xrefs: 6C5ECE58
nostacksampling, xrefs: 6C5ECD7C
ipcmessages, xrefs: 6C5ECDBE
samplingallthreads, xrefs: 6C5ECE2C
java, xrefs: 6C5ECC37
Unrecognized feature "%s"., xrefs: 6C5ECEA0
noiostacks, xrefs: 6C5ECCBE
stackwalk, xrefs: 6C5ECCF8
jsallocations, xrefs: 6C5ECD0E
fileioall, xrefs: 6C5ECCA8
preferencereads, xrefs: 6C5ECD92
power, xrefs: 6C5ECE84
seqstyle, xrefs: 6C5ECCE6
leaf, xrefs: 6C5ECC66
notimerresolutionchange, xrefs: 6C5ECE00
processcpu, xrefs: 6C5ECE6E
nativeallocations, xrefs: 6C5ECDA8
audiocallbacktracing, xrefs: 6C5ECDD4
default, xrefs: 6C5ECC21
fileio, xrefs: 6C5ECC92
mainthreadio, xrefs: 6C5ECC7C
markersallthreads, xrefs: 6C5ECE42

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$Q^$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-1065946776
Opcode ID: 3a2c7171958b9561609795740c909d88370760df082db387857aa337d82519eb
Instruction ID: 393fb66a07737cea417b6c975e6b01fe38d7e650c0b50591e21ee837e370fadf
Opcode Fuzzy Hash: 3a2c7171958b9561609795740c909d88370760df082db387857aa337d82519eb
Instruction Fuzzy Hash: 5A51CCF19092A561FA05B1191E20BEE1C45EF5B24BF106436EE1BA1F80FF06F61949BF

Function 6C5B4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5B4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C5B44B2,6C62E21C,6C62F7F8), ref: 6C5B473E
Part of subcall function 6C5B4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C5B474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C5B44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C5B44D2
InitOnceExecuteOnce.KERNEL32(6C62F80C,6C5AF240,?,?), ref: 6C5B451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C5B455C
LoadLibraryW.KERNEL32(?), ref: 6C5B4592
InitializeCriticalSection.KERNEL32(6C62F770), ref: 6C5B45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C5B45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C5B45BB
InitOnceExecuteOnce.KERNEL32(6C62F818,6C5AF240,?,?), ref: 6C5B4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C5B4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C5B4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5B466D
VerSetConditionMask.NTDLL ref: 6C5B469F
VerSetConditionMask.NTDLL ref: 6C5B46AB
VerSetConditionMask.NTDLL ref: 6C5B46B2
VerSetConditionMask.NTDLL ref: 6C5B46B9
VerSetConditionMask.NTDLL ref: 6C5B46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5B46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C5B46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C5B46FD

Strings

Gbl, xrefs: 6C5B44FC
kernel32.dll, xrefs: 6C5B44CD
user32.dll, xrefs: 6C5B4557, 6C5B463F
l, xrefs: 6C5B4578
WRusr.dll, xrefs: 6C5B44B5
NativeNtBlockSet_Write, xrefs: 6C5B46F7

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: Gbl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3324001954
Opcode ID: 92cf069cee517e135d84ebd5672a7e51041a6d58fc5ddb4b040e2d112189c132
Instruction ID: cff88caaebaecf6036a6618cd64cac75ac8956e8d5328bba4cbe5482e6b61ac3
Opcode Fuzzy Hash: 92cf069cee517e135d84ebd5672a7e51041a6d58fc5ddb4b040e2d112189c132
Instruction Fuzzy Hash: 0A615BB0604354AFEB209F62CC85B957FB8EF82308F04855CE545AB641D3BD9945CF5A

Function 6C5EF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C5EF8F9

Part of subcall function 6C5B6390: GetCurrentThreadId.KERNEL32 ref: 6C5B63D0
Part of subcall function 6C5B6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C5B63DF
Part of subcall function 6C5B6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C5B640E

ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF93A
GetCurrentThreadId.KERNEL32 ref: 6C5EF98A
GetCurrentThreadId.KERNEL32 ref: 6C5EF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF716

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

Part of subcall function 6C5AB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C5AB5E0

GetCurrentThreadId.KERNEL32 ref: 6C5EF739
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF746
GetCurrentThreadId.KERNEL32 ref: 6C5EF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C62385B,00000002,?,?,?,?,?), ref: 6C5EF829
free.MOZGLUE(?,?,00000000,?), ref: 6C5EF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C5EF866
free.MOZGLUE(?), ref: 6C5EFA0C

Part of subcall function 6C5B5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B5E8C
Part of subcall function 6C5B5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5E9D
Part of subcall function 6C5B5E60: GetCurrentThreadId.KERNEL32 ref: 6C5B5EAB
Part of subcall function 6C5B5E60: GetCurrentThreadId.KERNEL32 ref: 6C5B5EB8
Part of subcall function 6C5B5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5ECF
Part of subcall function 6C5B5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C5B5F27
Part of subcall function 6C5B5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C5B5F47
Part of subcall function 6C5B5E60: GetCurrentProcess.KERNEL32 ref: 6C5B5F53
Part of subcall function 6C5B5E60: GetCurrentThread.KERNEL32 ref: 6C5B5F5C
Part of subcall function 6C5B5E60: GetCurrentProcess.KERNEL32 ref: 6C5B5F66
Part of subcall function 6C5B5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5B5F7E

free.MOZGLUE(?), ref: 6C5EF9C5
free.MOZGLUE(?), ref: 6C5EF9DA

Strings

Thread , xrefs: 6C5EF789
" attempted to re-register as ", xrefs: 6C5EF858
[D %d/%d] profiler_register_thread(%s), xrefs: 6C5EF71F
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C5EF9A6

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 5bc0720ddb7945827e735d21d03b0c5cdb327e011554b325365b11191bf233ed
Instruction ID: 488dc76d27e11a44d6bbb42f8ababecb44f75b6518541091df13282c4ebfe0a9
Opcode Fuzzy Hash: 5bc0720ddb7945827e735d21d03b0c5cdb327e011554b325365b11191bf233ed
Instruction Fuzzy Hash: 22811371A04200DFDB00DF65DC80AAEB7B5EFC9308F40456DE8869BB51EB34AC49CB92

Function 6C5EEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EEE60
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEE6D
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C5EEEA5
CloseHandle.KERNEL32(?), ref: 6C5EEEB4
free.MOZGLUE(00000000), ref: 6C5EEEBB
GetCurrentThreadId.KERNEL32 ref: 6C5EEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EEECF

Part of subcall function 6C5EDE60: GetCurrentThreadId.KERNEL32 ref: 6C5EDE73
Part of subcall function 6C5EDE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5B4A68), ref: 6C5EDE7B
Part of subcall function 6C5EDE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5B4A68), ref: 6C5EDEB8
Part of subcall function 6C5EDE60: free.MOZGLUE(00000000,?,6C5B4A68), ref: 6C5EDEFE
Part of subcall function 6C5EDE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C5EDF38

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

GetCurrentThreadId.KERNEL32 ref: 6C5EEF1E
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEF2B
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEF59
GetCurrentThreadId.KERNEL32 ref: 6C5EEFB0
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEFBD
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EEFE1
GetCurrentThreadId.KERNEL32 ref: 6C5EEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF000

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C5EF02F

Part of subcall function 6C5EF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5EF09B
Part of subcall function 6C5EF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C5EF0AC
Part of subcall function 6C5EF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C5EF0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C5EF008
[I %d/%d] profiler_stop, xrefs: 6C5EEED7

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: d347387d18bc8e9a24d58b264f266c6432058a6b791cc7962174517bcfbff507
Instruction ID: 172177a8a43190cfbaa3514cbc59d34977cd7b9451b6a9ebd098c94da342b9c6
Opcode Fuzzy Hash: d347387d18bc8e9a24d58b264f266c6432058a6b791cc7962174517bcfbff507
Instruction Fuzzy Hash: 1D51FA71600220DFDB009F66DC88B9577B8EF8A358F100A25ED2683B41DBBD5805CBAF

Function 6C5B5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5E9D

Part of subcall function 6C5C5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B85
Part of subcall function 6C5C5B50: EnterCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5B90
Part of subcall function 6C5C5B50: LeaveCriticalSection.KERNEL32(6C62F688,?,?,?,6C5C56EE,?,00000001), ref: 6C5C5BD8
Part of subcall function 6C5C5B50: GetTickCount64.KERNEL32 ref: 6C5C5BE4

GetCurrentThreadId.KERNEL32 ref: 6C5B5EAB
GetCurrentThreadId.KERNEL32 ref: 6C5B5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5B5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C5B6017

Part of subcall function 6C5A4310: moz_xmalloc.MOZGLUE(00000010,?,6C5A42D2), ref: 6C5A436A
Part of subcall function 6C5A4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5A42D2), ref: 6C5A4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C5B5F47
GetCurrentProcess.KERNEL32 ref: 6C5B5F53
GetCurrentThread.KERNEL32 ref: 6C5B5F5C
GetCurrentProcess.KERNEL32 ref: 6C5B5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C5B5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C5B5F27

Part of subcall function 6C5BCA10: mozalloc_abort.MOZGLUE(?), ref: 6C5BCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B5E8C

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5B55E1), ref: 6C5B60CC

Strings

GeckoMain, xrefs: 6C5B5ECE, 6C5B6015

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: bc8a66d3f4e5879e9053ca4d6552303308d189544a1ecc2152a51cc8daffefdc
Instruction ID: 9686039008196e16fdede45e9eb6a355864f811db17045e49d1cdd61a471e426
Opcode Fuzzy Hash: bc8a66d3f4e5879e9053ca4d6552303308d189544a1ecc2152a51cc8daffefdc
Instruction Fuzzy Hash: A871CFB0A04740DFD704DF29C890A6ABBF0FF8A304F54496DE58697B42DB75E848CB96

Function 6C5B9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5A31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C5A3217
Part of subcall function 6C5A31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C5A3236
Part of subcall function 6C5A31C0: FreeLibrary.KERNEL32 ref: 6C5A324B
Part of subcall function 6C5A31C0: __Init_thread_footer.LIBCMT ref: 6C5A3260
Part of subcall function 6C5A31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C5A327F
Part of subcall function 6C5A31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5A328E
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5A32AB
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C5A32D1
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5A32E5
Part of subcall function 6C5A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5A32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5B9675
__Init_thread_footer.LIBCMT ref: 6C5B9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5B96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5B9707
__Init_thread_footer.LIBCMT ref: 6C5B971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5B97B7
FreeLibrary.KERNEL32 ref: 6C5B97D0
FreeLibrary.KERNEL32 ref: 6C5B97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9824

Strings

ntdll.dll, xrefs: 6C5B96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5B9670
NtMapViewOfSection, xrefs: 6C5B9701
MapViewOfFileNuma2, xrefs: 6C5B97B1

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 785070c44e9d77c3265306a62cc6707f3e27218ecb76c7aa985ac09ace800631
Instruction ID: d55b47565fee14a58791fc922627726d36049c56a61cbc801af5ab2cdb497dc1
Opcode Fuzzy Hash: 785070c44e9d77c3265306a62cc6707f3e27218ecb76c7aa985ac09ace800631
Instruction Fuzzy Hash: CE61D371600311DBDF00CF6AECE4B9A7FB1EB8A314F104529E995A7780D738A845CF9A

Function 6C606660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C62F618), ref: 6C606694
GetThreadId.KERNEL32(?), ref: 6C6066B1
GetCurrentThreadId.KERNEL32 ref: 6C6066B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C6066E1
EnterCriticalSection.KERNEL32(6C62F618), ref: 6C606734
GetCurrentProcess.KERNEL32 ref: 6C60673A
LeaveCriticalSection.KERNEL32(6C62F618), ref: 6C60676C
GetCurrentThread.KERNEL32 ref: 6C6067FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C606868
RtlCaptureContext.NTDLL ref: 6C60687F

Strings

WalkStack64, xrefs: 6C606890

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 98a9c8c257e3cce7053adf66fad7fe344b49fb5cc88fd305a473a21984d4e6fc
Instruction ID: 2e30eb97275442ed5e4bae0b4d3720e09072db7c547d5cf06e448291e5cb3795
Opcode Fuzzy Hash: 98a9c8c257e3cce7053adf66fad7fe344b49fb5cc88fd305a473a21984d4e6fc
Instruction Fuzzy Hash: 4251DD71A09300AFD715CF25C984B9ABBF4FF89714F00492DF999A7640D774E848CB9A

Function 6C5EDE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EDE73
GetCurrentThreadId.KERNEL32 ref: 6C5EDF7D
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EDF8A
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EDFC9
GetCurrentThreadId.KERNEL32 ref: 6C5EDFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C5B4A68), ref: 6C5EDE7B

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C5B4A68), ref: 6C5EDEB8
free.MOZGLUE(00000000,?,6C5B4A68), ref: 6C5EDEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C5EDF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C5EE00E
[I %d/%d] locked_profiler_stop, xrefs: 6C5EDE83
<none>, xrefs: 6C5EDFD7

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: f944cdc6bc340e3db7fb3751c85bf89fcc0545df2f0977463ef60acbccfbd20b
Instruction ID: 3e2b67d5da2fc55c59b8306ab98f0e3f3a857da6d6d28b4699875a0216e51dc2
Opcode Fuzzy Hash: f944cdc6bc340e3db7fb3751c85bf89fcc0545df2f0977463ef60acbccfbd20b
Instruction Fuzzy Hash: B841E571B012209BDB109F66CC88BAA7775EFC9318F140015E91597B02CB79AC05CBEA

Function 6C5FD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5FD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD52A
GetCurrentThreadId.KERNEL32 ref: 6C5FD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD55F
free.MOZGLUE(00000000), ref: 6C5FD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5FD5D3
GetCurrentThreadId.KERNEL32 ref: 6C5FD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD652
GetCurrentThreadId.KERNEL32 ref: 6C5FD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5FD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5FD6A2

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 0e539773b435dbde7afbbe333bb4567307dd2dd53ee606a47c3995f2eb245bdc
Instruction ID: bd0a2a167f11c15bff91ecacebe5fd50ffbe98bd5735a06bc675e3bb5e177760
Opcode Fuzzy Hash: 0e539773b435dbde7afbbe333bb4567307dd2dd53ee606a47c3995f2eb245bdc
Instruction Fuzzy Hash: 97516B71604705DFC704DF35C888A9ABBF4FF89358F108A2EE85A87711DB34A94ACB95

Function 6C5A1E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5A1EC1
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5A1EE1
EnterCriticalSection.KERNEL32(6C62E744), ref: 6C5A1F38
LeaveCriticalSection.KERNEL32(6C62E744), ref: 6C5A1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C5A1F83
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5A1FC0
EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5A1FE2
LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5A1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5A2019

Strings

Dbl, xrefs: 6C5A1F56
MOZ_CRASH(), xrefs: 6C5A2000
\bl, xrefs: 6C5A1F3E
Dbl, xrefs: 6C5A1F32

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: Dbl$Dbl$MOZ_CRASH()$\bl
API String ID: 2055633661-2003662670
Opcode ID: 624a4fefef57437f5626c32cda91aa8559df1c7042933f26c4fac25a862c1b57
Instruction ID: 4e0ba75fd7903f07b1a281ca017b0d8d97a2916a52963529a28721669fbcd374
Opcode Fuzzy Hash: 624a4fefef57437f5626c32cda91aa8559df1c7042933f26c4fac25a862c1b57
Instruction Fuzzy Hash: A041C171B003158BDF009FBACC84BAE7AB5FB8A389F010035E94597B40D7799805CBE9

Function 6C5C5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C5C56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5C56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C5C56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C5C5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C5C57BC
GetTickCount64.KERNEL32 ref: 6C5C58CB
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C58F3
__aulldiv.LIBCMT ref: 6C5C5945
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5C59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C62F638,?,?,?,?), ref: 6C5C59E9

Strings

MOZ_APP_RESTART, xrefs: 6C5C56CC

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 0fb087a3eccda5efbd4e006a42a2e99e911f5275acfb1365366cc89fe6ea0fbf
Instruction ID: 5d4250336862ad32119328bf52f3b7aa0fa4f5b3f69c3764172ffaa5b9fdd3ff
Opcode Fuzzy Hash: 0fb087a3eccda5efbd4e006a42a2e99e911f5275acfb1365366cc89fe6ea0fbf
Instruction Fuzzy Hash: 60C1AC31A083509FC705CFA9C880A6ABBF1FFDA754F458A1DE8C497620D734A885DB87

Function 6C5EEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EEC8C

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EECA1
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C5EECC5
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C5EED19
CloseHandle.KERNEL32(?), ref: 6C5EED28
free.MOZGLUE(00000000), ref: 6C5EED2F
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C5EEC94

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 03932673b80914f6dc77a8a821320a9a5a16bda0373f3da6a89e9143662c3add
Instruction ID: d2a060a07e2413237a826e5a00685c08ade598e3fbeb856d675adc263b216c20
Opcode Fuzzy Hash: 03932673b80914f6dc77a8a821320a9a5a16bda0373f3da6a89e9143662c3add
Instruction Fuzzy Hash: 6F213271600118EBCB008F65DC88AAA3779FFCA36CF104614FC1997741DBB99C068BAA

Function 6C5E8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C5AEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5AEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C5EB392,?,?,00000001), ref: 6C5E91F4

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

Strings

timeline-ipc, xrefs: 6C5E9096
marker-table, xrefs: 6C5E906C
timeline-memory, xrefs: 6C5E9088
timeline-overview, xrefs: 6C5E907A
data, xrefs: 6C5E90E8
name, xrefs: 6C5E8F16
timeline-fileio, xrefs: 6C5E90A4
marker-chart, xrefs: 6C5E905E
stack-chart, xrefs: 6C5E90B2

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 66b34a779770cf88fe151751ecec8b07e23c648dee18eb0bca85acedeea74e6d
Instruction ID: 361e60b774ad795e8b3c00c882d51a509c8a1154583b516d5c4c9052b10b1b90
Opcode Fuzzy Hash: 66b34a779770cf88fe151751ecec8b07e23c648dee18eb0bca85acedeea74e6d
Instruction Fuzzy Hash: F5B1B0B1A04209DBDB04CF99CCA6BEEBBB6AF88318F104429D401ABF80D7759D45CBD5

Function 6C5CC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5CC5A3
WideCharToMultiByte.KERNEL32 ref: 6C5CC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5CC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C5CCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5CCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5CCAA5

Strings

(null), xrefs: 6C5CC596
0, xrefs: 6C5CD30A

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 4e55850ca7fe2cc86b11bacc5fb59ae24ba90ea29ec8786a314fd6d938f94a8c
Instruction ID: 238b23af7ec283966682840a5b1c22be70c2c3009ccf85bec683c40507c2adb6
Opcode Fuzzy Hash: 4e55850ca7fe2cc86b11bacc5fb59ae24ba90ea29ec8786a314fd6d938f94a8c
Instruction Fuzzy Hash: A2A19A307083429FDB10DF69C98875ABBE1AF89748F04882DE99AD7741D735E809CB97

Function 6C5A3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C5A350E
__Init_thread_footer.LIBCMT ref: 6C5A3522
__aulldiv.LIBCMT ref: 6C5A3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5A3592

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C5A3508
kernel32.dll, xrefs: 6C5A34EA

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: b227b04fd828dc299030c3ba2133d002182e0b596c575e735fb8332e04328c0c
Instruction ID: cbbbbe47fd31ba4fa95100fc93d1585da9a89e9a3c0c38f7cf39bf8eae584c33
Opcode Fuzzy Hash: b227b04fd828dc299030c3ba2133d002182e0b596c575e735fb8332e04328c0c
Instruction Fuzzy Hash: EF319271B002159BDF00DFBACD88EAE77B5FB89305F100419E541936A0DB78E906CF55

Function 6C5A4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C5E4843,?), ref: 6C5A45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C5E4843,?), ref: 6C5A468A
free.MOZGLUE(?,?,?,?,?,?,6C5E4843,?), ref: 6C5A46C9
free.MOZGLUE(?), ref: 6C5A46EF
free.MOZGLUE(?), ref: 6C5A4712
free.MOZGLUE(?), ref: 6C5A4735
free.MOZGLUE(?), ref: 6C5A4758
free.MOZGLUE(?), ref: 6C5A477B
free.MOZGLUE(?), ref: 6C5A479E

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 956d6b742d20f446c37b415ad19da982a66a72e4f81addcce92daf969ff5cfc8
Instruction ID: b235b85f31c7b100b1b88b28b9a7c123636ee0a92927097124baa914d3a6f86f
Opcode Fuzzy Hash: 956d6b742d20f446c37b415ad19da982a66a72e4f81addcce92daf969ff5cfc8
Instruction Fuzzy Hash: 58B10571A001518FDB18CEFDDC9076D77A2AF86328F184668E416DBB92EB31DC428B91

Function 6C60AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C60AC52
CreateFileMappingW.KERNEL32 ref: 6C60AC7D
GetSystemInfo.KERNEL32 ref: 6C60AC98
MapViewOfFile.KERNEL32 ref: 6C60ACB0
GetSystemInfo.KERNEL32 ref: 6C60ACCD
MapViewOfFile.KERNEL32 ref: 6C60AD05
UnmapViewOfFile.KERNEL32 ref: 6C60AD1C
CloseHandle.KERNEL32 ref: 6C60AD28
UnmapViewOfFile.KERNEL32 ref: 6C60AD37
CloseHandle.KERNEL32 ref: 6C60AD43
CloseHandle.KERNEL32 ref: 6C60AD67

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: db92535dc816bf2cc27be4c1a3620d28a1d4facdf7d1cdd889fb3548a7a263bd
Instruction ID: bf8bfe9abb2f62120e484287ac4ed580bcf8d47285b516996b0da01be76345cb
Opcode Fuzzy Hash: db92535dc816bf2cc27be4c1a3620d28a1d4facdf7d1cdd889fb3548a7a263bd
Instruction Fuzzy Hash: 563190B1A043048FDB00AF7DD68826EBBF0FF85345F05892DE98697241EB749449CB86

Function 6C5B9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C5B9675
__Init_thread_footer.LIBCMT ref: 6C5B9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C5B96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C5B9707
__Init_thread_footer.LIBCMT ref: 6C5B971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9773

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C5B97B7
FreeLibrary.KERNEL32 ref: 6C5B97D0
FreeLibrary.KERNEL32 ref: 6C5B97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C5B9824

Strings

ntdll.dll, xrefs: 6C5B96E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C5B9670
NtMapViewOfSection, xrefs: 6C5B9701
MapViewOfFileNuma2, xrefs: 6C5B97B1

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 2fa055d8909f508fd37fc8ed104ceac4e62b06d4ec511a9ceff39ef535b1403e
Instruction ID: 726b85e24ac7c84d8d5ea3b8a1c7dda6cc5fca7ae0cf3e248580861b6cff9084
Opcode Fuzzy Hash: 2fa055d8909f508fd37fc8ed104ceac4e62b06d4ec511a9ceff39ef535b1403e
Instruction Fuzzy Hash: 2641A0756003169BDF00CFA6ECE4A977BB4EB8A354F114128ED55A7740D738E805CFAA

Function 6C5B7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5B7EA7
malloc.MOZGLUE(00000001), ref: 6C5B7EB3

Part of subcall function 6C5BCAB0: EnterCriticalSection.KERNEL32(?), ref: 6C5BCB49
Part of subcall function 6C5BCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C5BCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C5B7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C5B7F19
malloc.MOZGLUE(?), ref: 6C5B7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5B7F4D

Strings

d, xrefs: 6C5B7F89

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 675ea6bd66d6b45139d2589f8201d95b6ef2e13bff29204be089a5a19b7ed3bd
Instruction ID: 83313b412103125404552f21bd1eb796919a6c4a3b35b4f62e64ca8bac2aa9cd
Opcode Fuzzy Hash: 675ea6bd66d6b45139d2589f8201d95b6ef2e13bff29204be089a5a19b7ed3bd
Instruction Fuzzy Hash: 06312671E0438897DB019B39CC409FEB778EF96248F055229ED4967612FB34A988C398

Function 6C5F9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5F8273), ref: 6C5F9D65
free.MOZGLUE(6C5F8273,?), ref: 6C5F9D7C
free.MOZGLUE(?,?), ref: 6C5F9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C5F9E0F
free.MOZGLUE(6C5F946B,?,?), ref: 6C5F9E24
free.MOZGLUE(?,?,?), ref: 6C5F9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C5F9EC8
free.MOZGLUE(6C5F946B,?,?,?), ref: 6C5F9EDF
free.MOZGLUE(?,?,?,?), ref: 6C5F9EF5

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 787a0062091700d61be2b65576cfdc054fefc4eac589345f2f7d66a646773795
Instruction ID: 14cf36fab5c8c4ff030dd84be57df243b4357bda1339c2fbb0f3b53d882bc4a9
Opcode Fuzzy Hash: 787a0062091700d61be2b65576cfdc054fefc4eac589345f2f7d66a646773795
Instruction Fuzzy Hash: 1E719DB0A09B41CBC716CF58C88059AF3F4FF99314B84965DE95A9B701EB30E886CBD1

Function 6C5FDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C5FDDCF

Part of subcall function 6C5DFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5DFA4B

Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F90FF
Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDE0D
free.MOZGLUE(00000000), ref: 6C5FDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5FDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C5EDEFD,?,6C5B4A68), ref: 6C5FDF32

Part of subcall function 6C5FDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5FDB86
Part of subcall function 6C5FDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5FDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C5EDEFD,?,6C5B4A68), ref: 6C5FDF65
free.MOZGLUE(?), ref: 6C5FDF80

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: a93f226ff001548a579bb6d5680957d14381645c5c3d1099f92fa9ebc7e4e195
Instruction ID: e9d9f3a7715c3da00ed2307247d91099d61ff5c943ff41bb846aa0dd65ddfe1b
Opcode Fuzzy Hash: a93f226ff001548a579bb6d5680957d14381645c5c3d1099f92fa9ebc7e4e195
Instruction Fuzzy Hash: C451A3726016009BE7199F28CC806AEB376AFD1308F95051CDA2A53B00DB31F91BCF96

Function 6C605D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605DC9
std::_Facet_Register.LIBCPMT ref: 6C605DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C605C8C,?,6C5DE829), ref: 6C605E45

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 871dac4c81d3ed0953dd66f54eddc66779fee5913753c2f61b4aebdab8ac5640
Instruction ID: e30331564348a2ea0243372d30cab556a56615624ce3625c0d870351296d7690
Opcode Fuzzy Hash: 871dac4c81d3ed0953dd66f54eddc66779fee5913753c2f61b4aebdab8ac5640
Instruction Fuzzy Hash: 65417F307002058FCB14EF6AC9D8AAE77FAEF89314F044469D50AA7791DB34A805CB6D

Function 6C5DCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C5A31A7), ref: 6C5DCDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C5DCFA4, 6C5DCFB8
<jemalloc>, xrefs: 6C5DCF9F, 6C5DCFB3

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 59991e841da24b02a7d6701440c61c268d3e8a587b7c6203eb3020ac1d84045a
Instruction ID: 998e27ab659295d1e5994167c4859d8b0af2eea0761ea0fb29930de1b0c23f75
Opcode Fuzzy Hash: 59991e841da24b02a7d6701440c61c268d3e8a587b7c6203eb3020ac1d84045a
Instruction Fuzzy Hash: B031C770B403069BEF11AFAD8C85BAE7775EB81754F214015F611EBA80DB74F900CB99

Function 6C5AECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5AF100: LoadLibraryW.KERNEL32(shell32,?,6C61D020), ref: 6C5AF122
Part of subcall function 6C5AF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5AF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C5AED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5AEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C5AEDCC
CreateFileW.KERNEL32 ref: 6C5AEE08
free.MOZGLUE(00000000), ref: 6C5AEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C5AEE32

Part of subcall function 6C5AEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C5AEBB5
Part of subcall function 6C5AEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C5DD7F3), ref: 6C5AEBC3
Part of subcall function 6C5AEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C5DD7F3), ref: 6C5AEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C5AEDC1

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: ed7730c43932792132b6632c2cd87483b03c9e08a81952d9e3848b32a4ac58d0
Instruction ID: 98bbf4f3ef0777127e5ae27a845bd472b8300f5f5d205e968e16351221157966
Opcode Fuzzy Hash: ed7730c43932792132b6632c2cd87483b03c9e08a81952d9e3848b32a4ac58d0
Instruction Fuzzy Hash: 7551D071D05204CBDB00DFAACC806EEB7B1AF99318F44892DE8556B740E770695ACBA2

Function 6C61A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C61A565

Part of subcall function 6C61A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C61A4BE
Part of subcall function 6C61A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C61A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C61A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C61A6B6

Strings

0, xrefs: 6C61A5FB
z, xrefs: 6C61A6AE

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 353ff2b689af6809951fbe571db2c758c231e7299376bf09e47aaffb2fa8d897
Instruction ID: 915c25c0bad6a613ca7e3937631c18ba55314a02d7f2e53d91269edd6a871d94
Opcode Fuzzy Hash: 353ff2b689af6809951fbe571db2c758c231e7299376bf09e47aaffb2fa8d897
Instruction Fuzzy Hash: 4241357190C7459FC341DF28C480A8EBBE5BF89354F409A2EF49987651EB30EA49CB86

Function 6C5E9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
__Init_thread_footer.LIBCMT ref: 6C5E949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C5E947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C5E9459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C5E946B

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 289ca0ae295a1d3219f54df93742441ce228b5671d617e7840185ce4a8ec480a
Instruction ID: 0081f0393451ff0e005ba07dd94fe2a75616aa04fe90c0196bb49f527cd3ec27
Opcode Fuzzy Hash: 289ca0ae295a1d3219f54df93742441ce228b5671d617e7840185ce4a8ec480a
Instruction Fuzzy Hash: EA012430A0021197E7009B6EDC80A8A33B5AF4A329F040536ED0AC6F42E67BE8558D5F

Function 6C5AB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB6AC

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C5AB61E), ref: 6C5AB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C5AB61E,?,?,?,?,?,00000000), ref: 6C5AB79A

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 86040440a6b5a666add629f8f4769de8ca988bcfd99eaa29ce1d05a203c244f9
Instruction ID: 0eaa3da87508b8389fc69d7f1b5e92b83b5973571bb3e035c648cbd8645011f0
Opcode Fuzzy Hash: 86040440a6b5a666add629f8f4769de8ca988bcfd99eaa29ce1d05a203c244f9
Instruction Fuzzy Hash: 7D41D4B2D001199FCB00EFA9DC805AEB7B5FB85324F250629E825E7790E771AD0587D1

Function 6C61B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C61B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C61B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C61B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C61B5F4
__Init_thread_footer.LIBCMT ref: 6C61B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C61B61F
std::_Facet_Register.LIBCPMT ref: 6C61B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C61B655

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: f2ec8b70b07684d4cf0f0aab25e2cf4280ae7eefacb04037f4dbbeb477f763e5
Instruction ID: 1f71f04cfe6d1d077e6d6df7f400f5cb3e6d9534b9819a13942ab196e849e7cb
Opcode Fuzzy Hash: f2ec8b70b07684d4cf0f0aab25e2cf4280ae7eefacb04037f4dbbeb477f763e5
Instruction Fuzzy Hash: 11318471B00214CBCB10DF6AC8949EEB7F5EBCA325F150929D90697740DB38A806CF9A

Function 6C5E6590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DFA80: GetCurrentThreadId.KERNEL32 ref: 6C5DFA8D
Part of subcall function 6C5DFA80: AcquireSRWLockExclusive.KERNEL32(6C62F448), ref: 6C5DFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5E6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C5E67C8

Part of subcall function 6C5F4290: memcpy.VCRUNTIME140(?,?,6C602003,6C600AD9,?,6C600AD9,00000000,?,6C600AD9,?,00000004,?,6C601A62,?,6C602003,?), ref: 6C5F42C4

Strings

data, xrefs: 6C5E6593
vbl, xrefs: 6C5E696C

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vbl
API String ID: 511789754-1095404901
Opcode ID: 369c71a260fe7e67a1b24390b5a4041e21f86be7599bc09608e447d5c260b9fa
Instruction ID: 76854d40968107d371606e8cdc04344036de73bd22231d81875b052ce1f557d6
Opcode Fuzzy Hash: 369c71a260fe7e67a1b24390b5a4041e21f86be7599bc09608e447d5c260b9fa
Instruction Fuzzy Hash: 40D1CE75A08340CFD724DF29C851B9FB7E6AFC9348F10492DE59997B91EB30A809CB52

Function 6C5DD5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C5AEB57,?,?,?,?,?,?,?,?,?), ref: 6C5DD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C5AEB57,?), ref: 6C5DD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C5AEB57,?), ref: 6C5DD673
free.MOZGLUE(?), ref: 6C5DD888

Strings

|Enabled, xrefs: 6C5DD81E
WZl, xrefs: 6C5DD5D9, 6C5DD63F

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: WZl$|Enabled
API String ID: 4142949111-2253591229
Opcode ID: 0c7a8bfe7889f99ca0d2cb1a05a9465906010ae34b1be3c1af2b93e896d3b131
Instruction ID: 94e8c673f1f9dabd18c86c782d384f36b3bf29acdf5d5246b29ac01ef2c475ae
Opcode Fuzzy Hash: 0c7a8bfe7889f99ca0d2cb1a05a9465906010ae34b1be3c1af2b93e896d3b131
Instruction Fuzzy Hash: 06A1F0B0A00308DFDB11CF69C8D0BAEBBF1AF49318F15845CD889AB741D735A885CBA5

Function 6C5F1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5F1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C5F1BE3,?,?,6C5F1D96,00000000), ref: 6C5F1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C5F1BE3,?,?,6C5F1D96,00000000), ref: 6C5F1D4C
GetCurrentThreadId.KERNEL32 ref: 6C5F1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C5F1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C5F1DDA

Part of subcall function 6C5F1EF0: GetCurrentThreadId.KERNEL32 ref: 6C5F1F03
Part of subcall function 6C5F1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C5F1DF2,00000000,00000000), ref: 6C5F1F0C
Part of subcall function 6C5F1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C5F1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C5F1DF4

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: b6d7287b3a40ddc3ce9e4fc848ef94815a84db91f4ef79f460e7ce6af70260b7
Instruction ID: 9a471be08b50e03592e8f6c06e79911b50f8685a6c83a424bdf97b2465dc7a99
Opcode Fuzzy Hash: b6d7287b3a40ddc3ce9e4fc848ef94815a84db91f4ef79f460e7ce6af70260b7
Instruction Fuzzy Hash: 704159B52007009FCB14DF29C888A56BBF9FB89354F10442DE99A87B41CB75F855CBA5

Function 6C5E84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E85AC

Part of subcall function 6C5E7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5E85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E767F
Part of subcall function 6C5E7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5E85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E7693
Part of subcall function 6C5E7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5E85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5E85B2

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 3618939d2246d539879c1c169ea646ce8a789ed37bdf003004a6aa54b5a21095
Instruction ID: b652a571e6f515641b9c497483492db018b07d393e4d3211ba346c22e8bc3285
Opcode Fuzzy Hash: 3618939d2246d539879c1c169ea646ce8a789ed37bdf003004a6aa54b5a21095
Instruction Fuzzy Hash: 61218375200601AFEB14DB29CC88A5AB7B5AF8830CF14482DE55BC3B42DB35F948CB96

Function 6C5B1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C5B1699
VerSetConditionMask.NTDLL ref: 6C5B16CB
VerSetConditionMask.NTDLL ref: 6C5B16D7
VerSetConditionMask.NTDLL ref: 6C5B16DE
VerSetConditionMask.NTDLL ref: 6C5B16E5
VerSetConditionMask.NTDLL ref: 6C5B16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C5B16F9

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: b6f42de132c7c570b1acc8af22459d86b432da717e7c0a9fdf9f8d92dba5dab6
Instruction ID: d7b8fea4e3683e935f6ab4b0026390d715965b0081423ffdbe60eb39ebaa007a
Opcode Fuzzy Hash: b6f42de132c7c570b1acc8af22459d86b432da717e7c0a9fdf9f8d92dba5dab6
Instruction Fuzzy Hash: 9321E4B07442086BEB116E69CC85FFBB77CEFC6704F004528F645AB5C0C6799D548BA5

Function 6C5EF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C5EF598), ref: 6C5EF621

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EF637
AcquireSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF645
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C5EF62A

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 69fbacff4da7f0a93362dcaa94a33f23be06b897f07cb4d8d1ce540091deff6d
Instruction ID: d740527415803baead367260ccc54a38db26fffedb8bb9903df7e10db01e0423
Opcode Fuzzy Hash: 69fbacff4da7f0a93362dcaa94a33f23be06b897f07cb4d8d1ce540091deff6d
Instruction Fuzzy Hash: 7611C471201204EBCB04AF1ADC849D57779FFCA768F500416EA0687F42CB79AC11CFA9

Function 6C6076C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C6076F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C607705

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C607717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C60778F,00000000,00000000,00000000,00000000), ref: 6C607731
free.MOZGLUE(00000000), ref: 6C607760

Strings

}>^l, xrefs: 6C6076C4

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>^l
API String ID: 2538299546-4141363822
Opcode ID: 02ea93f5d8dae6cc70c534ca2b7b28a8e68b0bddd1472283d0ac95af12868c13
Instruction ID: 3893732f0238d377a58bf1b99782178f79b1b980dc362e957950ebf602c93efd
Opcode Fuzzy Hash: 02ea93f5d8dae6cc70c534ca2b7b28a8e68b0bddd1472283d0ac95af12868c13
Instruction Fuzzy Hash: FF11C8B1A05215ABD710AFB69D44BAB7EF8EF86354F144429F848E7300E7719C4087F6

Function 6C5B0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DAB89: EnterCriticalSection.KERNEL32(6C62E370,?,?,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284), ref: 6C5DAB94
Part of subcall function 6C5DAB89: LeaveCriticalSection.KERNEL32(6C62E370,?,6C5A34DE,6C62F6CC,?,?,?,?,?,?,?,6C5A3284,?,?,6C5C56F6), ref: 6C5DABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C5DD9F0,00000000), ref: 6C5B0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C5B0F3C
__Init_thread_footer.LIBCMT ref: 6C5B0F50
FreeLibrary.KERNEL32(?,6C5DD9F0,00000000), ref: 6C5B0F86

Strings

combase.dll, xrefs: 6C5B0F18
CoInitializeEx, xrefs: 6C5B0F36

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: a7cee45d4ec562646d864cf8a1148395bd84483e521c1bae9e1d3e78dda1bc79
Instruction ID: fdb6274280e0f1f393e42948ae0343e7f380d4eda2ee25400c2213caffb89feb
Opcode Fuzzy Hash: a7cee45d4ec562646d864cf8a1148395bd84483e521c1bae9e1d3e78dda1bc79
Instruction Fuzzy Hash: 1D117774705250DBDF00CF6ACE98E563B74FBD6356F00452AE905B2A40D73DA405CE5E

Function 6C5EF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5EF561

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EF577
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF585
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EF5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C5EF56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C5EF3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6C5EF499
[I %d/%d] profiler_resume, xrefs: 6C5EF239

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 3c2e8acc4c31766ecfc975ffcc8cefc4c1e6c627542a3f463756e48522c68cc4
Instruction ID: 03265f08b4a00b757ebf81af91c979ad22f8070b296c73ce3a419070fe799b41
Opcode Fuzzy Hash: 3c2e8acc4c31766ecfc975ffcc8cefc4c1e6c627542a3f463756e48522c68cc4
Instruction Fuzzy Hash: 96F054B6600214DBDB106F66DC8899A77BDFFCA2ADF100415EA4683702DB795C05CB79

Function 6C5B0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C5B0DF8), ref: 6C5B0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C5B0EA1
__Init_thread_footer.LIBCMT ref: 6C5B0EB5
FreeLibrary.KERNEL32 ref: 6C5B0EC5

Strings

kernel32.dll, xrefs: 6C5B0E7D
GetProcessMitigationPolicy, xrefs: 6C5B0E9B

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 8a41818a3f56e7a280dc361170db04a4a59b64484cd9ec0752716f28a7af0ae1
Instruction ID: 1338323c2aa967b18e730aef20f6ff9aa4f5ce6327b88b9390b08b796e755f94
Opcode Fuzzy Hash: 8a41818a3f56e7a280dc361170db04a4a59b64484cd9ec0752716f28a7af0ae1
Instruction Fuzzy Hash: 99012CB0700391CBDB009FAAEAE4B523BB5E786715F100526ED81A2B40D778F4058E0F

Function 6C5EF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C5B4A68), ref: 6C5E945E
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C5E9470
Part of subcall function 6C5E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C5E9482
Part of subcall function 6C5E9420: __Init_thread_footer.LIBCMT ref: 6C5E949F

GetCurrentThreadId.KERNEL32 ref: 6C5EF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C5EF598), ref: 6C5EF621

Part of subcall function 6C5E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5E94EE
Part of subcall function 6C5E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C5E9508

GetCurrentThreadId.KERNEL32 ref: 6C5EF637
AcquireSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF645
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8,?,?,00000000,?,6C5EF598), ref: 6C5EF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C5EF62A

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 8a7f11ead181df86cb2777e4ba332622f2531f251d4c97163218a775b05a5fa2
Instruction ID: b5152233cb28f46531ffb5a9e07f26628ce8b2b510106d1e6375e3429f58e837
Opcode Fuzzy Hash: 8a7f11ead181df86cb2777e4ba332622f2531f251d4c97163218a775b05a5fa2
Instruction Fuzzy Hash: 5DF054B5200214EBDB006F66DC8899A777DFFCA2ADF100415EA4683742CB7D5C068B79

Function 6C5E05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C5DCFAE,?,?,?,6C5A31A7), ref: 6C5E05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C5DCFAE,?,?,?,6C5A31A7), ref: 6C5E0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C5A31A7), ref: 6C5E061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C5A31A7), ref: 6C5E0627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C5E061B, 6C5E0625
<jemalloc>, xrefs: 6C5E05FA, 6C5E060F

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 1eb7e58eecf85674e7aecac0d09b90099c4523d2296cb72b96c586a10a3ddd04
Instruction ID: c4a98a956f55f95e307f566df6d2a84d968cb2cab198701521c56181794086b4
Opcode Fuzzy Hash: 1eb7e58eecf85674e7aecac0d09b90099c4523d2296cb72b96c586a10a3ddd04
Instruction Fuzzy Hash: 89E08CE2A0505037F614625AAC86DBB761CDBC6134F080039FE0E83701E94AAD1A91FA

Function 6C5B05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68d604123b8c700eab54a0339abaf282b528aaab9a3049d03e3def920749ec1
Instruction ID: 71b87c169bac8725c5fed277119e8e624a08bb25e853a94f434066c43cba1a7e
Opcode Fuzzy Hash: b68d604123b8c700eab54a0339abaf282b528aaab9a3049d03e3def920749ec1
Instruction Fuzzy Hash: 95A139B0A00745CFDB14CF29CA94A9AFBF1BF89304F54866ED44AA7B00E735A945CF90

Function 6C6014A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C6014C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C6014E2
GetCurrentThreadId.KERNEL32 ref: 6C601546
InitializeConditionVariable.KERNEL32(?), ref: 6C6015BA
free.MOZGLUE(?), ref: 6C6016B4

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 44048b429ea6754209735bae832411f7e40f69ccb4947dfeba277eceffb089cc
Instruction ID: 3b85694a2f6a8376f6868fcd50267b928d270214ee3f971a7a68f408e6e03eb1
Opcode Fuzzy Hash: 44048b429ea6754209735bae832411f7e40f69ccb4947dfeba277eceffb089cc
Instruction Fuzzy Hash: BF610F71A00710DBCB268F25CD80BDAB7B0BF8A308F44851CED8A67701DB35E949CB96

Function 6C5FDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5FDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C5FD38A,?), ref: 6C5FDC6F
free.MOZGLUE(?,?,?,?,?,6C5FD38A,?), ref: 6C5FDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C5FD38A,?), ref: 6C5FDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C5FD38A,?), ref: 6C5FDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C5FD38A,?), ref: 6C5FDD4A

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: c08c1ccf4efd4da386da43b8dcadabfca917e8693be9ecacc61973521901cc57
Instruction ID: 2d63cb209887d0d031ff30217980f1014a49cbd843916cfc64a0fb1d48de12b9
Opcode Fuzzy Hash: c08c1ccf4efd4da386da43b8dcadabfca917e8693be9ecacc61973521901cc57
Instruction Fuzzy Hash: 64417CB5A00205CFCB04CF99C880A9AB7F5FF88314B654569D956ABB10D731FC01CFA0

Function 6C5DF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C5DF480

Part of subcall function 6C5AF100: LoadLibraryW.KERNEL32(shell32,?,6C61D020), ref: 6C5AF122
Part of subcall function 6C5AF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C5AF132

CloseHandle.KERNEL32(00000000), ref: 6C5DF555

Part of subcall function 6C5B14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C5B1248,6C5B1248,?), ref: 6C5B14C9
Part of subcall function 6C5B14B0: memcpy.VCRUNTIME140(?,6C5B1248,00000000,?,6C5B1248,?), ref: 6C5B14EF

Part of subcall function 6C5AEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C5AEEE3

CreateFileW.KERNEL32 ref: 6C5DF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C5DF523

Strings

\oleacc.dll, xrefs: 6C5DF4CB

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: c66cd70beb3a11533f2396de786440cd85da727da81c3c71a35881a7fac4d29a
Instruction ID: 2134da9321acfbda9a6b5df98b8c6eeec316a76fa6e4674f37b20f2ee9753eb0
Opcode Fuzzy Hash: c66cd70beb3a11533f2396de786440cd85da727da81c3c71a35881a7fac4d29a
Instruction Fuzzy Hash: EA41BA30618710DFE720DF69CC84A9BB7F4AF84318F100B1CE59193650EB34E94A8B9A

Function 6C6074A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C607526
__Init_thread_footer.LIBCMT ref: 6C607566
__Init_thread_footer.LIBCMT ref: 6C607597

Strings

kernel32.dll, xrefs: 6C607557
UnmapViewOfFile2, xrefs: 6C607552

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 12ed108610144c713255777905cc7c91f160965193f830e781cbc563a19931d7
Instruction ID: abee23426f78951740b87518bf1671cb3da709acbfaca3211ca65716baa6f17a
Opcode Fuzzy Hash: 12ed108610144c713255777905cc7c91f160965193f830e781cbc563a19931d7
Instruction Fuzzy Hash: 6421253170061097DB188FAAAA84EDA3375EB86325F010528D84567F80DB39A8028E9F

Function 6C60C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C60C0E9), ref: 6C60C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C60C437
FreeLibrary.KERNEL32(?,6C60C0E9), ref: 6C60C44C

Strings

ntdll.dll, xrefs: 6C60C413
NtQueryVirtualMemory, xrefs: 6C60C431

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 9786a22231714566ad89453b8477d514271840b62303c6b74f073385d70dd9da
Instruction ID: 9bdf78e303547c56877abce20579eb2b07751252da307d4fe5d1ae9b2055ef5d
Opcode Fuzzy Hash: 9786a22231714566ad89453b8477d514271840b62303c6b74f073385d70dd9da
Instruction Fuzzy Hash: 64E0B678705311ABEF007F77CA98711BBF8FB46745F044516EA4699611EBBCC0028B5E

Function 6C6075B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C60748B,?), ref: 6C6075B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C6075D7
FreeLibrary.KERNEL32(?,6C60748B,?), ref: 6C6075EC

Strings

ntdll.dll, xrefs: 6C6075B3
RtlNtStatusToDosError, xrefs: 6C6075D1

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: edb1749e390b4be92fdac12a7fd3b620272018227304aea8c2a7108f2e7090df
Instruction ID: c8448132604f243b271b620274f46711ab7fba1cf273f0736a59eaadb12b623c
Opcode Fuzzy Hash: edb1749e390b4be92fdac12a7fd3b620272018227304aea8c2a7108f2e7090df
Instruction Fuzzy Hash: 61E0BF71740316ABEF015FA3D9C8B917AF8EB46354F104025AA85D1610DBBC8042CF1E

Function 6C607600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C607592), ref: 6C607608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C607627
FreeLibrary.KERNEL32(?,6C607592), ref: 6C60763C

Strings

ntdll.dll, xrefs: 6C607603
NtUnmapViewOfSection, xrefs: 6C607621

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: c50f41736b222fb8bdfc8e6f55adab255a57dc6e94e1769dcded437e086ae5f8
Instruction ID: 76eaabeebaae48c1bf1af0d1b26e7578d3a3296fe20e66457df4eaae0a4f987c
Opcode Fuzzy Hash: c50f41736b222fb8bdfc8e6f55adab255a57dc6e94e1769dcded437e086ae5f8
Instruction Fuzzy Hash: 0CE0BF707113159BDF005FA7ED987517AB8F756399F004115EA86D1B10D7BD80018F1D

Function 6C60BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C60BE49), ref: 6C60BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C60BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C60BE49), ref: 6C60BF38
RtlReAllocateHeap.NTDLL ref: 6C60BF83
RtlFreeHeap.NTDLL(6C60BE49,00000000), ref: 6C60BFA6

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 0bc3f7afbeb5b46df42425df507de119598400cf998ed7dcacb9eaaf28e6282d
Instruction ID: aa62fd6b6df0c29ddb4edfcd6b88aeb2f0c78a734e05832788f608522ca5a7d4
Opcode Fuzzy Hash: 0bc3f7afbeb5b46df42425df507de119598400cf998ed7dcacb9eaaf28e6282d
Instruction Fuzzy Hash: 6B519171B002058FE718CF69CE80BAAB7A6FFC5314F298639D516A7B54D730F9068B94

Function 6C5F8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?,6C61D734), ref: 6C5F8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?,6C61D734), ref: 6C5F8EBF
free.MOZGLUE(?,?,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?), ref: 6C5F8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?,6C61D734), ref: 6C5F8F46
free.MOZGLUE(?,?,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?), ref: 6C5F8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5EB58D,?,?,?,?,?,?,?,6C61D734,?,?,?), ref: 6C5F8F8F

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 66e5875086ec4ed15332b0a4b85bb7aa4699b36b73c9d332b8a2c9ce6a595305
Instruction ID: 707bab24a3142175ac47226a82a74f39eeb8935633965fed151c006ef1f30dc7
Opcode Fuzzy Hash: 66e5875086ec4ed15332b0a4b85bb7aa4699b36b73c9d332b8a2c9ce6a595305
Instruction Fuzzy Hash: A25170B1A016168FEB18CF95DC8066EB3B2EF46318F15056AD526AB740E731F906CF92

Function 6C5A4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C5A4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C5A4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5A4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C5A4F1E

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: ef70baefcd1f4a79c3cf146ffaf1c455e5738f363828de04a5c09904f4d6ad2a
Instruction ID: 8db71d70037b96a812adfac1e322eb98cf1e01d7fdad1c259b9b80c8434714b1
Opcode Fuzzy Hash: ef70baefcd1f4a79c3cf146ffaf1c455e5738f363828de04a5c09904f4d6ad2a
Instruction Fuzzy Hash: CC41AE716087419FC705CFAAC88095FBBE4BF89344F109A2DF56687741DB30E95ACB92

Function 6C5B1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B15E7
free.MOZGLUE(?,?,?,?,?,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C5B152B,?,?,?,?,6C5B1248,?), ref: 6C5B1637

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: ae8c1c4aa4f5627fe729d6284e938991e374b3ced65b88ce2a870019a4f529a7
Instruction ID: 298714f61dcaf8340d150e5108cb3734292ae8fdebc9c09be1bbae8ce9459ab0
Opcode Fuzzy Hash: ae8c1c4aa4f5627fe729d6284e938991e374b3ced65b88ce2a870019a4f529a7
Instruction Fuzzy Hash: 5E31D872A001159BCB58CE78DD6146F7BA9FB863647340B2DE423EBBD4EB30D9148791

Function 6C60AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AD9D

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AE01
GetLastError.KERNEL32(?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C61E330,?,6C5CC059), ref: 6C60AE3D

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: bd90c4d9d40508a33d2fa221abd3e9182c25b2d8f9c6cc278f2466702305c998
Instruction ID: 980a8026e768077b496859377dbc78bdc61d82841d51bbf210238037fef54601
Opcode Fuzzy Hash: bd90c4d9d40508a33d2fa221abd3e9182c25b2d8f9c6cc278f2466702305c998
Instruction Fuzzy Hash: 563182B1A002159FDB14DF798D44AABB7F8EF49660F15483DE84AE7701E734E805CBA8

Function 6C605EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C61DCA0,?,?,?,6C5DE8B5,00000000), ref: 6C605F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C5DE8B5,00000000), ref: 6C605F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C5DE8B5,00000000), ref: 6C605F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C5DE8B5,00000000), ref: 6C605F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C5DE8B5,00000000), ref: 6C605FD6

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 4b5bf40d485bf47f4959bba8888fca314022499af2c53ea598304a17b11d3352
Instruction ID: bd21ee4c3a6a53e2151ce225b4ff387fd91c1c58f84c8595c3fa1cb1b9adebc2
Opcode Fuzzy Hash: 4b5bf40d485bf47f4959bba8888fca314022499af2c53ea598304a17b11d3352
Instruction Fuzzy Hash: F03117343006008FD714CF29C998A6ABBE5EF89318BA48958E5569B795CB39EC41CA88

Function 6C5AB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C5AB532
moz_xmalloc.MOZGLUE(?), ref: 6C5AB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5AB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C5AB57E
free.MOZGLUE(00000000), ref: 6C5AB58F

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 26c82cff55d224b855ead318601609220217c564d308f83e716aea7e01c42299
Instruction ID: 615f74b9e40e044e93b2782b79110fad6349ce3f82877c2fe91aebbf32c33f63
Opcode Fuzzy Hash: 26c82cff55d224b855ead318601609220217c564d308f83e716aea7e01c42299
Instruction Fuzzy Hash: D521DB71A001099BDB00DFA6CC40B6EBBB9FF86314F244129E914D7341F775D916C7A1

Function 6C606E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C606E78

Part of subcall function 6C606A10: InitializeCriticalSection.KERNEL32(6C62F618), ref: 6C606A68
Part of subcall function 6C606A10: GetCurrentProcess.KERNEL32 ref: 6C606A7D
Part of subcall function 6C606A10: GetCurrentProcess.KERNEL32 ref: 6C606AA1
Part of subcall function 6C606A10: EnterCriticalSection.KERNEL32(6C62F618), ref: 6C606AAE
Part of subcall function 6C606A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C606AE1
Part of subcall function 6C606A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C606B15
Part of subcall function 6C606A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C606B65
Part of subcall function 6C606A10: LeaveCriticalSection.KERNEL32(6C62F618,?,?), ref: 6C606B83

MozFormatCodeAddress.MOZGLUE ref: 6C606EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C606EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C606EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C606EFF

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 50d98cac459cfccf3c67f7a526e0e3f1d5ce9d81a6d58c0ffebf5efd701370ed
Instruction ID: 2960a748ebed22b2b26b84daa4be406dcfcf13ce8fc13f28adfc13edaaf1d4e0
Opcode Fuzzy Hash: 50d98cac459cfccf3c67f7a526e0e3f1d5ce9d81a6d58c0ffebf5efd701370ed
Instruction Fuzzy Hash: 1921B0B1A0421A8FCB14CF29D9C569E77F5EF84308F044039E809A7240EB349A998F96

Function 6C5E0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C5A3DEF), ref: 6C5E0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C5A3DEF), ref: 6C5E0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C5A3DEF), ref: 6C5E0DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C5E0D97, 6C5E0DBE
<jemalloc>, xrefs: 6C5E0D92, 6C5E0DB9

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 9897a67e32c292d9dd0389f8ff36613e324f03738bcd7d909ac20c2941b742be
Instruction ID: de3898b8ffebf8e652b2d2dd900d6d85fb15fefb494ee03f35de1a3f3ea6d7ad
Opcode Fuzzy Hash: 9897a67e32c292d9dd0389f8ff36613e324f03738bcd7d909ac20c2941b742be
Instruction Fuzzy Hash: 0BF0893178439423E72016665D0AB6A266DE7C6B65F344037F205DADC4DF98E800ABAD

Function 6C5F7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C5F75C4,?), ref: 6C5F762B

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C5F74D7,6C6015FC,?,?,?), ref: 6C5F7644
GetCurrentThreadId.KERNEL32 ref: 6C5F765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5F74D7,6C6015FC,?,?,?), ref: 6C5F7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5F74D7,6C6015FC,?,?,?), ref: 6C5F7677

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ac16d4d0d6f9beeaa3fbb56f12024aa09f9e55a9f530c3f4243e569b2ec277cb
Instruction ID: 1c75419332ee999be94102c42528ea51201a85dfbaf45b127cfcdbc58560bc9d
Opcode Fuzzy Hash: ac16d4d0d6f9beeaa3fbb56f12024aa09f9e55a9f530c3f4243e569b2ec277cb
Instruction Fuzzy Hash: B3F0C271E10745ABD7008F22C888676B778FFEB299F214316F94553601E7B4B5D18BD1

Function 6C5CD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCBE8: GetCurrentProcess.KERNEL32(?,6C5A31A7), ref: 6C5DCBF1
Part of subcall function 6C5DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C5A31A7), ref: 6C5DCBFA

EnterCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD4F2
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD50B

Part of subcall function 6C5ACFE0: EnterCriticalSection.KERNEL32(6C62E784), ref: 6C5ACFF6
Part of subcall function 6C5ACFE0: LeaveCriticalSection.KERNEL32(6C62E784), ref: 6C5AD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD52E
EnterCriticalSection.KERNEL32(6C62E7DC), ref: 6C5CD690
LeaveCriticalSection.KERNEL32(6C62E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C5DD1C5), ref: 6C5CD751

Strings

MOZ_CRASH(), xrefs: 6C5CD4BB

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 01c8af8999fa44f848580e7a7b5695c36d775f1fb278ff12e4fb0165670c9d1c
Instruction ID: 6073f7b52de7276c14624d6453a21e25677ccea06243d0b83af71556857c1beb
Opcode Fuzzy Hash: 01c8af8999fa44f848580e7a7b5695c36d775f1fb278ff12e4fb0165670c9d1c
Instruction Fuzzy Hash: D651FF71B047018FD314CF69C99471AB7F1EB89304F558A2ED9AAC7B84D774E840CB86

Function 6C5F4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5F4721

Strings

., xrefs: 6C5F476A
profiler-paused, xrefs: 6C5F46E4
-%llu, xrefs: 6C5F4733

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 02d2431436505ea390332891be45be20aafe35a8cb4bc334b1bae0802a016e4a
Instruction ID: fb0346b79a0459fbead43eeb43d10f9d903501105c760a2504206c716e89d68f
Opcode Fuzzy Hash: 02d2431436505ea390332891be45be20aafe35a8cb4bc334b1bae0802a016e4a
Instruction Fuzzy Hash: 22414871A047089BCB08DF7DDD9115EBBF5EF85344F10863EE865A7B41EB3498068B46

Function 6C5F46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C5F4721

Part of subcall function 6C5A4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C5E3EBD,00000017,?,00000000,?,6C5E3EBD,?,?,6C5A42D2), ref: 6C5A4444

Strings

., xrefs: 6C5F476A
profiler-paused, xrefs: 6C5F46E4
-%llu, xrefs: 6C5F4733

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 378382522e1ec86daa7a7dca2baba677621098ee0109571fd7a527e36f43e025
Instruction ID: bd26a1c4ab554642d0468cab29256e0184eeef609df12e389fb0870c63421e3d
Opcode Fuzzy Hash: 378382522e1ec86daa7a7dca2baba677621098ee0109571fd7a527e36f43e025
Instruction Fuzzy Hash: 13311471F052088BCB0CDF6DDC8129EBBE69B88314F15853EE9159BB41EB7499068B94

Function 6C5FB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5A4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C5E3EBD,6C5E3EBD,00000000), ref: 6C5A42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C5FB127), ref: 6C5FB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5FB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C5FB4E4

Strings

pid:, xrefs: 6C5FB4DE

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 4d883a7927769a94d0ee5f79526be02d1108bcdbba14c08db3a1fe8a43189b6b
Instruction ID: 8210f7f9c2f7351a1b93f7acc946bda6fccc1073beab081611a6374596c80917
Opcode Fuzzy Hash: 4d883a7927769a94d0ee5f79526be02d1108bcdbba14c08db3a1fe8a43189b6b
Instruction Fuzzy Hash: 8C311531A01204DBDB04EFA9DD84ADEB7B6FF44308F540529D86167A41E736E94ACFA1

Function 6C5EE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5EE577
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EE584
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5EE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C5EE8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C5EE826, 6C5EE850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C5EE777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C5EE722, 6C5EE750, 6C5EE7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C5EE655
MOZ_PROFILER_STARTUP, xrefs: 6C5EE5A1, 6C5EE5CC, 6C5EE5FF, 6C5EE62A

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 3c317313831570e106565cfa9fa440b4e86ef5be35e8101c9f864e57c54925fd
Instruction ID: 39bf27d9e90d1baac4db604af5e5dd37337d43ef41b55021859276a121b277f0
Opcode Fuzzy Hash: 3c317313831570e106565cfa9fa440b4e86ef5be35e8101c9f864e57c54925fd
Instruction Fuzzy Hash: 1411C431A04264DFCB009F1AC888B6DBBF4FFC9728F010519E88657651C7B8A805CFDA

Function 6C5F0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5F0CD5

Part of subcall function 6C5DF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C5DF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5F0D40
free.MOZGLUE ref: 6C5F0DCB

Part of subcall function 6C5C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C5C5EDB
Part of subcall function 6C5C5E90: memset.VCRUNTIME140(ew`l,000000E5,?), ref: 6C5C5F27
Part of subcall function 6C5C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C5C5FB2

free.MOZGLUE ref: 6C5F0DDD
free.MOZGLUE ref: 6C5F0DF2

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 504b796e02f183e61f8bbae3592099efa8b2155177eb0de756d9f0703ae93093
Instruction ID: bab8025a9aa4eb61a4ca4f50f68266641b337de3cd6190bcdedef839de4bc89f
Opcode Fuzzy Hash: 504b796e02f183e61f8bbae3592099efa8b2155177eb0de756d9f0703ae93093
Instruction Fuzzy Hash: F9411471A087809BD720CF29C48079AFBE5BFC9614F558A2EE8E887711D770A845CF92

Function 6C5FCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FCDA4

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

Part of subcall function 6C5FD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C5FCDBA,00100000,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FD158
Part of subcall function 6C5FD130: InitializeConditionVariable.KERNEL32(00000098,?,6C5FCDBA,00100000,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FCDC4

Part of subcall function 6C5F7480: ReleaseSRWLockExclusive.KERNEL32(?,6C6015FC,?,?,?,?,6C6015FC,?), ref: 6C5F74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FCECC

Part of subcall function 6C5BCA10: mozalloc_abort.MOZGLUE(?), ref: 6C5BCAA2

Part of subcall function 6C5ECB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C5FCEEA,?,?,?,?,00000000,?,6C5EDA31,00100000,?,?,00000000), ref: 6C5ECB57
Part of subcall function 6C5ECB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C5ECBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C5FCEEA,?,?), ref: 6C5ECBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C5EDA31,00100000,?,?,00000000,?), ref: 6C5FD058

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 336706cdab618bdd46f8368f0e60d53fd941aae7f6cb2a35e7dff3cc848d64ed
Instruction ID: 879e78360a411d97b5c7b7ac026dafbc59998bbc5e1c20b802ed3b57d85cdacb
Opcode Fuzzy Hash: 336706cdab618bdd46f8368f0e60d53fd941aae7f6cb2a35e7dff3cc848d64ed
Instruction Fuzzy Hash: CDD15D71A04B469FD718CF28C880B99F7E1BF89304F01866DD96987712EB71B965CF81

Function 6C5C5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C5C5D40
EnterCriticalSection.KERNEL32(6C62F688), ref: 6C5C5D67
__aulldiv.LIBCMT ref: 6C5C5DB4
LeaveCriticalSection.KERNEL32(6C62F688), ref: 6C5C5DED

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 5513bd98fd613ddc927b6412ee29fc264908e0a02818c448b4221dedbf3086f9
Instruction ID: 5cdf1b7ede26d27e5f716df1938b1e259e9392feb3a7d64ad937e06b9cdd4693
Opcode Fuzzy Hash: 5513bd98fd613ddc927b6412ee29fc264908e0a02818c448b4221dedbf3086f9
Instruction Fuzzy Hash: 54517071F002298FCF08CFE9C894AAEBBB2FB85304F59462DD811A7750C7346945CB96

Function 6C5ACDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5ACEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C5ACEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C5ACF4E

Strings

0, xrefs: 6C5ACF30

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 230bbc0868a276f63beadac7bbe13db63f8f980cb17d4d1d373b96ef5fa19e25
Instruction ID: 9bc5628d6ed544f5354486608e6306c92b10276516dd9477ed6ce8d75e82b65f
Opcode Fuzzy Hash: 230bbc0868a276f63beadac7bbe13db63f8f980cb17d4d1d373b96ef5fa19e25
Instruction Fuzzy Hash: BD512171A042568FCB01CF19C890AAABBB5EF99300F19859DD8595F752D732FD06CBE0

Function 6C5E6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C5E82BC,?,?), ref: 6C5E649B

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E64A9

Part of subcall function 6C5DFA80: GetCurrentThreadId.KERNEL32 ref: 6C5DFA8D
Part of subcall function 6C5DFA80: AcquireSRWLockExclusive.KERNEL32(6C62F448), ref: 6C5DFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5E653F
free.MOZGLUE(?), ref: 6C5E655A

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: c91f166382bd3fd64e812328528c3ca6b9b02fb0801c72a85dc99f542df670c6
Instruction ID: 990e4a6c5b7bfcdbecc680458b6d647096665b742da5f0d009d51041a66f46f4
Opcode Fuzzy Hash: c91f166382bd3fd64e812328528c3ca6b9b02fb0801c72a85dc99f542df670c6
Instruction Fuzzy Hash: 003181B5A043059FC704CF14D88069EBBE4FF89314F40442EE85A97741DB34E919CB96

Function 6C5BB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5BB4F5
AcquireSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5BB502
ReleaseSRWLockExclusive.KERNEL32(6C62F4B8), ref: 6C5BB542
free.MOZGLUE(?), ref: 6C5BB578

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 6c8c33785cffff9f3c0b5c1f49c5edde3ba4b1c13abb414c1d7437da26c0dbfe
Instruction ID: 87d1e21dcf8f64cb89cdc75139f47cafdca46d96d00ca8120aa426b6a3e84de6
Opcode Fuzzy Hash: 6c8c33785cffff9f3c0b5c1f49c5edde3ba4b1c13abb414c1d7437da26c0dbfe
Instruction Fuzzy Hash: 5C11F030A04B00C7C3118F2AC9807A5B7B0FFD6318F10570AD84A63A02FBF4B1C18B96

Function 6C5E3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C5AF20E,?), ref: 6C5E3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C5AF20E,00000000,?), ref: 6C5E3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C5E3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C5E3E0E

Part of subcall function 6C5DCC00: GetCurrentProcess.KERNEL32(?,?,6C5A31A7), ref: 6C5DCC0D
Part of subcall function 6C5DCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C5A31A7), ref: 6C5DCC16

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 3f6dc398444e0299e8487e662ba372cb2253b8dbdd644a3c1fa8dbc82e0f92dc
Instruction ID: 54c36f2300aacf374a4ab28a68a95182243e461c5d95669c4df6d6bd7a5cba32
Opcode Fuzzy Hash: 3f6dc398444e0299e8487e662ba372cb2253b8dbdd644a3c1fa8dbc82e0f92dc
Instruction Fuzzy Hash: EDF012715002087FD700AB55DC81DAB376DEB86624F050020FE0957741D739BD5596FB

Function 6C5F85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C5F85D3

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C5F8725

Strings

map/set<T> too long, xrefs: 6C5F8720

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 7954213cd4bf5f8f875848353130ec5044cfcfec0efe4781c7cf8047e94308f4
Instruction ID: 8744cc00671aabb540df735202770512f76d75cb83b376f8c0167df48dc31244
Opcode Fuzzy Hash: 7954213cd4bf5f8f875848353130ec5044cfcfec0efe4781c7cf8047e94308f4
Instruction Fuzzy Hash: 94516474600641CFC705CF1AC884B5ABBF1BF5A318F18C58AD8695BB52C335E886CF92

Function 6C5ABD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C5ABDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C5ABE8F

Strings

0, xrefs: 6C5ABE5B

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: d38659ef6fe135f32c4374614b163ab3a7426f08491927b20596be361a428308
Instruction ID: e1e1b2850043cf09a21d4318144441802e4d438342b90bb6193782944b4280db
Opcode Fuzzy Hash: d38659ef6fe135f32c4374614b163ab3a7426f08491927b20596be361a428308
Instruction Fuzzy Hash: 8C41B171909749CFC701DFBAC881A9FBBF4AF8A348F004A1DF98597611D730D94A8B92

Function 6C5E3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5E3D19
mozalloc_abort.MOZGLUE(?), ref: 6C5E3D6C

Strings

d, xrefs: 6C5E3D58

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: ebd837007defe26ee9175a32f96c61751019fd5b868ed50f368bb0e6bc04663f
Instruction ID: b3de1599416444cc140386dc4567eb343d23b19b8ce20dcefd6d08b4140a8cc1
Opcode Fuzzy Hash: ebd837007defe26ee9175a32f96c61751019fd5b868ed50f368bb0e6bc04663f
Instruction Fuzzy Hash: F3113431E04688D7DF018F6ECC444EDB775EFDA258F458229DC459B612EB34A984C390

Function 6C606DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C606E22
__Init_thread_footer.LIBCMT ref: 6C606E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C606E1D

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 2b9e3949eab14a6f7c4a3d4070d103ebb495d7a247e5e61090762738b71d2cca
Instruction ID: 024e4cc1d8689df441d8ceaff222fce83e046cd8f734c1fc08befb674e403705
Opcode Fuzzy Hash: 2b9e3949eab14a6f7c4a3d4070d103ebb495d7a247e5e61090762738b71d2cca
Instruction Fuzzy Hash: 26F0FA30309380CAEB008B69CAA0EC277729742B18F040165C80186FA1CA29F987CF9F

Function 6C5B9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C5B9EEF

Strings

NaN, xrefs: 6C5B9EC1
Infinity, xrefs: 6C5B9EB7

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 161d9af429ed195f77abd69af26fbab8466775acdb676d6d6b8bb88561346404
Instruction ID: fbaf3a5bb5981a9dc85788cc8266dce170ca99ea17aa831848620ec5fdbcdc7c
Opcode Fuzzy Hash: 161d9af429ed195f77abd69af26fbab8466775acdb676d6d6b8bb88561346404
Instruction Fuzzy Hash: E5F0A970600262CAEB008F1ADE96B823BF1A35371AF600E19D5041AB80D73E7946CF8F

Function 6C5B6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0K^l,?,6C5E4B30,80000000,?,6C5E4AB7,?,6C5A43CF,?,6C5A42D2), ref: 6C5B6C42

Part of subcall function 6C5BCA10: malloc.MOZGLUE(?), ref: 6C5BCA26

moz_xmalloc.MOZGLUE(0K^l,?,6C5E4B30,80000000,?,6C5E4AB7,?,6C5A43CF,?,6C5A42D2), ref: 6C5B6C58

Strings

0K^l, xrefs: 6C5B6C33, 6C5B6C41, 6C5B6C57

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0K^l
API String ID: 1967447596-3449559093
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 7730db33859605fa4891f2fc2e51ff307dea3b65e17dffbf0f658fc81488f961
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 74E026F1A103004ADB0CD8799C2A52A79C8CB352A87044A35E826F3BC8FF34F9408051

Function 6C5BBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C5BBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C5BBEF5

Strings

cryptbase.dll, xrefs: 6C5BBEF0

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: f304f89b7f1098ab588461850324c203061fffd6f79296763012e72f16054808
Instruction ID: 5a8e827c48539296f82e644b6e10bc4caaacba438bdb67aedd30e8c440003529
Opcode Fuzzy Hash: f304f89b7f1098ab588461850324c203061fffd6f79296763012e72f16054808
Instruction Fuzzy Hash: 99D0C731184208EAD740BA518D56B253B74E741755F10C421F79654961C7F5A451CF58

Function 6C5FB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C5FB2C9,?,?,?,6C5FB127,?,?,?,?,?,?,?,?,?,6C5FAE52), ref: 6C5FB628

Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F90FF
Part of subcall function 6C5F90E0: free.MOZGLUE(?,00000000,?,?,6C5FDEDB), ref: 6C5F9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C5FB2C9,?,?,?,6C5FB127,?,?,?,?,?,?,?,?,?,6C5FAE52), ref: 6C5FB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C5FB2C9,?,?,?,6C5FB127,?,?,?,?,?,?,?,?,?,6C5FAE52), ref: 6C5FB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C5FB127,?,?,?,?,?,?,?,?), ref: 6C5FB74D

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 64aa8345e48425a80c77f4c7ac13a772bebb3a794955cfacd32b6bbe6cc7de61
Instruction ID: b712c67391636e8cc1ced318c4a05d7d813e26569a77d797f07b665b612d7291
Opcode Fuzzy Hash: 64aa8345e48425a80c77f4c7ac13a772bebb3a794955cfacd32b6bbe6cc7de61
Instruction Fuzzy Hash: 6651BF71A06216CBDB18EF18CD8065EB7B5FF85304F55852DC86AAB700E731A806CFA1

Function 6C5F6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C5F6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C5F6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C5F6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5F6F5C

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 5cf9d2bf3d837c3957ea928ef843f79daedadce377f00d9fe1ca00bba72be87d
Instruction ID: fe99e3e7cc7026cdc591976d874872a8b6039d257af178db3d3df5153889b693
Opcode Fuzzy Hash: 5cf9d2bf3d837c3957ea928ef843f79daedadce377f00d9fe1ca00bba72be87d
Instruction Fuzzy Hash: FA31C571A1060A8FEB08CF2CCD806AA73E9EB85344F504639D52AC7655EF31E65ACB91

Function 6C60B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C5B0A4D), ref: 6C60B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C5B0A4D), ref: 6C60B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C5B0A4D), ref: 6C60B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C5B0A4D), ref: 6C60B67F

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 2db3bba7e13b4994be89daef076b27c93a3fa56044cfc655a27edf42c0c0bcd6
Instruction ID: c005816eac53de3db2f64862330d05e188912859335dcd8631030355d99441d6
Opcode Fuzzy Hash: 2db3bba7e13b4994be89daef076b27c93a3fa56044cfc655a27edf42c0c0bcd6
Instruction Fuzzy Hash: 4931D471A112168FEB14CF59C98465AFBB9FFC1304F16C569C806AB201DB31E915CBE5

Function 6C5DF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C5DF611
memcpy.VCRUNTIME140(?,?,?), ref: 6C5DF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C5DF652
memcpy.VCRUNTIME140(?,?,?), ref: 6C5DF668

Memory Dump Source

Source File: 00000000.00000002.2469975558.000000006C5A1000.00000020.00000001.01000000.00000008.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2469935667.000000006C5A0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470169805.000000006C61D000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470208016.000000006C62E000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000000.00000002.2470246607.000000006C632000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: f3efbb9df7ab69244732f3331dbab488b233a8e45ecd5aa99811ab534ae9bba5
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 35314F71A00314AFC714CF5DDCC0A9F77B5EB85358B188A39FA4A8BB05D632F9448B98

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Threatname: RedLine

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Stealing of Sensitive Information

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAFHIIDHJEBFBFIDAKFB

C:\ProgramData\AEGHCFIDAKJEBGCAFBAE

C:\ProgramData\AFIIIIJKFCAAECAKFIEH

C:\ProgramData\BAKEBAFI

C:\ProgramData\DAEGIDHD

C:\ProgramData\DHIDHIEGIIIECAKEBFBAAEBKFC

C:\ProgramData\ECBGCGCGIEGCBFHIIEBFCAFHIE

Windows Analysis Report
file.exe

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre