Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe
Analysis ID:	1483536
MD5:	28a85ba5396fcfa8a5f794f04dce35e4
SHA1:	c730d730e167d68a41a8382823c181ff9a75a891
SHA256:	d77fbaa35585f25de3f492e4e3d0bfa6f0f73b053fd6a64058766fef75eca04e
Tags:	exe
Infos:

Detection

PureLog Stealer

Score:	46
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	51
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected PureLog Stealer

Submitted sample is a known malware sample

.NET source code contains method to dynamically call methods (often used by packers)

Found direct / indirect Syscall (likely to bypass EDR)

Found evasive API chain (may stop execution after checking locale)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs Task Scheduler Managed Wrapper

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected Generic Downloader

Abnormal high CPU Usage

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to communicate with device drivers

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops certificate files (DER)

Enables debug privileges

Enables driver privileges

Enables security privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Stores large binary data to the registry

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Uses net.exe to stop services

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Keylogger Generic

query blbeacon for getting browser version

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe (PID: 7764 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe" MD5: 28A85BA5396FCFA8A5F794F04DCE35E4)

SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp (PID: 7824 cmdline: "C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp" /SL5="$20462,29086952,780800,C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe" MD5: C47A946F3D41363C77CA4C719516E49B)

prod0.exe (PID: 7188 cmdline: "C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe" -ip:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240727184154&is_silent=true&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100&b=&se=true" -vp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240727184154&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100&oip=26&ptl=7&dta=true" -dp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240727184154&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100" -i -v -d -se=true MD5: 36D1B7C42C37FF8217B07851D0C4C39A)

3yq4abxg.exe (PID: 5828 cmdline: "C:\Users\user\AppData\Local\Temp\3yq4abxg.exe" /silent MD5: 70FD2613E8171383FCB917E2F22B71A2)

UnifiedStub-installer.exe (PID: 7656 cmdline: .\UnifiedStub-installer.exe /silent MD5: C7FE1EB6A82B9FFAAF8DCA0D86DEF7CA)

rsSyncSvc.exe (PID: 3820 cmdline: "C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:10 MD5: CC7167823D2D6D25E121FC437AE6A596)

conhost.exe (PID: 4300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

saBSI.exe (PID: 7404 cmdline: "C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US MD5: 143255618462A577DE27286A272584E1)

WZSetup.exe (PID: 7584 cmdline: "C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe" /S /tpchannelid=1571 /distid=App123 MD5: 3C17F28CC001F6652377D3B5DEEC10F0)

WeatherZeroService.exe (PID: 7776 cmdline: "C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe" install MD5: 2B149BA4C21C66D34F19214D5A8D3067)

conhost.exe (PID: 2688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WeatherZeroService.exe (PID: 2756 cmdline: "C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe" start silent MD5: 2B149BA4C21C66D34F19214D5A8D3067)

conhost.exe (PID: 5744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

CheatEngine75.exe (PID: 2564 cmdline: "C:\Users\user\AppData\Local\Temp\is-H908U.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST MD5: E0F666FE4FF537FB8587CCD215E41E5F)

CheatEngine75.tmp (PID: 5672 cmdline: "C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp" /SL5="$901D6,26511452,832512,C:\Users\user\AppData\Local\Temp\is-H908U.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST MD5: 9AA2ACD4C96F8BA03BB6C3EA806D806F)

net.exe (PID: 1564 cmdline: "net" stop BadlionAntic MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

conhost.exe (PID: 3636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net1.exe (PID: 5488 cmdline: C:\Windows\system32\net1 stop BadlionAntic MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

net.exe (PID: 1928 cmdline: "net" stop BadlionAnticheat MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

conhost.exe (PID: 3116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net1.exe (PID: 2080 cmdline: C:\Windows\system32\net1 stop BadlionAnticheat MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)

sc.exe (PID: 2288 cmdline: "sc" delete BadlionAntic MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 2352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2852 cmdline: "sc" delete BadlionAnticheat MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 3712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

_setup64.tmp (PID: 3456 cmdline: helper 105 0x44C MD5: E4211D6D009757C078A9FAC7FF4F03D4)

conhost.exe (PID: 3524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

icacls.exe (PID: 4640 cmdline: "icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX) MD5: 48C87E3B3003A2413D6399EA77707F5D)

conhost.exe (PID: 4568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Kernelmoduleunloader.exe (PID: 4700 cmdline: "C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe" /SETUP MD5: 9AF96706762298CF72DF2A74213494C9)

windowsrepair.exe (PID: 5376 cmdline: "C:\Program Files\Cheat Engine 7.5\windowsrepair.exe" /s MD5: 9A4D1B5154194EA0C42EFEBEB73F318F)

icacls.exe (PID: 4216 cmdline: "icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX) MD5: 48C87E3B3003A2413D6399EA77707F5D)

conhost.exe (PID: 1668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Cheat Engine.exe (PID: 416 cmdline: "C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe" MD5: F921416197C2AE407D53BA5712C3930A)

cheatengine-x86_64-SSE4-AVX2.exe (PID: 4256 cmdline: "C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe" MD5: 910DE25BD63B5DA521FC0B598920C4EC)

rsSyncSvc.exe (PID: 4536 cmdline: "C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -bn:ReasonLabs -dt:10 MD5: CC7167823D2D6D25E121FC437AE6A596)

Uninstall.exe (PID: 7804 cmdline: "C:\Program Files\ReasonLabs\EPP\Uninstall.exe" /auto-repair=UnifiedStub MD5: 8157D03D4CD74D7DF9F49555A04F4272)

Stub.exe (PID: 7800 cmdline: "C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe" /products=epp /auto-repair=UnifiedStub MD5: 70FD2613E8171383FCB917E2F22B71A2)

UnifiedStub-installer.exe (PID: 7380 cmdline: .\UnifiedStub-installer.exe /products=epp /auto-repair=UnifiedStub MD5: C7FE1EB6A82B9FFAAF8DCA0D86DEF7CA)

Stub.exe (PID: 7880 cmdline: "C:\Users\user\AppData\Local\Temp\Stub.exe" /products=epp /auto-repair=UnifiedStub MD5: 70FD2613E8171383FCB917E2F22B71A2)

WeatherZeroService.exe (PID: 6924 cmdline: "C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe" MD5: 2B149BA4C21C66D34F19214D5A8D3067)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsTime.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsAtom.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsAtom.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsLogger.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsDatabase.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Program Files (x86)\WeatherZero\WeatherZero.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsAtom.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsDatabase.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsJSON.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsJSON.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsLogger.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsJSON.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsTime.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsTime.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsDatabase.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsLogger.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 11 entries

Memory Dumps

Source	Rule	Description	Author
0000002D.00000002.2185072195.000001FA16D82000.00000002.00000001.01000000.0000002A.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000002D.00000002.2186104264.000001FA16E9D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000B.00000002.3319865235.0000019B4C9D2000.00000002.00000001.01000000.00000031.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000B.00000002.3282773301.0000019B32872000.00000002.00000001.01000000.00000030.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000031.00000003.2235185447.0000000002E40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: cheatengine-x86_64-SSE4-AVX2.exe PID: 4256	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
32.3.Stub.exe.2ea9f48.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
49.3.Stub.exe.2ee1058.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.UnifiedStub-installer.exe.19b4c9d0000.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.UnifiedStub-installer.exe.19b32870000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.3.3yq4abxg.exe.2ee1058.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.3.3yq4abxg.exe.2eb9f48.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
45.2.UnifiedStub-installer.exe.1fa16d80000.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
32.3.Stub.exe.2ed1058.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
49.3.Stub.exe.2eb9f48.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
49.3.Stub.exe.2e64ca4.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.3.3yq4abxg.exe.2ee1058.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
49.3.Stub.exe.2eb9f48.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
49.3.Stub.exe.2eb9f48.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.3.3yq4abxg.exe.2eb9f48.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
6.3.3yq4abxg.exe.2eb9f48.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
32.3.Stub.exe.2ea9f48.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
32.3.Stub.exe.2ea9f48.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
32.3.Stub.exe.2ed1058.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
49.3.Stub.exe.2ee1058.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
32.3.Stub.exe.2e54ca4.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
49.3.Stub.exe.2e40000.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.3.3yq4abxg.exe.2e64ca4.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.3.3yq4abxg.exe.2e40000.9.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
32.3.Stub.exe.2e30000.9.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 19 entries

Sigma Signatures

System Summary

Sigma detected: Net.exe Execution

Source: Process started

Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: "net" stop BadlionAntic, CommandLine: "net" stop BadlionAntic, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp" /SL5="$901D6,26511452,832512,C:\Users\user\AppData\Local\Temp\is-H908U.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST, ParentImage: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp, ParentProcessId: 5672, ParentProcessName: CheatEngine75.tmp, ProcessCommandLine: "net" stop BadlionAntic, ProcessId: 1564, ProcessName: net.exe

Sigma detected: Stop Windows Service Via Net.EXE

Source: Process started

Author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems): Data: Command: "net" stop BadlionAntic, CommandLine: "net" stop BadlionAntic, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp" /SL5="$901D6,26511452,832512,C:\Users\user\AppData\Local\Temp\is-H908U.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST, ParentImage: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp, ParentProcessId: 5672, ParentProcessName: CheatEngine75.tmp, ProcessCommandLine: "net" stop BadlionAntic, ProcessId: 1564, ProcessName: net.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.114.59.183 - Destination IP: 192.168.2.8

Timestamp:	2024-07-28T00:42:46.302134+0200
SID:	2022930
Source Port:	443
Destination Port:	49746
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET ADWARE_PUP Win32/OfferCore Checkin M2 - Source IP: 192.168.2.8 - Destination IP: 18.173.206.112

Timestamp:	2024-07-28T00:42:05.132066+0200
SID:	2053283
Source Port:	49713
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.8 - Destination IP: 146.185.153.16

Timestamp:	2024-07-28T00:43:08.257538+0200
SID:	2803305
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ETPRO MALWARE Common Downloader Header Pattern H - Source IP: 192.168.2.8 - Destination IP: 146.185.153.16

Timestamp:	2024-07-28T00:43:07.054429+0200
SID:	2803305
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	Unknown Traffic

ET ADWARE_PUP Win32/OfferCore Checkin M2 - Source IP: 192.168.2.8 - Destination IP: 18.173.206.112

Timestamp:	2024-07-28T00:41:56.746449+0200
SID:	2053283
Source Port:	49707
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET ADWARE_PUP Win32/OfferCore Checkin M2 - Source IP: 192.168.2.8 - Destination IP: 18.173.206.112

Timestamp:	2024-07-28T00:42:36.134525+0200
SID:	2053283
Source Port:	49728
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET ADWARE_PUP Win32/OfferCore Checkin M2 - Source IP: 192.168.2.8 - Destination IP: 18.173.206.112

Timestamp:	2024-07-28T00:42:03.851118+0200
SID:	2053283
Source Port:	49712
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET ADWARE_PUP Win32/OfferCore Checkin M2 - Source IP: 192.168.2.8 - Destination IP: 18.173.206.112

Timestamp:	2024-07-28T00:42:00.673154+0200
SID:	2053283
Source Port:	49710
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET ADWARE_PUP Win32/OfferCore Checkin M2 - Source IP: 192.168.2.8 - Destination IP: 18.173.206.112

Timestamp:	2024-07-28T00:42:34.298833+0200
SID:	2053283
Source Port:	49725
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET ADWARE_PUP Win32/OfferCore Checkin M2 - Source IP: 192.168.2.8 - Destination IP: 18.173.206.112

Timestamp:	2024-07-28T00:42:31.158635+0200
SID:	2053283
Source Port:	49723
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow - Source IP: 20.114.59.183 - Destination IP: 192.168.2.8

Timestamp:	2024-07-28T00:42:08.010918+0200
SID:	2022930
Source Port:	443
Destination Port:	49715
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET ADWARE_PUP Win32/OfferCore Checkin M2 - Source IP: 192.168.2.8 - Destination IP: 18.173.206.112

Timestamp:	2024-07-28T00:42:54.309052+0200
SID:	2053283
Source Port:	49750
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET ADWARE_PUP Win32/OfferCore Checkin M2 - Source IP: 192.168.2.8 - Destination IP: 18.173.206.112

Timestamp:	2024-07-28T00:42:02.064048+0200
SID:	2053283
Source Port:	49711
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.8 - Destination IP: 104.20.94.94

Timestamp:	2024-07-28T00:43:12.900165+0200
SID:	2803274
Source Port:	49763
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ETPRO MALWARE Common Downloader Header Pattern UH - Source IP: 192.168.2.8 - Destination IP: 104.20.94.94

Timestamp:	2024-07-28T00:43:11.985969+0200
SID:	2803274
Source Port:	49761
Destination Port:	443
Protocol:	TCP
Classtype:	Potentially Bad Traffic

ET ADWARE_PUP Win32/OfferCore Checkin M1 - Source IP: 192.168.2.8 - Destination IP: 18.173.206.112

Timestamp:	2024-07-28T00:41:55.357573+0200
SID:	2053280
Source Port:	49706
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe

ReversingLabs: Detection: 47%

Cryptography

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F314F0 CryptMsgGetParam,CryptMsgGetParam,CryptMsgGetParam,CryptMsgGetParam,CertGetSubjectCertificateFromStore,CryptMsgGetParam,CertFreeCRLContext,CertFreeCRLContext,	5_2_00F314F0
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F317A0 CryptQueryObject,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CryptQueryObject,CryptMsgClose,CertCloseStore,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,	5_2_00F317A0
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00EE5870 GetCurrentProcessId,GetCurrentThreadId,CreateFileW,CreateFileW,CreateFileW,CreateFileW,CreateFileW,CreateFileW,UuidCreate,UuidCreate,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	5_2_00EE5870
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00EE6220 GetCurrentProcessId,GetCurrentThreadId,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,DeviceIoControl,DeviceIoControl,	5_2_00EE6220
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F1E610 CryptMsgClose,	5_2_00F1E610
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00EE67B0 GetCurrentProcessId,GetCurrentThreadId,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,DeviceIoControl,DeviceIoControl,	5_2_00EE67B0
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F1EB60 CryptQueryObject,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,CryptQueryObject,CryptMsgClose,CryptMsgClose,CertCloseStore,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CryptMsgClose,CertCloseStore,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,CryptMsgClose,CertCloseStore,	5_2_00F1EB60
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F1F150 CryptMsgGetParam,CryptMsgGetParam,CryptMsgGetParam,CertGetSubjectCertificateFromStore,CertFreeCRLContext,	5_2_00F1F150
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F1F3C0 CryptMsgGetParam,CryptMsgGetParam,CryptMsgGetParam,CertGetSubjectCertificateFromStore,CertGetNameStringW,CertGetNameStringW,CertGetCertificateChain,CertFreeCertificateChain,CertFreeCertificateChain,CertVerifyCertificateChainPolicy,CertFreeCertificateChain,CertFreeCRLContext,CertFreeCRLContext,	5_2_00F1F3C0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF7824D14A0 CryptQueryObject,GetLastError,CryptMsgGetParam,GetLastError,LocalAlloc,CryptMsgGetParam,GetLastError,CertFindCertificateInStore,GetLastError,CertGetNameStringW,CertGetNameStringW,LocalFree,CertFreeCertificateContext,CertCloseStore,CryptMsgClose,	25_2_00007FF7824D14A0

Compliance

Uses 32bit PE files

Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Creates a directory in C:\Program Files

Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Stub
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\Uninstall.exe
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\unins000.dat
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-1U45L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-KLETU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-MV96K.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-1HAUB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-04JI4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-R767B.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-APHCK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-UJMF9.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-OUQ5Q.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\win32
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\win32\is-OH84O.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\win64
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\win64\is-F9V6M.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\win32\is-A3GKJ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\win64\is-356FE.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\win32\is-7KKVU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\win64\is-HNC5I.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-SBH22.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-VP6HP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-AJB6K.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-4H8E2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-IM0FE.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-TTU3J.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-JBLAJ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-PP0OR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-OQMOE.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-7TSFI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-RKO1I.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-8G4IN.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-A5OSQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-7DIKH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-FC05A.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-ERBSE.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-27N0B.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-LR956.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-L3GJI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-AATAN.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-RUAAP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-MRM89.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-81GE3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-7NK6B.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-76J7R.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\tcclib
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\tcclib\lib
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\tcclib\lib\is-23JOJ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\tcclib\is-V0OQK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\tcclib\is-K56C1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\tcclib\is-47N79.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-9UL4R.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-4232T.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-0PACH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-S6USS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-KITFQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-7UMKO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-INTCK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-MKK0B.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-51LG7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-5BN1Q.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-0K952.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-J1VDF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-PL1GR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-EUHVU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-77A2I.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-MG740.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-DANGD.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-C2D8P.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-6QL5T.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-48C7L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-HBL1M.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-FEKQ6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-2OU3Q.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-1C906.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-T0LBE.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-RE8LQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-4IT51.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-AGEPC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-OK78B.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-F8B1F.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-C9L6B.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-BF42V.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-HH378.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-0PE6T.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-VDPOG.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-G42GM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-CE1AR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-EE2JR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-G3L07.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-E1KQ9.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-JMF9S.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-SE4Q2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-TSDM9.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-EEKRH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-706F4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-P9BF9.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-PKD7D.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-7T9K6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-PU1PA.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-CKLD9.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-U65KB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-VB57V.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-MVJR7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-S8NHP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\sys
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\sys\is-N2NHS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sys
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-FQ2UK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-4DSRI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-QHAUI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-MUO8O.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-0I53U.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-GL0L4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-PTQPB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-74NLM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-OSJ7L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\tcc
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\tcc\is-JASML.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-92IBT.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-1S69F.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-97NTF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-P2U2R.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-2RB3V.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-GLR8Q.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-93UT7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-MUNGH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-5UQJA.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-GCQCF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-H9J2J.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-BBNAD.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-FJ0FL.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-4CQ17.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-1NSDB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-PTTF7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-SIKIP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-AD97Q.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-ASU18.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-NNHHO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-SJKQD.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-8HLKV.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-PMK62.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-5DOON.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-AUJ8A.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-MUHHF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-DSI7G.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-SQBUT.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-87427.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-EJPQ1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-A30LA.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-VADJ1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\languages
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\languages\is-OLBHT.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\languages\is-ERRVD.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\languages\is-L6R39.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\languages\is-QPVNS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\languages\is-IGC53.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\languages\is-IVS6D.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\languages\is-CIE95.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\languages\is-2CQ46.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\languages\is-FPKDI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\languages\is-PGR7M.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\languages\is-EBM2L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-0K02L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-V9D11.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-6LSG2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-BQRFH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-GGMI4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-NS6P9.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-JFC09.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-QQIJI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-J3Q59.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-Q18K1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-2V4D2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-60OMG.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-UQL2S.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-IPTJ2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-V5KV6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-3GI42.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-E8L5M.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-RQ2S3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-747JC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\forms
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\forms\is-158C0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-RU1SE.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-RPLOS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-VK6QC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\images
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\images\is-U6823.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\images\is-0BI9T.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-J71N7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-033OV.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-HJUU2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-G334Q.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-8AE8P.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-T3S7T.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-4TPRM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-V5CNU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-EAD3D.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\forms\is-Q50JT.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\forms\is-IH2QN.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-NCP20.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-B180O.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-JRPTO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-VGUUS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-N4PLP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-6JEUL.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-SKFQ5.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-G7CFT.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-LUTQ1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-ON5UP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-CNEHS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-UV0PJ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-KK89E.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-ESJ6U.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-FJD1M.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-4M6BM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-645IR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\images
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\images\is-F7D0S.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\xml
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\xml\is-VSIQB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\clibs32
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\clibs32\is-AQQPT.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\clibs64
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\clibs64\is-701OU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-397QA.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-BGU0I.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\32
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\32\is-5VCS0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\64
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\64\is-0JUIF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-UD451.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\is-1H9D4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-0OQDO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-TS9A7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-R3SMO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-IVICO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-6LEET.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-UOGUT.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-J1K98.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-OHV06.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-5SV36.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-0AS3A.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-SS3Q8.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\is-MB3S7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-89BIB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-MKUU5.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-3Q8BH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-V7A9J.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-A8Q85.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-U1HA7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-K4H2Q.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-1EM51.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-VOMKC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Common
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Common\is-HB4M8.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Common\is-06D9S.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-DSBVA.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-U9FAM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-QFQ4U.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\is-9GQEE.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\is-JAMT5.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\is-BRK2U.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\is-R1OD4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\is-1DI29.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\is-FKENA.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\is-Q5JOQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\is-I51PG.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\is-SJNR4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-VQTQI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-TIQC2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-DAA8Q.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-TD7IO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-1177L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-NBF0F.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-PMDDR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-VT36S.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\is-RCCJA.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-ILHTP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-J74FA.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-RN0P9.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-OOK6A.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-RUQFN.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-N4S80.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-MNOFM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-GJETC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-1VL61.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-7HB6K.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\Properties
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\Properties\is-CEIJS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\bin
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\bin\Release
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\bin\Release\is-QAU98.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-O71KG.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-L37DV.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-L7LJI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-01QEO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-PVGIS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-CUSKP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-17K0H.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-IOO6H.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-LT1SS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-FS25O.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-27QGG.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-9SETD.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-H42I8.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-08GVN.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-83TT8.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-V8UK4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-PPAMP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-SNPLC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\unins000.msg
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\server.txt

Creates a software uninstall entry

Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReasonLabs-EPP

Creates install or setup log file

Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\UnifiedStub-installer.exe.log

PE / OLE file has a valid certificate

Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.172.112.34:443 -> 192.168.2.8:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.172.112.34:443 -> 192.168.2.8:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.162.225.150:443 -> 192.168.2.8:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.230.219.225:443 -> 192.168.2.8:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.230.219.225:443 -> 192.168.2.8:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.94.94:443 -> 192.168.2.8:49761 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: shlwapi.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2118878537.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2173916136.00000000086F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: UxTheme.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2122434367.0000000008EED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CLBCatQ.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2163289242.000000000985B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Windows.Storage.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2194997737.00000000099C7000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2197941230.00000000099C7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: profapi.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2222821125.00000000093F6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winmm.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2137865690.0000000008EFF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntmarta.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2228947878.0000000009BD4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: glu32.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2197030680.0000000008F0B000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2128686001.0000000008F0B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\rsSyncSvc\rsSyncSvc\x64\Release\rsSyncSvc.pdb< source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, rsSyncSvc.exe, 00000019.00000000.1918136023.00007FF782567000.00000002.00000001.01000000.0000001A.sdmp, rsSyncSvc.exe, 00000019.00000002.1922544985.00007FF782567000.00000002.00000001.01000000.0000001A.sdmp, rsSyncSvc.exe, 0000001E.00000002.3276180421.00007FF782567000.00000002.00000001.01000000.0000001A.sdmp, rsSyncSvc.exe, 0000001E.00000000.1920370235.00007FF782567000.00000002.00000001.01000000.0000001A.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: shcore.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2173754543.00000000086EC000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2151062995.00000000086EC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CoreMessaging.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2228947878.0000000009BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winnsi.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2222821125.0000000009419000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net452\Microsoft.Win32.TaskScheduler.pdbSHA256 source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000002.3321945122.0000019B4CE52000.00000002.00000001.01000000.00000032.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\git\cheat-engine\Cheat Engine\bin\lua53-64.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2151918393.0000000008F11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dbghelp.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2174085824.0000000009B7F000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2228947878.0000000009B7F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: advapi32.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2133387170.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: XInput1_4.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2228947878.0000000009BAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: netutils.pdbbbK source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2222821125.0000000009572000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sspicli.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2222821125.00000000093F0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\git\cheat-engine\Cheat Engine\bin\tcc64-32.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2174085824.0000000009911000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CLBCatQ.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2163289242.000000000985B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntmarta.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2228947878.0000000009BD4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rsDatabase.pdb source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: UxTheme.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2122434367.0000000008EED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcp_win.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2228662166.0000000007CEE000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2117545096.0000000007CAD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winnsi.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2222821125.0000000009419000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\rsStubActivator\rsStubActivator\rsStubActivator\obj\Release\net462\rsStubActivator.pdb$1>1 01_CorExeMainmscoree.dll source: prod0.exe, 00000004.00000000.1813402829.000002A3CF932000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\Win32\Release\SaBsi.pdb source: saBSI.exe, 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmp, saBSI.exe, 00000005.00000000.1845266666.0000000000F8E000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: shlwapi.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2118878537.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2173916136.00000000086F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WLDP.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2201559902.0000000009A5C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\dev\sqlite\dotnet\obj\2015\System.Data.SQLite.2015\Release\System.Data.SQLite.pdb@ source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: propsys.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2184312242.0000000009AB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sspicli.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2222821125.00000000093F0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net452\Microsoft.Win32.TaskScheduler.pdb source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000002.3321945122.0000019B4CE52000.00000002.00000001.01000000.00000032.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: combase.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2220370244.0000000008594000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\rsSyncSvc\rsSyncSvc\x64\Release\rsSyncSvc.pdb source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, rsSyncSvc.exe, 00000019.00000000.1918136023.00007FF782567000.00000002.00000001.01000000.0000001A.sdmp, rsSyncSvc.exe, 00000019.00000002.1922544985.00007FF782567000.00000002.00000001.01000000.0000001A.sdmp, rsSyncSvc.exe, 0000001E.00000002.3276180421.00007FF782567000.00000002.00000001.01000000.0000001A.sdmp, rsSyncSvc.exe, 0000001E.00000000.1920370235.00007FF782567000.00000002.00000001.01000000.0000001A.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: win32u.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2148792759.0000000007CBF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gdi32full.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2117545096.0000000007CED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CoreMessaging.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2228947878.0000000009BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bcryptprimitives.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2179075086.0000000009800000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dbghelp.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2174085824.0000000009B7F000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2228947878.0000000009B7F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\git\cheat-engine\Cheat Engine\bin\tcc64-32.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2174085824.0000000009911000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wsock32.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2178434787.0000000008EE7000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2128686001.0000000008EE7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ExplorerFrame.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2197941230.00000000098B6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: imm32.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2112822903.00000000086DE000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2151062995.00000000086DE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rsAtom.pdb source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000002.3319865235.0000019B4C9D2000.00000002.00000001.01000000.00000031.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: glu32.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2197030680.0000000008F0B000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2128686001.0000000008F0B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: opengl32.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2137865690.0000000008EF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: profapi.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2222821125.00000000093F6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: comdlg32.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2139633733.0000000008D4A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws2_32.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2116863682.0000000008712000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2227495299.0000000008712000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2117545096.0000000007CA2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\rsStubActivator\rsStubActivator\rsStubActivator\obj\Release\net462\rsStubActivator.pdb source: prod0.exe, 00000004.00000000.1813402829.000002A3CF932000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: WLDP.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2201559902.0000000009A5C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rsTime.pdb source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: imm32.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2112822903.00000000086DE000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2151062995.00000000086DE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: advapi32.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2133387170.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: propsys.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2184312242.0000000009AB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gdi32full.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2117545096.0000000007CED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winmm.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2137865690.0000000008EFF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msctf.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2228947878.0000000009B99000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2155421442.0000000009B22000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msctf.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2228947878.0000000009B99000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2155421442.0000000009B22000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\rsStub\rsStub\rsStubLib\obj\Release\rsStubLib.pdb source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000002D.00000002.2201075023.000001FA2F4B2000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: version.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2145426436.0000000008EDB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ole32.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2112822903.00000000086D8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ^Do not load external debug symbols like .PDB/.DBG files (Breaks tables that use these symbols) source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: D:\git\cheat-engine\Cheat Engine\bin\lua53-64.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2151918393.0000000008F11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ExplorerFrame.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2197941230.00000000098B6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\A\_work\39\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.ValueTuple\netfx\System.ValueTuple.pdb source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcp_win.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2228662166.0000000007CEE000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2117545096.0000000007CAD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: opengl32.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2137865690.0000000008EF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\rsStub\rsStub\ArchiveUtility\bin\Release\x64\ArchiveUtility.pdb source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\rsStub\rsStub\UnifiedStub\obj\Release\UnifiedStub.pdb source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: hhctrl.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2128686001.0000000008EF3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bcryptprimitives.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2179075086.0000000009800000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Windows.Storage.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2194997737.00000000099C7000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2197941230.00000000099C7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: combase.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2220370244.0000000008594000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\dev\sqlite\dotnet\obj\2015\System.Data.SQLite.2015\Release\System.Data.SQLite.pdb source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ws2_32.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2116863682.0000000008712000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: hhctrl.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2128686001.0000000008EF3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: added an option to skip loading .PDB files source: CheatEngine75.exe, 0000000C.00000003.1882445843.0000000002530000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.2042781311.0000000002318000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000003.2031697249.0000000003781000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000003.2030897563.00000000007FE000.00000004.00000020.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000003.2031073742.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000003.1898011309.0000000003490000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000003.2035583319.00000000022D7000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: rsLogger.pdb source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000002D.00000002.2185072195.000001FA16D82000.00000002.00000001.01000000.0000002A.sdmp, UnifiedStub-installer.exe, 0000002D.00000002.2186104264.000001FA16E9D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ole32.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2112822903.00000000086D8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\rsStub\rsStub\rsStubRunner\rsStubRunner\bin\Release\x64\rsStubRunner.pdb source: 3yq4abxg.exe, 00000006.00000003.1871952838.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1871604014.0000000002A40000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.000000000326D000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.00000000032AE000.00000004.00001000.00020000.00000000.sdmp, Uninstall.exe, 0000001F.00000002.1971316751.00007FF62D7D6000.00000002.00000001.01000000.0000001B.sdmp, Uninstall.exe, 0000001F.00000000.1933226506.00007FF62D7D6000.00000002.00000001.01000000.0000001B.sdmp, Stub.exe, 00000020.00000003.2057681827.000000000325D000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.000000000329E000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2056875449.0000000002BF0000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2056593501.0000000002A30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: shcore.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2173754543.00000000086EC000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2151062995.00000000086EC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rsJSON.pdb source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000002.3282773301.0000019B32872000.00000002.00000001.01000000.00000030.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: rsLogger.pdbx source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000002D.00000002.2185072195.000001FA16D82000.00000002.00000001.01000000.0000002A.sdmp, UnifiedStub-installer.exe, 0000002D.00000002.2186104264.000001FA16E9D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: comctl32.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2145426436.0000000008EE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wsock32.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2178434787.0000000008EE7000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2128686001.0000000008EE7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2227495299.0000000008712000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2117545096.0000000007CA2000.00000004.00000020.00020000.00000000.sdmp

Spreading

Creates COM task schedule object (often to register a task for autostart)

Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Key opened: HKEY_CURRENT_USER_Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F69BF0 FindFirstFileExW,	5_2_00F69BF0
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Code function: 6_2_00404EC1 FindFirstFileW,	6_2_00404EC1
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Code function: 7_2_00405A19 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	7_2_00405A19
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Code function: 7_2_004065CE FindFirstFileA,FindClose,	7_2_004065CE
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Code function: 7_2_004027AA FindFirstFileA,	7_2_004027AA
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Code function: 31_2_00007FF62D7CCA9C FindFirstFileExW,	31_2_00007FF62D7CCA9C
Source: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe	Code function: 38_2_00417980 CreateFileW,DeviceIoControl,FindFirstFileExW,FindClose,SetLastError,SetLastError,	38_2_00417980
Source: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe	Code function: 38_2_00417E10 FindFirstFileExW,FindClose,	38_2_00417E10

Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	File opened: C:\Users\user\AppData\Local\Temp\is-H908U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	File opened: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	File opened: C:\Users\user\AppData\Local	Jump to behavior

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 49.3.Stub.exe.2eb9f48.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.3yq4abxg.exe.2eb9f48.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.3.Stub.exe.2ea9f48.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Program Files (x86)\WeatherZero\WeatherZero.exe, type: DROPPED

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /ReasonLabs-Setup-Wizard.exe?dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240727184154&is_silent=true&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100&b=&se=true&oip=26&ptl=7&dta=true&pds=%5bepp%2cvpn%2cdns%5d HTTP/1.1Host: shield.reasonsecurity.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Accept: application/jsonContent-Type: application/json; charset=utf-8Host: track.analytics-data.ioContent-Length: 1932Expect: 100-continueConnection: Close
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Accept: application/jsonContent-Type: application/json; charset=utf-8Host: track.analytics-data.ioContent-Length: 1907Expect: 100-continueConnection: Close
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Accept: application/jsonContent-Type: application/json; charset=utf-8Host: track.analytics-data.ioContent-Length: 1951Expect: 100-continueConnection: Close
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Accept: application/jsonContent-Type: application/json; charset=utf-8Host: track.analytics-data.ioContent-Length: 1932Expect: 100-continueConnection: Close

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: POST /o HTTP/1.1Connection: Keep-AliveContent-Type: application/json; Charset=UTF-8Accept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 125Host: d3cored83b0wp2.cloudfront.net
Source: global traffic	HTTP traffic detected: POST /zbd HTTP/1.1Connection: Keep-AliveContent-Type: application/json; Charset=UTF-8Accept: /Authorization: Signature=e09076fb7be72413458f55a70553fc9fe7a788e10f08e18ca857b7883846325fUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 276Host: d3cored83b0wp2.cloudfront.net
Source: global traffic	HTTP traffic detected: POST /zbd HTTP/1.1Connection: Keep-AliveContent-Type: application/json; Charset=UTF-8Accept: /Authorization: Signature=e09076fb7be72413458f55a70553fc9fe7a788e10f08e18ca857b7883846325fUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 352Host: d3cored83b0wp2.cloudfront.net
Source: global traffic	HTTP traffic detected: POST /zbd HTTP/1.1Connection: Keep-AliveContent-Type: application/json; Charset=UTF-8Accept: /Authorization: Signature=e09076fb7be72413458f55a70553fc9fe7a788e10f08e18ca857b7883846325fUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 339Host: d3cored83b0wp2.cloudfront.net
Source: global traffic	HTTP traffic detected: POST /zbd HTTP/1.1Connection: Keep-AliveContent-Type: application/json; Charset=UTF-8Accept: /Authorization: Signature=e09076fb7be72413458f55a70553fc9fe7a788e10f08e18ca857b7883846325fUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 344Host: d3cored83b0wp2.cloudfront.net
Source: global traffic	HTTP traffic detected: POST /zbd HTTP/1.1Connection: Keep-AliveContent-Type: application/json; Charset=UTF-8Accept: /Authorization: Signature=e09076fb7be72413458f55a70553fc9fe7a788e10f08e18ca857b7883846325fUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 334Host: d3cored83b0wp2.cloudfront.net
Source: global traffic	HTTP traffic detected: POST /zbd HTTP/1.1Connection: Keep-AliveContent-Type: application/json; Charset=UTF-8Accept: /Authorization: Signature=e09076fb7be72413458f55a70553fc9fe7a788e10f08e18ca857b7883846325fUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 353Host: d3cored83b0wp2.cloudfront.net
Source: global traffic	HTTP traffic detected: POST /zbd HTTP/1.1Connection: Keep-AliveContent-Type: application/json; Charset=UTF-8Accept: /Authorization: Signature=e09076fb7be72413458f55a70553fc9fe7a788e10f08e18ca857b7883846325fUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 355Host: d3cored83b0wp2.cloudfront.net
Source: global traffic	HTTP traffic detected: POST /zbd HTTP/1.1Connection: Keep-AliveContent-Type: application/json; Charset=UTF-8Accept: /Authorization: Signature=e09076fb7be72413458f55a70553fc9fe7a788e10f08e18ca857b7883846325fUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 343Host: d3cored83b0wp2.cloudfront.net
Source: global traffic	HTTP traffic detected: POST /zbd HTTP/1.1Connection: Keep-AliveContent-Type: application/json; Charset=UTF-8Accept: /Authorization: Signature=e09076fb7be72413458f55a70553fc9fe7a788e10f08e18ca857b7883846325fUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 298Host: d3cored83b0wp2.cloudfront.net

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe

Code function: 25_2_00007FF7824DFAA0 URLDownloadToFileA,

25_2_00007FF7824DFAA0

Source: global traffic	HTTP traffic detected: GET /f/RAV_Triple_NCB/images/DOTPS-855/EN.png HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.1.2Host: d3cored83b0wp2.cloudfront.net
Source: global traffic	HTTP traffic detected: GET /f/WebAdvisor/images/943/EN.png HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.1.2Host: d3cored83b0wp2.cloudfront.net
Source: global traffic	HTTP traffic detected: GET /f/WeatherZero/images/969/EN.png HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.1.2Host: d3cored83b0wp2.cloudfront.net
Source: global traffic	HTTP traffic detected: GET /rsStubActivator.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.1.2Host: shield.reasonsecurity.com
Source: global traffic	HTTP traffic detected: GET /f/WebAdvisor/files/1489/saBSI.zip HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.1.2Host: d3cored83b0wp2.cloudfront.net
Source: global traffic	HTTP traffic detected: GET /f/WeatherZero/files/969/WZSetup.zip HTTP/1.1Connection: Keep-AliveUser-Agent: Inno Setup 6.1.2Host: d3cored83b0wp2.cloudfront.net
Source: global traffic	HTTP traffic detected: GET /ReasonLabs-Setup-Wizard.exe?dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240727184154&is_silent=true&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100&b=&se=true&oip=26&ptl=7&dta=true&pds=%5bepp%2cvpn%2cdns%5d HTTP/1.1Host: shield.reasonsecurity.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cesharelist.txt HTTP/1.1User-Agent: Cheat Engine 7.5 : luascript-ceshareHost: cheatengine.org
Source: global traffic	HTTP traffic detected: GET /latestversion.txt HTTP/1.1User-Agent: Cheat Engine 7.5 : luascript-CEVersionCheckHost: cheatengine.org

Source: global traffic	DNS traffic detected: DNS query: d3cored83b0wp2.cloudfront.net
Source: global traffic	DNS traffic detected: DNS query: shield.reasonsecurity.com
Source: global traffic	DNS traffic detected: DNS query: analytics.apis.mcafee.com
Source: global traffic	DNS traffic detected: DNS query: sadownload.mcafee.com
Source: global traffic	DNS traffic detected: DNS query: localweatherfree.com
Source: global traffic	DNS traffic detected: DNS query: track.analytics-data.io
Source: global traffic	DNS traffic detected: DNS query: cheatengine.org

Source: unknown

HTTP traffic detected: POST /o HTTP/1.1Connection: Keep-AliveContent-Type: application/json; Charset=UTF-8Accept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Content-Length: 125Host: d3cored83b0wp2.cloudfront.net

Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1863363539.0000000004F35000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1843760686.0000000004F3B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2059425218.0000000006A07000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441868888.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2457680068.0000000005599000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2458319074.0000000005895000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2456590494.00000000058D5000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2462765751.0000000005599000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2463495772.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2461624703.0000000005599000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2440483421.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2454019553.0000000005599000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2463671905.0000000005599000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2457230909.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2458534556.000000000559A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2455020674.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2443385585.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2455216703.0000000005599000.00000004.00000020.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1871952838.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1871604014.0000000002A40000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.000000000326D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 3yq4abxg.exe, 00000006.00000003.1871952838.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1871604014.0000000002A40000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.000000000326D000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.00000000032AE000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.000000000325D000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.000000000329E000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2056875449.0000000002BF0000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2056593501.0000000002A30000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000002D.00000002.2202510954.000001FA2F534000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1863363539.0000000004F35000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1843760686.0000000004F3B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2059425218.0000000006A07000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441868888.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2463495772.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2571518040.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2440483421.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2457230909.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2455020674.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1871952838.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1871604014.0000000002A40000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.000000000326D000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.00000000032AE000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.000000000325D000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.000000000329E000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2056875449.0000000002BF0000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2056593501.0000000002A30000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000002D.00000002.2202510954.000001FA2F534000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1863363539.0000000004F35000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1843760686.0000000004F3B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2059425218.0000000006A07000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441868888.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2457680068.0000000005599000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2462765751.0000000005599000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2463495772.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2461624703.0000000005599000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2440483421.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2454019553.0000000005599000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2457230909.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2455020674.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2443385585.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2455216703.0000000005599000.00000004.00000020.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1871952838.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1871604014.0000000002A40000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.000000000326D000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.00000000032AE000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.000000000325D000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.000000000329E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: saBSI.exe, 00000005.00000002.2583025617.000000000314E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmp, saBSI.exe, 00000005.00000000.1845266666.0000000000F8E000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: http://clients2.google.com/service/update2/crx
Source: saBSI.exe, 00000005.00000002.2583025617.000000000314E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/service/update2/crxQ
Source: CheatEngine75.tmp, 0000000D.00000003.2017396988.00000000054D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://creativecommons.org/ns#
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1863363539.0000000004F35000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2059425218.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000A75000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2456178236.0000000000A74000.00000004.00000020.00020000.00000000.sdmp, prod0.exe, 00000004.00000002.3288281066.000002A3E9F1D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2442974006.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1931266022.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1975835833.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1916253547.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.00000000031B7000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2443385585.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2442884926.00000000031C9000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000003.1994178474.00000000007A8000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000003.1893145095.00000000007B1000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000003.1907678051.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000002.1998636294.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000003.1922914800.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000003.1992384218.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000003.1947310455.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000002.3317370961.0000019B4C8BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2451374947.000000000018E000.00000004.00000010.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1888165639.000000007FE24000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1884318482.0000000002628000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000002.2039167823.000000000018F000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1843760686.0000000004F3B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2451374947.000000000018E000.00000004.00000010.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2456590494.00000000058D5000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2463495772.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441980925.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2440483421.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441980925.0000000003206000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2457230909.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2455020674.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1888165639.000000007FE24000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1884318482.0000000002628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1843760686.0000000004F3B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2451374947.000000000018E000.00000004.00000010.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2463495772.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2442104275.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2571518040.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441980925.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2440483421.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2457230909.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2455020674.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1888165639.000000007FE24000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1884318482.0000000002628000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000002.2039167823.000000000018F000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2451374947.000000000018E000.00000004.00000010.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1888165639.000000007FE24000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1884318482.0000000002628000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000002.2039167823.000000000018F000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2451374947.000000000018E000.00000004.00000010.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1888165639.000000007FE24000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1884318482.0000000002628000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000002.2039167823.000000000018F000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: CheatEngine75.exe, 0000000C.00000003.1888165639.000000007FE24000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1884318482.0000000002628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1863363539.0000000004F35000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2059425218.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1863363539.0000000004F35000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2059425218.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1863363539.0000000004F35000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1843760686.0000000004F3B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2059425218.0000000006A07000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441868888.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2457680068.0000000005599000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2458319074.0000000005895000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2456590494.00000000058D5000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2462765751.0000000005599000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2463495772.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2461624703.0000000005599000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2440483421.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2454019553.0000000005599000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2463671905.0000000005599000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2457230909.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2458534556.000000000559A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2455020674.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2443385585.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2455216703.0000000005599000.00000004.00000020.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1871952838.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1871604014.0000000002A40000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.000000000326D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: 3yq4abxg.exe, 00000006.00000003.1871952838.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1871604014.0000000002A40000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.000000000326D000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.00000000032AE000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.000000000325D000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.000000000329E000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2056875449.0000000002BF0000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2056593501.0000000002A30000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000002D.00000002.2202510954.000001FA2F534000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1863363539.0000000004F35000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1843760686.0000000004F3B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2059425218.0000000006A07000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441868888.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2463495772.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2571518040.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2440483421.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2457230909.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2455020674.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1871952838.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1871604014.0000000002A40000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.000000000326D000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.00000000032AE000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.000000000325D000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.000000000329E000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2056875449.0000000002BF0000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2056593501.0000000002A30000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000002D.00000002.2202510954.000001FA2F534000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: UnifiedStub-installer.exe, 0000002D.00000002.2202510954.000001FA2F534000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: 3yq4abxg.exe, 00000006.00000003.1871952838.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1871604014.0000000002A40000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.000000000326D000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.00000000032AE000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.000000000325D000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.000000000329E000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2056875449.0000000002BF0000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2056593501.0000000002A30000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000002D.00000002.2202510954.000001FA2F534000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1863363539.0000000004F35000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2059425218.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1863363539.0000000004F35000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2059425218.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: saBSI.exe, 00000005.00000003.2571419970.00000000054D2000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2585696686.00000000054D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: saBSI.exe, 00000005.00000002.2585659818.00000000054C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/eng
Source: prod0.exe, 00000004.00000002.3283145627.000002A3D18F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://d14mh4uvqj4iiz.cloudfront.net
Source: CheatEngine75.tmp, 0000000D.00000003.2017396988.00000000054D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ns/office/1.2/meta/odf#ContentFile
Source: CheatEngine75.tmp, 0000000D.00000003.2017396988.00000000054D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ns/office/1.2/meta/odf#StylesFile
Source: CheatEngine75.tmp, 0000000D.00000003.2017396988.00000000054D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ns/office/1.2/meta/pkg#
Source: CheatEngine75.tmp, 0000000D.00000003.2017396988.00000000054D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ns/office/1.2/meta/pkg#Document
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: http://forum.cheatengine.org/
Source: WZSetup.exe, WZSetup.exe, 00000007.00000000.1865545320.000000000040A000.00000008.00000001.01000000.00000012.sdmp, WZSetup.exe, 00000007.00000002.1995533666.000000000040A000.00000004.00000001.01000000.00000012.sdmp, WZSetup.exe, 00000007.00000003.1994147598.0000000002841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: WZSetup.exe, 00000007.00000000.1865545320.000000000040A000.00000008.00000001.01000000.00000012.sdmp, WZSetup.exe, 00000007.00000002.1995533666.000000000040A000.00000004.00000001.01000000.00000012.sdmp, WZSetup.exe, 00000007.00000003.1994147598.0000000002841000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1863363539.0000000004F35000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2059425218.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: 3yq4abxg.exe, 00000006.00000003.1871952838.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1871604014.0000000002A40000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.000000000326D000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.00000000032AE000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.000000000325D000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.000000000329E000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2056875449.0000000002BF0000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2056593501.0000000002A30000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000002D.00000002.2202510954.000001FA2F534000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1863363539.0000000004F35000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1843760686.0000000004F3B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2059425218.0000000006A07000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441868888.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2457680068.0000000005599000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2462765751.0000000005599000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2463495772.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2461624703.0000000005599000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2440483421.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2454019553.0000000005599000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2457230909.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2455020674.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2443385585.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2455216703.0000000005599000.00000004.00000020.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1871952838.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1871604014.0000000002A40000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.000000000326D000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.00000000032AE000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.000000000325D000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.000000000329E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1863363539.0000000004F35000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1843760686.0000000004F3B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2059425218.0000000006A07000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441868888.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2457680068.0000000005599000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2458319074.0000000005895000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2456590494.00000000058D5000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2462765751.0000000005599000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2463495772.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2461624703.0000000005599000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2440483421.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2454019553.0000000005599000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2463671905.0000000005599000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2457230909.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2458534556.000000000559A000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2455020674.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2443385585.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2455216703.0000000005599000.00000004.00000020.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1871952838.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1871604014.0000000002A40000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.000000000326D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1863363539.0000000004F35000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1843760686.0000000004F3B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2059425218.0000000006A07000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441868888.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2463495772.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2571518040.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2440483421.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2457230909.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2455020674.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1871952838.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1871604014.0000000002A40000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.000000000326D000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.00000000032AE000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.000000000325D000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.000000000329E000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2056875449.0000000002BF0000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2056593501.0000000002A30000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000002D.00000002.2202510954.000001FA2F534000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: saBSI.exe, 00000005.00000003.2571518040.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441980925.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.000000000320C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2451374947.000000000018E000.00000004.00000010.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1888165639.000000007FE24000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1884318482.0000000002628000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000002.2039167823.000000000018F000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1843760686.0000000004F3B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2451374947.000000000018E000.00000004.00000010.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2456590494.00000000058D5000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2463495772.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2440483421.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441980925.0000000003206000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2457230909.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2455020674.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1888165639.000000007FE24000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1884318482.0000000002628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1843760686.0000000004F3B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2451374947.000000000018E000.00000004.00000010.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2463495772.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2442104275.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2571518040.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441980925.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2440483421.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2457230909.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2455020674.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1888165639.000000007FE24000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1884318482.0000000002628000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000002.2039167823.000000000018F000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: CheatEngine75.exe, 0000000C.00000003.1888165639.000000007FE24000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1884318482.0000000002628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2451374947.000000000018E000.00000004.00000010.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1888165639.000000007FE24000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1884318482.0000000002628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1863363539.0000000004F35000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2059425218.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2451374947.000000000018E000.00000004.00000010.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1888165639.000000007FE24000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1884318482.0000000002628000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000002.2039167823.000000000018F000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2451374947.000000000018E000.00000004.00000010.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1888165639.000000007FE24000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1884318482.0000000002628000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000002.2039167823.000000000018F000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: prod0.exe, 00000004.00000002.3283145627.000002A3D1801000.00000004.00000800.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000002.3283444796.0000019B3408C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: saBSI.exe, 00000005.00000003.2441980925.000000000320C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.glob
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1843760686.0000000004F3B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2451374947.000000000018E000.00000004.00000010.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2456590494.00000000058D5000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2463495772.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441980925.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2440483421.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441980925.0000000003206000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2457230909.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2455020674.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1888165639.000000007FE24000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1884318482.0000000002628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1843760686.0000000004F3B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2451374947.000000000018E000.00000004.00000010.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2463495772.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2442104275.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2440483421.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2457230909.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2455020674.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1888165639.000000007FE24000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1884318482.0000000002628000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000002.2039167823.000000000018F000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2451374947.000000000018E000.00000004.00000010.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1888165639.000000007FE24000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1884318482.0000000002628000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000002.2039167823.000000000018F000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2451374947.000000000018E000.00000004.00000010.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1888165639.000000007FE24000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1884318482.0000000002628000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: prod0.exe, 00000004.00000002.3283145627.000002A3D18F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://shield.reasonsecurity.com
Source: CheatEngine75.tmp, 0000000D.00000003.2017396988.00000000054D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd
Source: CheatEngine75.tmp, 0000000D.00000003.2017396988.00000000054D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://wiki.lazarus.freepascal.org/fpvectorial)
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: http://www.cheatengine.org/?referredby=CE%.2f
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: http://www.cheatengine.org/ceads.php
Source: 3yq4abxg.exe, 00000006.00000003.1871952838.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1871604014.0000000002A40000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.000000000326D000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.00000000032AE000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.000000000325D000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.000000000329E000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2056875449.0000000002BF0000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2056593501.0000000002A30000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000002D.00000002.2202510954.000001FA2F534000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe, 00000000.00000003.1402834501.0000000002530000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe, 00000000.00000003.2478930076.00000000021D8000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2159882150.0000000006D86000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1411738649.0000000002C60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.dk-soft.org/
Source: saBSI.exe, 00000005.00000002.2583025617.00000000031B7000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2455020674.00000000057D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.mcafee.com
Source: saBSI.exe, 00000005.00000002.2583025617.000000000314E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.apis.mcafee.com
Source: saBSI.exe, 00000005.00000002.2583025617.000000000314E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.00000000031B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.apis.mcafee.com/
Source: saBSI.exe, 00000005.00000002.2583025617.000000000314E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2585659818.00000000054C0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2571419970.00000000054D2000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2585696686.00000000054D2000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.00000000031B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.apis.mcafee.com/mosaic/2.0/product-web/am/v1/record
Source: saBSI.exe, 00000005.00000003.2442104275.00000000054D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2571419970.00000000054D2000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2585696686.00000000054D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.apis.mcafee.com/mosaic/2.0/product-web/am/v1/recordl
Source: saBSI.exe, 00000005.00000002.2585735618.00000000054F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.apis.mcafee.com:443/mosaic/2.0/product-web/am/v1/record
Source: saBSI.exe, 00000005.00000003.2570621559.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2571183671.00000000054F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.apis.mcafee.com:443/mosaic/2.0/product-web/am/v1/recordps://sadownload.mcafee.com/
Source: saBSI.exe, 00000005.00000003.2570621559.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2571183671.00000000054F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.apis.mcafee.com:443/mosaic/2.0/product-web/am/v1/recordtribution
Source: saBSI.exe, 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmp, saBSI.exe, 00000005.00000000.1845266666.0000000000F8E000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: https://analytics.apis.mcafee.comhttps://analytics.qa.apis.mcafee.com/mosaic/2.0/product-web/am/v1/r
Source: saBSI.exe, 00000005.00000002.2583025617.000000000314E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.qa.apis.mcafee.comx
Source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beta.reasonlabs.com/contact-us?prod=2&utm_source=vpn_uninstall&utm_medium=home_contact_suppo
Source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://beta.reasonlabs.com/contact-us?prod=3&utm_source=safer_web_uninstall_home&utm_medium=contact
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: https://cheatengine.org/
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2133387170.0000000007CE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheatengine.org/cesharelist.txt0
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: https://cheatengine.org/dbkerror.php
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: https://cheatengine.org/dbkerror.phpopen
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2174085824.0000000009DEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cheatengine.org/e-4e5c-ae1f-9bc86c8e8c94T
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: https://cheatengine.org/microtransaction.php?action=buy&amount=
Source: CheatEngine75.tmp, 0000000D.00000003.2017396988.00000000054D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cheatengine.org/tutorial.php?tutorial=
Source: CheatEngine75.tmp, 0000000D.00000003.2017396988.00000000054D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cheatengine.org/tutorial.php?tutorial=open
Source: saBSI.exe, 00000005.00000002.2583025617.000000000314E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cu1pehnswad01.servicebus.windows.net/wadp32h02/messages?timeout=60&api-version=2014-01p
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1578782739.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/0
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508883120.0000000000A93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/5
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/?
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1578782739.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/e
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe, 00000000.00000003.1402834501.0000000002530000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe, 00000000.00000003.2478930076.000000000223E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002DA9000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2163484819.0000000002350000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002CD9000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1411738649.0000000002C60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/f/
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1578782739.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/f/AVAST/files/cookie_mmm_irs_ppi_005_888_a.zip
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe, 00000000.00000003.1402834501.0000000002530000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe, 00000000.00000003.2478930076.000000000223E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2159882150.0000000006CC0000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1578782739.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2163484819.0000000002350000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508883120.0000000000A93000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002CD9000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1411738649.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/f/CheatEngine/1032/CheatEngine75.exe
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1578782739.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508883120.0000000000A93000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2172217386.0000000004E71000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/f/RAV_Triple_NCB/images/DOTPS-855/EN.png
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/f/RAV_Triple_NCB/images/DOTPS-855/EN.png9SP3pRw0yVFKRoA4O6H4
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2172217386.0000000004E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/f/RAV_Triple_NCB/images/DOTPS-855/EN.pngM
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2172217386.0000000004E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/f/RAV_Triple_NCB/images/DOTPS-855/EN.pngll
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1578782739.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1864310516.0000000004EC6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2090140344.0000000004EC1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2163484819.0000000002404000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2464054224.0000000004EC1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/f/WeatherZero/files/969/WZSetup.zip
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1578782739.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/f/WeatherZero/files/969/WZSetup.zip2yhVX
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2090140344.0000000004EC1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2464054224.0000000004EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/f/WeatherZero/files/969/WZSetup.zip5vT
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1864310516.0000000004EA9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2124115026.0000000004EA9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1844139575.0000000004EA3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2150822703.0000000004EA9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000A2C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2463662036.0000000004EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/f/WeatherZero/images/969/EN.png
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2455203792.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/f/WeatherZero/images/969/EN.pnga
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000A90000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1578782739.0000000000A93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/f/WeatherZero/images/969/EN.pngc
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1578782739.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/f/WeatherZero/images/969/EN.pngzip
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1578782739.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/f/WeatherZero/images/969/EN.pngzipam
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508883120.0000000000A93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/f/WebAdvisor/files/1489/saBSI.zip
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1578782739.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508883120.0000000000A93000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1864310516.0000000004EC6000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2090140344.0000000004EC1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2464054224.0000000004EC1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/f/WebAdvisor/files/1489/saBSI.zip.png
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2090140344.0000000004EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/f/WebAdvisor/files/1489/saBSI.zip5f
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1844139575.0000000004EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/f/WebAdvisor/files/1489/saBSI.zipp
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508883120.0000000000A93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/f/WebAdvisor/files/1489/saBSI.zipxe
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2124115026.0000000004EA9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1844139575.0000000004EA3000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A27000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2150822703.0000000004EA9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000A2C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2463662036.0000000004EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/f/WebAdvisor/images/943/EN.png
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1844139575.0000000004EA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/f/WebAdvisor/images/943/EN.png5
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2455203792.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/f/WebAdvisor/images/943/EN.pngD
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508883120.0000000000A93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/f/WebAdvisor/images/943/EN.pngc
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1864310516.0000000004EA9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2124115026.0000000004EA9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2150822703.0000000004EA9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2463662036.0000000004EAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/f/WebAdvisor/images/943/EN.pnge
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508883120.0000000000A93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/f/WebAdvisor/images/943/EN.pngipe
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508883120.0000000000A93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/f/WebAdvisor/images/943/EN.pngipera_
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe, 00000000.00000003.1402834501.0000000002530000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe, 00000000.00000003.2478930076.000000000223E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002DED000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2163484819.0000000002350000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A27000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002CD9000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000A2C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1411738649.0000000002C60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/o
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe, 00000000.00000003.1402834501.0000000002530000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe, 00000000.00000003.2478930076.000000000223E000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2476998019.000000000B540000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002DED000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2163484819.0000000002350000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000A90000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1578782739.0000000000A93000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2090140344.0000000004EC1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002CD9000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2464054224.0000000004EC1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1411738649.0000000002C60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/zbd
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2476998019.000000000B540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/zbd=u
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000A90000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1578782739.0000000000A93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net/zbdt
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2476998019.000000000B540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d3cored83b0wp2.cloudfront.net:443/zbd
Source: UnifiedStub-installer.exe, 0000000B.00000002.3283444796.0000019B3408C000.00000004.00000800.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://electron-shell.reasonsecurity.com/v
Source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000002.3321945122.0000019B4CE52000.00000002.00000001.01000000.00000032.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dahall/taskscheduler
Source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbf
Source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbf8
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2172217386.0000000004E71000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002CD9000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://home.mcafee.com/Root/AboutUs.aspx?id=eula
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe, 00000000.00000000.1401972062.0000000000401000.00000020.00000001.01000000.00000003.sdmp, CheatEngine75.exe, 0000000C.00000000.1878862598.000000000040E000.00000020.00000001.01000000.00000016.sdmp	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: WZSetup.exe, 00000007.00000003.1994178474.00000000007A8000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000002.1998636294.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000003.1994867793.000000000075E000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000003.1922914800.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000003.1992384218.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000003.1947310455.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000002.1998170408.000000000075E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://localweatherfree.com/
Source: WZSetup.exe, 00000007.00000003.1907678051.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000003.1922914800.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://localweatherfree.com/E
Source: WZSetup.exe, 00000007.00000003.1922914800.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000003.1995145479.0000000000785000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000003.1992384218.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000003.1947310455.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000002.1995533666.0000000000439000.00000004.00000001.01000000.00000012.sdmp, WZSetup.exe, 00000007.00000002.1997948492.0000000000708000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000002.1998170408.000000000075E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://localweatherfree.com/forecast
Source: WZSetup.exe, 00000007.00000003.1922914800.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://localweatherfree.com/forecast32
Source: WZSetup.exe, 00000007.00000003.1994178474.00000000007A8000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000002.1998636294.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000003.1992384218.00000000007AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://localweatherfree.com/forecast4
Source: WZSetup.exe, 00000007.00000003.1922914800.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://localweatherfree.com/forecastA
Source: WZSetup.exe, 00000007.00000003.1992384218.00000000007AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://localweatherfree.com/forecastLnCZyJIT3VIHOjglwhzNosGx/9V1OxmW
Source: WZSetup.exe, 00000007.00000003.1992384218.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000003.1947310455.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://localweatherfree.com/forecastX
Source: WZSetup.exe, 00000007.00000003.1907678051.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://localweatherfree.com/forecastdT
Source: WZSetup.exe, 00000007.00000003.1922914800.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://localweatherfree.com/forecastgT
Source: WZSetup.exe, 00000007.00000002.1995533666.0000000000439000.00000004.00000001.01000000.00000012.sdmp	String found in binary or memory: https://localweatherfree.com/forecastlocation=5OhVky%2B4V0XPkJ6rjUuB0R4ELexthS%2BA2%2F7JDmd%2BDJstFI
Source: WZSetup.exe, 00000007.00000003.1994178474.00000000007A8000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000003.1992384218.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000003.1947310455.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://localweatherfree.com/forecastp&
Source: WZSetup.exe, 00000007.00000003.1994178474.00000000007A8000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000002.1998636294.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000003.1992384218.00000000007AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://localweatherfree.com/forecastpp
Source: WZSetup.exe, 00000007.00000003.1907678051.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://localweatherfree.com/forecastt&
Source: WZSetup.exe, 00000007.00000003.1947310455.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://localweatherfree.com/forecasttJ
Source: WZSetup.exe, 00000007.00000003.1992384218.00000000007AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://localweatherfree.com/forecastz
Source: UnifiedStub-installer.exe, 0000002D.00000002.2201075023.000001FA2F4B2000.00000002.00000001.01000000.0000002B.sdmp, UnifiedStub-installer.exe, 0000002D.00000002.2186104264.000001FA16E9D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://logziop.reasonsecurity.com
Source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com/?utm_source=safer_web_uninstall_home&utm_medium=website_link&ruserid=
Source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com/contact-us?prod=2&utm_source=vpn_uninstall&utm_medium=home_contact_support&ru
Source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com/contact-us?prod=3&utm_source=safer_web_uninstall_home&utm_medium=contact_supp
Source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000002.3283444796.0000019B3408C000.00000004.00000800.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com/platform/packages/essential?utm_source=rav_uninstall&utm_medium=home_website_
Source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000002.3283444796.0000019B3408C000.00000004.00000800.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com/platform/products/rav/privacy-policy?utm_source=rav_antivirus_installer
Source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000002.3283444796.0000019B3408C000.00000004.00000800.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com/platform/products/rav/terms?utm_source=rav_antivirus_installer
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2464054224.0000000004EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com/policies
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com/policiesiveEventeatherZero/images/969/EN.pngzipam
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2090140344.0000000004EC1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2464054224.0000000004EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com/policiesiveEventfe7a788e10f08e18ca857b7883846325f
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1864310516.0000000004F10000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2150169474.0000000004F10000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2089750771.0000000004F5C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2464980416.0000000004F0D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1844139575.0000000004F0D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2090140344.0000000004F0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com/policiesm/rsSt
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000A79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com/policiesq
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000A79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com/policiesr
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com/policiesrivacy-policy88e10f08e18ca857b7883846325fInstaller_IC201102_ISV.zip
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2172039331.0000000000AAB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com/policiesrivacy-policyisor/files/1489/saBSI.zip
Source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://reasonlabs.com?utm_source=vpn_uninstall&utm_medium=home_website_link&ruserid=
Source: saBSI.exe, 00000005.00000003.1916253547.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1893113809.000000000320C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/
Source: saBSI.exe, 00000005.00000003.1916253547.00000000031D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/6
Source: saBSI.exe, 00000005.00000003.1895689100.000000000320D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1893113809.000000000320C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/Z0
Source: saBSI.exe, 00000005.00000003.1895689100.000000000320D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1893113809.000000000320C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/l
Source: saBSI.exe, 00000005.00000003.1931266022.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1916253547.00000000031D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/n
Source: saBSI.exe, 00000005.00000003.1894003745.000000000320F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1893113809.000000000320C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/o
Source: saBSI.exe	String found in binary or memory: https://sadownload.mcafee.com/products/SA/
Source: saBSI.exe, 00000005.00000003.2441868888.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2451927696.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2451252709.0000000003213000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1882145312.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1895689100.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1974949012.0000000003210000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2571518040.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1927510273.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1985361133.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1893113809.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1916114316.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1893560349.0000000003212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/Win/binary/3.7.2/update_bsi_product.xml
Source: saBSI.exe, 00000005.00000003.1893113809.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1974949012.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1916114316.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2451252709.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441868888.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1985361133.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1895689100.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1927510273.0000000003228000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/Win/binary/3.7.2/update_bsi_product.xml/
Source: saBSI.exe, 00000005.00000003.2441868888.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2451927696.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2451252709.0000000003213000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1882145312.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1895689100.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1974949012.0000000003210000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2571518040.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1927510273.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1985361133.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1893113809.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1916114316.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1893560349.0000000003212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/Win/binary/4.1.0/update_bsi_self.xml
Source: saBSI.exe, 00000005.00000003.1893113809.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1974949012.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1916114316.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2451252709.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441868888.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1985361133.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1895689100.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1927510273.0000000003228000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/Win/binary/4.1.0/update_bsi_self.xml/
Source: saBSI.exe, 00000005.00000002.2583025617.000000000314E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1931266022.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2585659818.00000000054C0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1894433107.00000000054C1000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1916253547.00000000031D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRules.xml
Source: saBSI.exe, 00000005.00000003.1895622893.00000000054D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRules.xml/
Source: saBSI.exe, 00000005.00000003.1931266022.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1916253547.00000000031D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRules.xmlB
Source: saBSI.exe, 00000005.00000003.1916253547.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1985361133.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.00000000031B7000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1893113809.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2442884926.00000000031C9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1916114316.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1893560349.0000000003212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_PaidDistribution.xml
Source: saBSI.exe, 00000005.00000003.1893113809.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1974949012.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1916114316.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2451252709.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441868888.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1985361133.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1895689100.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1927510273.0000000003228000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_PaidDistribution.xml/
Source: saBSI.exe, 00000005.00000003.2441868888.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2451927696.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2451252709.0000000003213000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1882145312.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1895689100.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1974949012.0000000003210000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2571518040.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1927510273.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1985361133.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1893113809.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1916114316.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1893560349.0000000003212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_PartnerDistribution.xml
Source: saBSI.exe, 00000005.00000003.1893113809.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1974949012.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1916114316.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2451252709.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441868888.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1985361133.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1895689100.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1927510273.0000000003228000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_PartnerDistribution.xml/
Source: saBSI.exe, 00000005.00000003.2441868888.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2442104275.00000000054D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2451927696.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1931229204.00000000054D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2451252709.0000000003213000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1882145312.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1895689100.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2571183671.00000000054D9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1974949012.0000000003210000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2571518040.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1927510273.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1975165861.00000000054D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1927510273.000000000320E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1985361133.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1893113809.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1916114316.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1893560349.0000000003212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_abtest.xml
Source: saBSI.exe, 00000005.00000003.1893113809.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1974949012.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1916114316.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1975165861.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2451252709.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2442104275.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441868888.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2570621559.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1985361133.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1895689100.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1927510273.0000000003228000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_abtest.xml/
Source: saBSI.exe, saBSI.exe, 00000005.00000003.2442974006.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1931266022.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmp, saBSI.exe, 00000005.00000003.1975835833.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000000.1845266666.0000000000F8E000.00000002.00000001.01000000.00000010.sdmp, saBSI.exe, 00000005.00000003.1916253547.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2443385585.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2442884926.00000000031C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_main.xml
Source: saBSI.exe, 00000005.00000003.2441868888.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2451927696.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2451252709.0000000003213000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1882145312.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1895689100.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1974949012.0000000003210000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2571518040.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1927510273.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1985361133.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1893113809.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1916114316.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1893560349.0000000003212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_vars.xml
Source: saBSI.exe, 00000005.00000003.1893113809.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1974949012.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1916114316.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2451252709.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441868888.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1985361133.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1895689100.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1927510273.0000000003228000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/BSI/bsi_vars.xml/
Source: saBSI.exe, 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmp, saBSI.exe, 00000005.00000000.1845266666.0000000000F8E000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/UPDATER_VERSIONaffidosplatSELF_UPDATE_ALLOWEDMAIN_XMLSTORE
Source: saBSI.exe, saBSI.exe, 00000005.00000002.2583025617.000000000314E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/Win/xpi/webadvisor/update.json
Source: saBSI.exe, 00000005.00000002.2583025617.000000000314E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/Win/xpi/webadvisor/update.jsonRE=x86
Source: saBSI.exe, 00000005.00000002.2583025617.000000000314E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/Win/xpi/webadvisor/update.jsoniveOS=
Source: saBSI.exe, 00000005.00000003.2442104275.00000000054D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1931229204.00000000054D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2571183671.00000000054D9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1975835833.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1975165861.00000000054D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/bsi
Source: saBSI.exe, 00000005.00000003.1975165861.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2442104275.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2570621559.00000000054EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/bsi/
Source: saBSI.exe, 00000005.00000003.2441868888.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2451927696.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2451252709.0000000003213000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1882145312.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1895689100.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1974949012.0000000003210000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2571518040.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1927510273.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1985361133.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1893113809.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1916114316.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1893560349.0000000003212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/bsi/4.1.1/install.xml
Source: saBSI.exe, 00000005.00000003.1893113809.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1974949012.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1916114316.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2451252709.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441868888.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1985361133.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1895689100.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1927510273.0000000003228000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/bsi/4.1.1/install.xml/
Source: saBSI.exe, 00000005.00000002.2583025617.00000000031B7000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2442884926.00000000031C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/bsi/4.1.1/install.xmlnload.mcafee.com
Source: saBSI.exe, 00000005.00000003.2442974006.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1975835833.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.00000000031B7000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2443385585.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2442884926.00000000031C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/bsi/binary
Source: saBSI.exe, 00000005.00000003.2441980925.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1975165861.00000000054D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1975037735.000000000320C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/installer/4.1.1/914/
Source: saBSI.exe, 00000005.00000003.2442104275.00000000054D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2442884926.00000000031C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/installer/4.1.1/914/64/installer.exe
Source: saBSI.exe, 00000005.00000003.2442104275.00000000054D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441980925.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1975165861.00000000054D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1975037735.000000000320C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/pc/partner_custom_bsi.xml
Source: saBSI.exe, 00000005.00000003.2442104275.00000000054D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2586262929.0000000005815000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441980925.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1975165861.00000000054D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1975037735.000000000320C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/SA/v1/update/post_install.xml
Source: saBSI.exe, 00000005.00000003.2442104275.00000000054D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1931229204.00000000054D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2571183671.00000000054D9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1975165861.00000000054D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/sa/bsi/win/binary
Source: saBSI.exe, 00000005.00000003.1975165861.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2442104275.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2570621559.00000000054EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/sa/bsi/win/binary/
Source: saBSI.exe, 00000005.00000003.1974949012.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1975165861.0000000005530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1975923382.000000000551B000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1985305677.0000000005530000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1975835833.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.00000000031B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/sa/v1/pc/partner_custom_vars.xml
Source: saBSI.exe, 00000005.00000002.2583025617.000000000314E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/sa1k
Source: saBSI.exe, 00000005.00000002.2583025617.000000000314E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/saLocal
Source: saBSI.exe, 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmp, saBSI.exe, 00000005.00000000.1845266666.0000000000F8E000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: https://sadownload.mcafee.com/products/saUPDATER_URLupdater.exeWebAdvisor_Updaterheron_hostthreat.ap
Source: saBSI.exe, 00000005.00000003.1931266022.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1916253547.00000000031D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sadownload.mcafee.com/x
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1863363539.0000000004F35000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2059425218.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: prod0.exe, 00000004.00000002.3283145627.000002A3D18DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com
Source: prod0.exe, 00000004.00000002.3283145627.000002A3D1801000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/
Source: prod0.exe, 00000004.00000000.1813402829.000002A3CF932000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/7ReasonLabs-Setup-Wizard.exe
Source: prod0.exe, 00000004.00000002.3283145627.000002A3D1801000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-Setup-Wizard.exe
Source: prod0.exe, 00000004.00000002.3283145627.000002A3D18DC000.00000004.00000800.00020000.00000000.sdmp, prod0.exe, 00000004.00000002.3283145627.000002A3D1801000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/ReasonLabs-Setup-Wizard.exe?dui=9e146be9-c76a-4720-bcdb-53011b87bd
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A63000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2090140344.0000000004EED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000A90000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2464257647.0000000004EED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2463458065.0000000004E70000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000A65000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2159882150.0000000006D68000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/rsStubActivator.exe
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1844139575.0000000004EED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1864310516.0000000004EED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/rsStubActivator.exe/
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/rsStubActivator.exeages/969/EN.pngzip
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2090140344.0000000004EC1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2464054224.0000000004EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/rsStubActivator.exee18ca857b7883846325f
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2172039331.0000000000AAB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com/rsStubActivator.exeles/969/WZSetup.zip
Source: prod0.exe, 00000004.00000002.3283145627.000002A3D1801000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shield.reasonsecurity.com:443/ReasonLabs-Setup-Wizard.exe?dui=9e146be9-c76a-4720-bcdb-53011b
Source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://system.data.sqlite.org/
Source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://system.data.sqlite.org/X
Source: UnifiedStub-installer.exe, 0000000B.00000002.3283444796.0000019B3408C000.00000004.00000800.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://track.analytics-data.io
Source: UnifiedStub-installer.exe, 0000000B.00000002.3283444796.0000019B3408C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://track.analytics-data.io/X
Source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reasonsecurity.com/v2/live
Source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://update-beta.reasonsecurity.com/v2/update
Source: rsSyncSvc.exe, 00000019.00000002.1921438935.0000019D7C686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonse.com/v
Source: rsSyncSvc.exe, 0000001E.00000002.3266265212.00000245547B0000.00000004.00000020.00020000.00000000.sdmp, rsSyncSvc.exe, 0000001E.00000002.3266265212.00000245547B7000.00000004.00000020.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity.com/v2/live
Source: rsSyncSvc.exe, 0000001E.00000002.3266265212.00000245547B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity.com/v2/live-bn:ReasonLabs-dt:10&
Source: rsSyncSvc.exe, 00000019.00000002.1921438935.0000019D7C68C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity.com/v2/live-dt:10
Source: rsSyncSvc.exe, 00000019.00000002.1921438935.0000019D7C68C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity.com/v2/liveING=D
Source: rsSyncSvc.exe, 00000019.00000002.1921438935.0000019D7C68C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity.com/v2/livelive
Source: rsSyncSvc.exe, 0000001E.00000002.3266265212.00000245547B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity.com/v2/livelivell
Source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000002.3283444796.0000019B3408C000.00000004.00000800.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://update.reasonsecurity.com/v2/update
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1578782739.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000A79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webcompanion.com/privacy
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000A79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webcompanion.com/privacyE
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000A79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webcompanion.com/termsP
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000A79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webcompanion.com/termsX
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: https://wiki.cheatengine.org/index.php
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2456178236.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000A90000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002CD9000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.360totalsecurity.com/en/license/
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2171737967.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.360totalsecurity.com/en/license/Z
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2171737967.00000000009E0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2456178236.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000A90000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002CD9000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.360totalsecurity.com/en/privacy/
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508883120.0000000000A93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.avast.c
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508883120.0000000000A93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.avast.com
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000A85000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1578782739.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2456178236.0000000000A94000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000A84000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508883120.0000000000A93000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000A90000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2456178236.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2172039331.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002CD9000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000A94000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2460450691.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.avast.com/eula#pc
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2172217386.0000000004E71000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002CD9000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.avast.com/eula-avast-consumer-products
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2172217386.0000000004E71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.avast.com/eula-avast-consumer-productsC
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002CD9000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000A79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.avast.com/privacy-policy
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2171737967.00000000009E0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1578782739.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2172039331.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002CD9000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2460450691.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.avast.com/privacy-policy#pc
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000A79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.avg.com/ww-en/eulaM
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000A79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.avg.com/ww-en/privacyj
Source: CheatEngine75.exe, 0000000C.00000003.2042781311.00000000023A1000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000003.2035583319.00000000023B1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.cheatengine.org/
Source: CheatEngine75.exe, 0000000C.00000003.1882445843.0000000002530000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000003.1898011309.0000000003490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.cheatengine.org/8https://www.cheatengine.org/8https://www.cheatengine.org/
Source: CheatEngine75.exe, 0000000C.00000003.2042781311.00000000023A1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.cheatengine.org/A
Source: CheatEngine75.tmp, 0000000D.00000003.2035583319.00000000023B1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.cheatengine.org/Q
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2163484819.0000000002350000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2159882150.0000000006D52000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2150822703.0000000004EA9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002CD9000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000A2C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1411738649.0000000002C60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.cheatengine.org/privacy.htm
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2171737967.00000000009E0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2454656622.00000000009FF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cheatengine.org/privacy.htmd
Source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000002.3283444796.0000019B3408C000.00000004.00000800.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.forbes.com/sites/forbestechcouncil/2022/07/13/why-do-hacks-happen-four-ubiquitous-motiva
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1843760686.0000000004F3B000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2451374947.000000000018E000.00000004.00000010.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2456590494.00000000058D5000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2463495772.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2442104275.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2571518040.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441980925.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2440483421.00000000055CC000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441980925.0000000003206000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2457230909.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2455020674.00000000057D3000.00000004.00000020.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1888165639.000000007FE24000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1884318482.0000000002628000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000002.2039167823.000000000018F000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe, 00000000.00000003.1405939759.0000000002670000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe, 00000000.00000003.1407943952.000000007FB70000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000000.1409808513.0000000000401000.00000020.00000001.01000000.00000004.sdmp, CheatEngine75.exe, 0000000C.00000003.1884318482.0000000002530000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1888165639.000000007FB30000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000000.1892916012.0000000000401000.00000020.00000001.01000000.00000018.sdmp	String found in binary or memory: https://www.innosetup.com/
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2159882150.0000000006D27000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A27000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2455203792.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002CD9000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000A2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/global/legal.html
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2159882150.0000000006D27000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/legal
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000A94000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2453900113.00000000009D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/legal.html
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000A61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/legal.htmlD
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000A58000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A55000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000A54000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2456178236.0000000000A5F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/legal.htmlfE
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508883120.0000000000A93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/en-us/policy/legal.htmlmages/DOTPS-855/EN.png
Source: saBSI.exe, 00000005.00000002.2583025617.000000000314E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmp, saBSI.exe, 00000005.00000000.1845266666.0000000000F8E000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/v/wa-how.html
Source: saBSI.exe, 00000005.00000002.2583025617.000000000314E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/v/wa-how.htmlL
Source: saBSI.exe, 00000005.00000002.2583025617.000000000314E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/v/wa-how.htmlW
Source: saBSI.exe, 00000005.00000002.2583025617.000000000314E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mcafee.com/consumer/v/wa-how.htmlf
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002CD9000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.nortonlifelock.com/us/en/legal/license-services-agreement/
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1578782739.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508883120.0000000000A93000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.nortonlifelock.com/us/en/legal/license-services-agreement/G
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002CD9000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.nortonlifelock.com/us/en/privacy/
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2171737967.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.nortonlifelock.com/us/en/privacy/-
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002CD9000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.opera.com/he/eula/computers
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002CD9000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000A79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.opera.com/he/privacy
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: https://www.patreon.com/cheatengine
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	String found in binary or memory: https://www.patreon.com/cheatengineopenhttps://cheatengine.org/http://forum.cheatengine.org/
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2159882150.0000000006CB9000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.premieropinion.
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2159882150.0000000006D36000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.premieropinion.com/common/termsofservice-v1
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A55000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000A54000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2456178236.0000000000A5F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.premieropinion.com/common/termsofservice-v1::
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2159882150.0000000006D6F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.premieropinion.com/pr
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2159882150.0000000006D36000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2163484819.000000000241B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.premieropinion.com/privacy-policy
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A55000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000A54000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2456178236.0000000000A54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.premieropinion.com/privacy-policy:J
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2090140344.0000000004EC1000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2464054224.0000000004EC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.premieropinion.com/privacy-policy:xQ
Source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000002.3283444796.0000019B3408C000.00000004.00000800.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.reasonsecurity.com/
Source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.reasonsecurity.com/safer-web/privacy-policy?utm_source=reason_safer_web_installer
Source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.reasonsecurity.com/safer-web/terms?utm_source=reason_safer_web_installer
Source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.reasonsecurity.com/vpn/privacy-policy?utm_source=reason_vpn_installer
Source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.reasonsecurity.com/vpn/terms?utm_source=reason_vpn_installer
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe, 00000000.00000003.1405939759.0000000002670000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe, 00000000.00000003.1407943952.000000007FB70000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000000.1409808513.0000000000401000.00000020.00000001.01000000.00000004.sdmp, CheatEngine75.exe, 0000000C.00000003.1884318482.0000000002530000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1888165639.000000007FB30000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000000.1892916012.0000000000401000.00000020.00000001.01000000.00000018.sdmp	String found in binary or memory: https://www.remobjects.com/ps
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2171737967.00000000009E0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002CD9000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.winzip.com/win/en/eula.html
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002CD9000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.winzip.com/win/en/privacy.html
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2171737967.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.winzip.com/win/en/privacy.htmlc

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.172.112.34:443 -> 192.168.2.8:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.172.112.34:443 -> 192.168.2.8:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.162.225.150:443 -> 192.168.2.8:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.8:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.230.219.225:443 -> 192.168.2.8:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.230.219.225:443 -> 192.168.2.8:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.173.206.112:443 -> 192.168.2.8:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.20.94.94:443 -> 192.168.2.8:49761 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality for read data from the clipboard

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe

Code function: 7_2_004054B6 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

7_2_004054B6

Installs a raw input device (often for capturing keystrokes)

Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2227248249.0000000008574000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: NtUserGetRawInputData

memstr_30c0b96c-2

Yara detected Keylogger Generic

Source: Yara match

File source: Process Memory Space: cheatengine-x86_64-SSE4-AVX2.exe PID: 4256, type: MEMORYSTR

E-Banking Fraud

Drops certificate files (DER)

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560

Jump to dropped file

System Summary

Submitted sample is a known malware sample

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe

Dropped file: MD5: e346fcecd037f0be2777231949977587 Family: APT37 Alias: Reaper group, Geumseong121, Group 123, Scarcruft, APT-S-008, Red Eyes, TEMP.Reaper, Ricochet Chollima, sun team, APT37 Description: APT37 is a suspected North Korean cyber espionage group that has been in operation since at least 2012. Their targets are primarily located in South Korea, but also Japan, Vietnam, Russia, China, India, and some of the countries in the Middle East. A wider range of industries are affected, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare entities References: https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf https://securelist.com/operation-daybreak/75100/https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/Data Source: https://github.com/RedDrip7/APT_Digital_Weapon

Abnormal high CPU Usage

Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe

Process Stats: CPU usage > 49%

Contains functionality to communicate with device drivers

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Code function: 5_2_00EE6220: GetCurrentProcessId,GetCurrentThreadId,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,DeviceIoControl,DeviceIoControl,

5_2_00EE6220

Contains functionality to delete services

Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe

Code function: 25_2_00007FF7824D4BB0 RegCreateKeyExW,RegCloseKey,OutputDebugStringW,OpenSCManagerW,OpenServiceW,CloseServiceHandle,ControlService,DeleteService,CloseServiceHandle,CloseServiceHandle,StartServiceCtrlDispatcherW,OutputDebugStringW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

25_2_00007FF7824D4BB0

Contains functionality to launch a process as a different user

Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe

Code function: 25_2_00007FF7824FE4D0 WTSGetActiveConsoleSessionId,ProcessIdToSessionId,OpenProcess,OpenProcessToken,CloseHandle,GetLastError,DuplicateTokenEx,CloseHandle,CreateProcessAsUserW,CloseHandle,WaitForSingleObject,CloseHandle,GetLastError,CloseHandle,CloseHandle,CloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

25_2_00007FF7824FE4D0

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe

Code function: 7_2_004033B3 EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

7_2_004033B3

Detected potential crypto function

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Code function: 4_2_00007FFB4B2BA610	4_2_00007FFB4B2BA610
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Code function: 4_2_00007FFB4B2B0E40	4_2_00007FFB4B2B0E40
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Code function: 4_2_00007FFB4B2BD4D1	4_2_00007FFB4B2BD4D1
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Code function: 4_2_00007FFB4B2B94ED	4_2_00007FFB4B2B94ED
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Code function: 4_2_00007FFB4B2BD7A9	4_2_00007FFB4B2BD7A9
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_3_0556F666	5_3_0556F666
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_3_0556E402	5_3_0556E402
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_3_0556E322	5_3_0556E322
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_3_055729D6	5_3_055729D6
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_3_0556CCD2	5_3_0556CCD2
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00EE8FB0	5_2_00EE8FB0
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00EE4F50	5_2_00EE4F50
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00EE5110	5_2_00EE5110
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F1D540	5_2_00F1D540
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F21840	5_2_00F21840
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00EE70D9	5_2_00EE70D9
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00EEF110	5_2_00EEF110
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F073B0	5_2_00F073B0
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F03AC0	5_2_00F03AC0
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F1FFE0	5_2_00F1FFE0
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F18190	5_2_00F18190
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F6C110	5_2_00F6C110
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F283A0	5_2_00F283A0
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F30660	5_2_00F30660
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F68609	5_2_00F68609
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F247C0	5_2_00F247C0
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F70992	5_2_00F70992
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F50919	5_2_00F50919
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F70AB2	5_2_00F70AB2
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F50B4B	5_2_00F50B4B
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F50DB0	5_2_00F50DB0
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00EF8EA0	5_2_00EF8EA0
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00ECCF40	5_2_00ECCF40
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F0D2C0	5_2_00F0D2C0
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F5933A	5_2_00F5933A
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F614AF	5_2_00F614AF
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00EC5400	5_2_00EC5400
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F6D8E0	5_2_00F6D8E0
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F1A540	5_2_00F1A540
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00ECA610	5_2_00ECA610
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F768E0	5_2_00F768E0
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F228A0	5_2_00F228A0
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00EC2B00	5_2_00EC2B00
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F4ADD0	5_2_00F4ADD0
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F26D43	5_2_00F26D43
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F1F150	5_2_00F1F150
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F5B340	5_2_00F5B340
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F2B4F0	5_2_00F2B4F0
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F27602	5_2_00F27602
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00ECF830	5_2_00ECF830
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F539A4	5_2_00F539A4
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F23A30	5_2_00F23A30
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00EFFB40	5_2_00EFFB40
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00EEBCB0	5_2_00EEBCB0
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00EF3C50	5_2_00EF3C50
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00EC7D10	5_2_00EC7D10
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Code function: 6_2_0040CDD5	6_2_0040CDD5
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Code function: 6_2_00418810	6_2_00418810
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Code function: 6_2_004030CF	6_2_004030CF
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Code function: 6_2_00411129	6_2_00411129
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Code function: 6_2_00414B30	6_2_00414B30
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Code function: 6_2_00417420	6_2_00417420
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Code function: 6_2_004144D0	6_2_004144D0
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Code function: 6_2_00419D01	6_2_00419D01
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Code function: 6_2_00419DDB	6_2_00419DDB
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Code function: 6_2_00416E09	6_2_00416E09
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Code function: 7_2_0040727F	7_2_0040727F
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Code function: 7_2_00406AA8	7_2_00406AA8
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Code function: 11_2_00007FFB4B2B18F5	11_2_00007FFB4B2B18F5
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF7824D4BB0	25_2_00007FF7824D4BB0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF7824D71C0	25_2_00007FF7824D71C0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF782539B94	25_2_00007FF782539B94
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF78253CB70	25_2_00007FF78253CB70
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF7824E7B30	25_2_00007FF7824E7B30
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF78253C334	25_2_00007FF78253C334
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF78253A3B4	25_2_00007FF78253A3B4
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF78252E430	25_2_00007FF78252E430
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF7824FE4D0	25_2_00007FF7824FE4D0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF78253B4A0	25_2_00007FF78253B4A0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF78254D18C	25_2_00007FF78254D18C
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF78255F188	25_2_00007FF78255F188
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF782502960	25_2_00007FF782502960
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF782539990	25_2_00007FF782539990
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF7824FC990	25_2_00007FF7824FC990
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF7824F5990	25_2_00007FF7824F5990
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF7824F4140	25_2_00007FF7824F4140
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF782546934	25_2_00007FF782546934
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF78255D1EC	25_2_00007FF78255D1EC
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF7825511E8	25_2_00007FF7825511E8
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF7824E89D0	25_2_00007FF7824E89D0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF78253A1B0	25_2_00007FF78253A1B0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF7824D92F0	25_2_00007FF7824D92F0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF782546314	25_2_00007FF782546314
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF782506AD0	25_2_00007FF782506AD0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF782549F80	25_2_00007FF782549F80
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF78253C76C	25_2_00007FF78253C76C
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF782546180	25_2_00007FF782546180
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF78254AFBC	25_2_00007FF78254AFBC
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF782539FA4	25_2_00007FF782539FA4
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF7824DA080	25_2_00007FF7824DA080
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF782551868	25_2_00007FF782551868
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF782552870	25_2_00007FF782552870
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF782556850	25_2_00007FF782556850
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF78254E024	25_2_00007FF78254E024
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF78253B824	25_2_00007FF78253B824
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF78253B108	25_2_00007FF78253B108
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF7825440B0	25_2_00007FF7825440B0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF782550D54	25_2_00007FF782550D54
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF7824DB5E0	25_2_00007FF7824DB5E0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF7825565D4	25_2_00007FF7825565D4
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF782539DA0	25_2_00007FF782539DA0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF7824E3660	25_2_00007FF7824E3660
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF7824DF6E0	25_2_00007FF7824DF6E0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF78255F6D4	25_2_00007FF78255F6D4
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Code function: 31_2_00007FF62D7C1330	31_2_00007FF62D7C1330
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Code function: 31_2_00007FF62D7CCA9C	31_2_00007FF62D7CCA9C
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Code function: 31_2_00007FF62D7CB594	31_2_00007FF62D7CB594
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Code function: 31_2_00007FF62D7D3FF8	31_2_00007FF62D7D3FF8
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Code function: 33_2_010A150E	33_2_010A150E
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Code function: 33_2_01095560	33_2_01095560
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Code function: 33_2_010015B0	33_2_010015B0
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Code function: 33_2_010015B5	33_2_010015B5
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Code function: 33_2_0109C9E8	33_2_0109C9E8
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Code function: 33_2_01002810	33_2_01002810
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Code function: 33_2_0109101F	33_2_0109101F
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Code function: 33_2_0109F05B	33_2_0109F05B
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Code function: 33_2_01001860	33_2_01001860
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Code function: 33_2_01001F60	33_2_01001F60
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Code function: 33_2_01002FB0	33_2_01002FB0
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Code function: 33_2_010A13EE	33_2_010A13EE
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Code function: 33_2_01003690	33_2_01003690
Source: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe	Code function: 38_2_00401A30	38_2_00401A30
Source: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe	Code function: 38_2_00411500	38_2_00411500
Source: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe	Code function: 38_2_00405640	38_2_00405640
Source: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe	Code function: 38_2_00404660	38_2_00404660
Source: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe	Code function: 38_2_00413760	38_2_00413760
Source: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe	Code function: 38_2_00412700	38_2_00412700
Source: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe	Code function: 38_2_00404C70	38_2_00404C70
Source: C:\Program Files\Cheat Engine 7.5\windowsrepair.exe	Code function: 39_2_00409AF0	39_2_00409AF0
Source: C:\Program Files\Cheat Engine 7.5\windowsrepair.exe	Code function: 39_2_0041DDE0	39_2_0041DDE0
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Code function: 45_2_00007FFB4B2D18F5	45_2_00007FFB4B2D18F5
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Code function: 46_2_0042C740	46_2_0042C740
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Code function: 46_2_004240F0	46_2_004240F0
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Code function: 46_2_00404160	46_2_00404160
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Code function: 46_2_004282F0	46_2_004282F0
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Code function: 46_2_004253E0	46_2_004253E0
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Code function: 46_2_004274F0	46_2_004274F0
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Code function: 46_2_00422535	46_2_00422535
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Code function: 46_2_0042B690	46_2_0042B690
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Code function: 46_2_0043B840	46_2_0043B840
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Code function: 46_2_004238B0	46_2_004238B0
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Code function: 46_2_00402A20	46_2_00402A20
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Code function: 46_2_00403B50	46_2_00403B50
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Code function: 46_2_00402B00	46_2_00402B00
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Code function: 46_2_00404B30	46_2_00404B30
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Code function: 46_2_0043AF20	46_2_0043AF20

Enables driver privileges

Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe

Process token adjusted: Load Driver

Enables security privileges

Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe

Process token adjusted: Security

Found potential string decryption / allocating functions

Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: String function: 00007FF7824D3810 appears 34 times
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: String function: 00007FF7824EE250 appears 58 times
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: String function: 00007FF7824D1DB0 appears 68 times
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Code function: String function: 004031E3 appears 37 times
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Code function: String function: 004197D0 appears 120 times
Source: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe	Code function: String function: 00401490 appears 35 times
Source: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe	Code function: String function: 004036A0 appears 86 times
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: String function: 00F48E31 appears 83 times
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: String function: 00F49600 appears 60 times
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: String function: 00F08650 appears 192 times
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: String function: 00F485BF appears 56 times
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: String function: 00F48713 appears 374 times
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: String function: 00F48375 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: String function: 00ED1BE0 appears 70 times
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: String function: 00F48DFE appears 103 times
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: String function: 00F64231 appears 31 times

PE file contains executable resources (Code or Archives)

Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: installer.exe.5.dr	Static PE information: Resource name: PAYLOAD type: Microsoft Cabinet archive data, many, 28277285 bytes, 132 files, at 0x2c +A "analyticsmanager.cab" +A "analyticstelemetry.cab", number 1, 993 datablocks, 0x1 compression

Sample file is different than original file name gathered from version info

Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe, 00000000.00000003.2478930076.0000000002298000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe, 00000000.00000003.1405939759.0000000002670000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe, 00000000.00000003.1407943952.000000007FB70000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe, 00000000.00000000.1402396274.00000000004C6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe

Uses 32bit PE files

Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

query blbeacon for getting browser version

Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp

Key value queried: HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon version

Jump to behavior

Source: rsAtom.dll.6.dr, y6HIThX7g6QtDvHSgF.cs	Cryptographic APIs: 'CreateDecryptor'
Source: rsAtom.dll.6.dr, y6HIThX7g6QtDvHSgF.cs	Cryptographic APIs: 'CreateDecryptor'
Source: rsAtom.dll.6.dr, y6HIThX7g6QtDvHSgF.cs	Cryptographic APIs: 'CreateDecryptor'
Source: rsAtom.dll.6.dr, y6HIThX7g6QtDvHSgF.cs	Cryptographic APIs: 'CreateDecryptor'
Source: rsDatabase.dll.6.dr, jTQUkyXTEdtNfPRZPx.cs	Cryptographic APIs: 'CreateDecryptor'
Source: rsDatabase.dll.6.dr, jTQUkyXTEdtNfPRZPx.cs	Cryptographic APIs: 'CreateDecryptor'
Source: rsDatabase.dll.6.dr, jTQUkyXTEdtNfPRZPx.cs	Cryptographic APIs: 'CreateDecryptor'
Source: rsDatabase.dll.6.dr, jTQUkyXTEdtNfPRZPx.cs	Cryptographic APIs: 'CreateDecryptor'
Source: rsJSON.dll.6.dr, J0mSrijoaAO8NrjmXU.cs	Cryptographic APIs: 'CreateDecryptor'
Source: rsJSON.dll.6.dr, J0mSrijoaAO8NrjmXU.cs	Cryptographic APIs: 'CreateDecryptor'
Source: rsJSON.dll.6.dr, J0mSrijoaAO8NrjmXU.cs	Cryptographic APIs: 'CreateDecryptor'
Source: rsJSON.dll.6.dr, J0mSrijoaAO8NrjmXU.cs	Cryptographic APIs: 'CreateDecryptor'

Source: CheatEngine75.tmp, 0000000D.00000003.2035583319.0000000002344000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI.sln
Source: icacls.exe, 00000029.00000003.2021718540.0000028AD3375000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: example-c.sln`
Source: CheatEngine75.tmp, 0000000D.00000003.2035583319.0000000002344000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector.sln
Source: icacls.exe, 00000029.00000003.2019412948.0000028AD3386000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: *MonoDataCollector.sln
Source: icacls.exe, 00000029.00000003.2021372247.0000028AD337E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ,CEPluginLibrary.csproj`\
Source: CheatEngine75.tmp, 0000000D.00000003.1898011309.0000000003490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Z{app}\plugins\c# template\CEPluginLibrary.sln
Source: CheatEngine75.tmp, 0000000D.00000003.2035583319.00000000022C2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 1{app}\autorun\dlls\src\Mono\MonoDataCollector.sln
Source: CheatEngine75.tmp, 0000000D.00000003.2035583319.000000000238D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: %{app}\plugins\example-c\example-c.sln
Source: CheatEngine75.tmp, 0000000D.00000003.2035583319.0000000002352000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\Cheat Engine 7.5\plugins\example-c\example-c.sln
Source: CheatEngine75.tmp, 0000000D.00000003.2035583319.000000000228F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\CEPluginLibrary.csproj
Source: CheatEngine75.tmp, 0000000D.00000003.2035583319.000000000232D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: -{app}\plugins\c# template\CEPluginLibrary.sln!
Source: CheatEngine75.tmp, 0000000D.00000003.1898011309.0000000003490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ^{app}\autorun\dlls\src\Java\CEJVMTI\CEJVMTI.sln
Source: CheatEngine75.tmp, 0000000D.00000003.1898011309.0000000003490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: J{app}\plugins\example-c\example-c.sln
Source: CheatEngine75.tmp, 0000000D.00000003.2035583319.0000000002344000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary.sln
Source: CheatEngine75.tmp, 0000000D.00000003.1898011309.0000000003490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: {app}\plugins\c# template\CEPluginLibrary\CEPluginLibrary.csproj
Source: CheatEngine75.tmp, 0000000D.00000003.1898011309.0000000003490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: b{app}\autorun\dlls\src\Mono\MonoDataCollector.sln
Source: CheatEngine75.tmp, 0000000D.00000003.2035583319.000000000232D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: /{app}\autorun\dlls\src\Java\CEJVMTI\CEJVMTI.slnq
Source: CheatEngine75.tmp, 0000000D.00000003.2035583319.000000000231C000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: @{app}\plugins\c# template\CEPluginLibrary\CEPluginLibrary.csproj
Source: icacls.exe, 00000029.00000003.2018899124.0000028AD338E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CEJVMTI.sln

Source: classification engine

Classification label: mal46.troj.spyw.evad.winEXE@72/800@11/6

Source: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe

Code function: 38_2_0040E500 GetLastError,FormatMessageW,

38_2_0040E500

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe

7_2_004033B3

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe

Code function: 7_2_00404766 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

7_2_00404766

Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe

Code function: OutputDebugStringW,GetModuleFileNameW,OpenSCManagerW,CreateServiceW,ChangeServiceConfig2W,StartServiceW,CloseServiceHandle,CloseServiceHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,OutputDebugStringW,RegisterServiceCtrlHandlerExW,OutputDebugStringW,SetServiceStatus,OutputDebugStringW,OutputDebugStringW,CreateEventW,OutputDebugStringW,GetLastError,SetServiceStatus,OutputDebugStringW,SetServiceStatus,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,WaitForSingleObject,OutputDebugStringW,OutputDebugStringW,CloseHandle,SetServiceStatus,OutputDebugStringW,OutputDebugStringW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,OutputDebugStringW,OutputDebugStringW,SetServiceStatus,OutputDebugStringW,SetEvent,OutputDebugStringW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

25_2_00007FF7824D71C0

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Code function: 5_2_00ED4C8E GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,FindCloseChangeNotification,

5_2_00ED4C8E

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Code function: 5_2_00ED5C1E CoCreateInstance,OleRun,

5_2_00ED5C1E

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Code function: 5_2_00EF5318 GetModuleHandleW,FindResourceW,LoadResource,LockResource,std::ios_base::_Ios_base_dtor,GetModuleHandleW,GetProcAddress,GetCurrentProcess,Concurrency::cancel_current_task,Concurrency::cancel_current_task,SysFreeString,SysFreeString,

5_2_00EF5318

Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe

25_2_00007FF7824D4BB0

Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe

25_2_00007FF7824D4BB0

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe

File created: C:\Program Files (x86)\WeatherZero

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2688:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Mutant created: \Sessions\1\BaseNamedObjects\{6F44C754-77E7-4687-80D4-B48E574DF023}Installer
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5744:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3524:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Mutant created: \Sessions\1\BaseNamedObjects\Global\{6F44C754-77E7-4687-80D4-B48E574DF023}Installer
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1668:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4568:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{48ca68e-e4ff-43ac-a993-6d162f33de7c}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3116:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3636:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4300:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3712:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2352:120:WilError_03

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe

File created: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\CheatEngine75.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\CheatEngine75.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - Root\CIMV2 : Select * from Win32_Process where name='browserhost.exe' and SessionId=1 and commandline like '%{4ED1F68A-5463-4931-9384-8FFF5ED91D92}%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - Root\CIMV2 : Select * from Win32_Process where name='browserhost.exe' and SessionId=1 and commandline like '%fdhgeoginicibhagdmblfikbgbkahibd%'
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - Root\CIMV2 : Select * from Win32_Process where name='browserhost.exe' and SessionId=1 and commandline like '%{4ED1F68A-5463-4931-9384-8FFF5ED91D92}%'

Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	Binary or memory string: create table modules(ptrid integer not null, moduleid integer not null, name char(256) not null, primary key (ptrid, moduleid) );
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	Binary or memory string: CREATE TABLE pointerfiles (`ptrid`INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,`name`char(256) NOT NULL,`maxlevel`INTEGER,`compressedptr`INTEGER,`unalligned`INTEGER,`MaxBitCountModuleIndex`INTEGER,`MaxBitCountModuleOffset`INTEGER,`MaxBitCountLevel`INTEGER,`MaxBitCountOffset`INTEGER,`DidBaseRangeScan`INTEGER,`BaseScanRange`INTEGER);
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	Binary or memory string: CREATE TABLE pointerfiles_endwithoffsetlist ( `ptrid`INTEGER NOT NULL, `offsetnr`INTEGER NOT NULL, `offsetvalue`INTEGER NOT NULL, PRIMARY KEY(ptrid,offsetnr));

Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe

ReversingLabs: Detection: 47%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-UC9I1.tmp\_isetup\_setup64.tmp

Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe	Process created: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp "C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp" /SL5="$20462,29086952,780800,C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe"
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe "C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe" -ip:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240727184154&is_silent=true&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100&b=&se=true" -vp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240727184154&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100&oip=26&ptl=7&dta=true" -dp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240727184154&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100" -i -v -d -se=true
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe "C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process created: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe "C:\Users\user\AppData\Local\Temp\3yq4abxg.exe" /silent
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe "C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe" /S /tpchannelid=1571 /distid=App123
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe .\UnifiedStub-installer.exe /silent
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\CheatEngine75.exe "C:\Users\user\AppData\Local\Temp\is-H908U.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\CheatEngine75.exe	Process created: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp "C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp" /SL5="$901D6,26511452,832512,C:\Users\user\AppData\Local\Temp\is-H908U.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process created: C:\Windows\System32\net.exe "net" stop BadlionAntic
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 stop BadlionAntic
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process created: C:\Windows\System32\net.exe "net" stop BadlionAnticheat
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 stop BadlionAnticheat
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process created: C:\Windows\System32\sc.exe "sc" delete BadlionAntic
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process created: C:\Windows\System32\sc.exe "sc" delete BadlionAnticheat
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-UC9I1.tmp\_isetup\_setup64.tmp helper 105 0x44C
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process created: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe "C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:10
Source: C:\Users\user\AppData\Local\Temp\is-UC9I1.tmp\_isetup\_setup64.tmp	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process created: C:\Windows\System32\icacls.exe "icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)
Source: C:\Windows\System32\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe "C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -bn:ReasonLabs -dt:10
Source: unknown	Process created: C:\Program Files\ReasonLabs\EPP\Uninstall.exe "C:\Program Files\ReasonLabs\EPP\Uninstall.exe" /auto-repair=UnifiedStub
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Process created: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe "C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe" /products=epp /auto-repair=UnifiedStub
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Process created: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe "C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe" install
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Process created: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe "C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe" start silent
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe "C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe"
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process created: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe "C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe" /SETUP
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process created: C:\Program Files\Cheat Engine 7.5\windowsrepair.exe "C:\Program Files\Cheat Engine 7.5\windowsrepair.exe" /s
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process created: C:\Windows\System32\icacls.exe "icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)
Source: C:\Windows\System32\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe .\UnifiedStub-installer.exe /products=epp /auto-repair=UnifiedStub
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process created: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe "C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe"
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Process created: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe "C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe"
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process created: C:\Users\user\AppData\Local\Temp\Stub.exe "C:\Users\user\AppData\Local\Temp\Stub.exe" /products=epp /auto-repair=UnifiedStub
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe	Process created: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp "C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp" /SL5="$20462,29086952,780800,C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe "C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe" -ip:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240727184154&is_silent=true&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100&b=&se=true" -vp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240727184154&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100&oip=26&ptl=7&dta=true" -dp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240727184154&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100" -i -v -d -se=true	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe "C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe "C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe" /S /tpchannelid=1571 /distid=App123	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\CheatEngine75.exe "C:\Users\user\AppData\Local\Temp\is-H908U.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process created: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe "C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process created: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe "C:\Users\user\AppData\Local\Temp\3yq4abxg.exe" /silent	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe .\UnifiedStub-installer.exe /silent	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Process created: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe "C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe" install	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Process created: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe "C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe" start silent	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process created: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe "C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:10
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\CheatEngine75.exe	Process created: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp "C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp" /SL5="$901D6,26511452,832512,C:\Users\user\AppData\Local\Temp\is-H908U.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process created: C:\Windows\System32\net.exe "net" stop BadlionAntic
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process created: C:\Windows\System32\net.exe "net" stop BadlionAnticheat
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process created: C:\Windows\System32\sc.exe "sc" delete BadlionAntic
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process created: C:\Windows\System32\sc.exe "sc" delete BadlionAnticheat
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-UC9I1.tmp\_isetup\_setup64.tmp helper 105 0x44C
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process created: C:\Windows\System32\icacls.exe "icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process created: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe "C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe" /SETUP
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process created: C:\Program Files\Cheat Engine 7.5\windowsrepair.exe "C:\Program Files\Cheat Engine 7.5\windowsrepair.exe" /s
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process created: C:\Windows\System32\icacls.exe "icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 stop BadlionAntic
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 stop BadlionAnticheat
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Process created: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe "C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe" /products=epp /auto-repair=UnifiedStub
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Process created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe .\UnifiedStub-installer.exe /products=epp /auto-repair=UnifiedStub
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process created: C:\Users\user\AppData\Local\Temp\Stub.exe "C:\Users\user\AppData\Local\Temp\Stub.exe" /products=epp /auto-repair=UnifiedStub
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Process created: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe "C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe"
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: globinputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: zipfldr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: mscorjit.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: mscorjit.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: msvcp140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: mscorjit.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: taskschd.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: sxs.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\CheatEngine75.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\CheatEngine75.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\CheatEngine75.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\CheatEngine75.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\CheatEngine75.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: msftedit.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: windows.globalization.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: bcp47mrm.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: globinputhost.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Section loaded: cscapi.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\net1.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\net1.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\net1.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\is-UC9I1.tmp\_isetup\_setup64.tmp	Section loaded: ntmarta.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: apphelp.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: version.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: urlmon.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: powrprof.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: winhttp.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: iertutil.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: srvcli.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: netutils.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: umpdc.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\icacls.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: version.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: urlmon.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: powrprof.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: winhttp.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: iertutil.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: srvcli.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: netutils.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: umpdc.dll
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Section loaded: wldp.dll
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Section loaded: apphelp.dll
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Section loaded: userenv.dll
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Section loaded: winsta.dll
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Cheat Engine 7.5\windowsrepair.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\icacls.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: mscorjit.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Section loaded: wldp.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Section loaded: propsys.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Section loaded: profapi.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Section loaded: edputil.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Section loaded: urlmon.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Section loaded: iertutil.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Section loaded: srvcli.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Section loaded: netutils.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Section loaded: wintypes.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Section loaded: appresolver.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Section loaded: bcp47langs.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Section loaded: slc.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Section loaded: userenv.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Section loaded: sppc.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: version.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: opengl32.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: wsock32.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: winmm.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: lua53-64.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: wininet.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: glu32.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: msimg32.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: explorerframe.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: tcc64-32.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: tcc64-64.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: wldp.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: propsys.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: textshaping.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: xinput1_4.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: devobj.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: inputhost.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: wintypes.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: iertutil.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: profapi.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: winhttp.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: mswsock.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: winnsi.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: urlmon.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: srvcli.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: netutils.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: schannel.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: mskeyprotect.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: ntasn1.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: dpapi.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: gpapi.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: ncrypt.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: ncryptsslp.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: textinputframework.dll
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Section loaded: duser.dll

Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Reads the Windows registered owner settings

Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Executable creates window controls seldom found in malware

Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp

Window found: window name: TSelectLanguageForm

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Automated click: Accept
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Automated click: Accept
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Automated click: Accept
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Automated click: Next
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Automated click: OK

Uses Rich Edit Controls

Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Found window with many clickable UI elements (buttons, textforms, scrollbars etc)

Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Window detected: Number of UI elements: 24
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Window detected: Number of UI elements: 39

Uses Microsoft Silverlight

Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Creates a directory in C:\Program Files

Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Stub
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\EPP\Uninstall.exe
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Directory created: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\unins000.dat
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-1U45L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-KLETU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-MV96K.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-1HAUB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-04JI4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-R767B.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-APHCK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-UJMF9.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-OUQ5Q.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\win32
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\win32\is-OH84O.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\win64
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\win64\is-F9V6M.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\win32\is-A3GKJ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\win64\is-356FE.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\win32\is-7KKVU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\win64\is-HNC5I.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-SBH22.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-VP6HP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-AJB6K.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-4H8E2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-IM0FE.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-TTU3J.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-JBLAJ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-PP0OR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-OQMOE.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-7TSFI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-RKO1I.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-8G4IN.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-A5OSQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-7DIKH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-FC05A.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-ERBSE.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-27N0B.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-LR956.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-L3GJI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-AATAN.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-RUAAP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-MRM89.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-81GE3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-7NK6B.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-76J7R.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\tcclib
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\tcclib\lib
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\tcclib\lib\is-23JOJ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\tcclib\is-V0OQK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\tcclib\is-K56C1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\tcclib\is-47N79.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-9UL4R.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-4232T.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-0PACH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-S6USS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-KITFQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-7UMKO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-INTCK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-MKK0B.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-51LG7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-5BN1Q.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-0K952.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-J1VDF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-PL1GR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-EUHVU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-77A2I.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-MG740.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-DANGD.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-C2D8P.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-6QL5T.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-48C7L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-HBL1M.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-FEKQ6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-2OU3Q.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-1C906.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-T0LBE.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-RE8LQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-4IT51.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-AGEPC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-OK78B.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-F8B1F.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-C9L6B.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-BF42V.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-HH378.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-0PE6T.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-VDPOG.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-G42GM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-CE1AR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-EE2JR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-G3L07.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-E1KQ9.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-JMF9S.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\is-SE4Q2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-TSDM9.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-EEKRH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-706F4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-P9BF9.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-PKD7D.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-7T9K6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-PU1PA.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-CKLD9.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-U65KB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-VB57V.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-MVJR7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\is-S8NHP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\sys
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sec_api\sys\is-N2NHS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sys
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-FQ2UK.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-4DSRI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-QHAUI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-MUO8O.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-0I53U.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-GL0L4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-PTQPB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-74NLM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\sys\is-OSJ7L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\tcc
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\tcc\is-JASML.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-92IBT.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-1S69F.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-97NTF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-P2U2R.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-2RB3V.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-GLR8Q.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-93UT7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-MUNGH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-5UQJA.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-GCQCF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-H9J2J.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-BBNAD.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-FJ0FL.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-4CQ17.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-1NSDB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-PTTF7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-SIKIP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\include\winapi\is-AD97Q.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-ASU18.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-NNHHO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-SJKQD.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-8HLKV.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-PMK62.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-5DOON.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-AUJ8A.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-MUHHF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-DSI7G.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-SQBUT.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-87427.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-EJPQ1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-A30LA.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-VADJ1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\languages
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\languages\is-OLBHT.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\languages\is-ERRVD.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\languages\is-L6R39.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\languages\is-QPVNS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\languages\is-IGC53.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\languages\is-IVS6D.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\languages\is-CIE95.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\languages\is-2CQ46.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\languages\is-FPKDI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\languages\is-PGR7M.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\languages\is-EBM2L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-0K02L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-V9D11.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-6LSG2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-BQRFH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-GGMI4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-NS6P9.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-JFC09.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-QQIJI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-J3Q59.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-Q18K1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-2V4D2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-60OMG.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-UQL2S.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-IPTJ2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-V5KV6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-3GI42.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-E8L5M.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-RQ2S3.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-747JC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\forms
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\forms\is-158C0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-RU1SE.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-RPLOS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-VK6QC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\images
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\images\is-U6823.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\images\is-0BI9T.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-J71N7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-033OV.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-HJUU2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-G334Q.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-8AE8P.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-T3S7T.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-4TPRM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-V5CNU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-EAD3D.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\forms\is-Q50JT.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\forms\is-IH2QN.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-NCP20.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-B180O.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\is-JRPTO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-VGUUS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-N4PLP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-6JEUL.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-SKFQ5.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-G7CFT.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-LUTQ1.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-ON5UP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-CNEHS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-UV0PJ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-KK89E.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-ESJ6U.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-FJD1M.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-4M6BM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-645IR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\images
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\images\is-F7D0S.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\xml
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\xml\is-VSIQB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\clibs32
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\clibs32\is-AQQPT.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\clibs64
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\clibs64\is-701OU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-397QA.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-BGU0I.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\32
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\32\is-5VCS0.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\64
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\64\is-0JUIF.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-UD451.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\is-1H9D4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-0OQDO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-TS9A7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-R3SMO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-IVICO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-6LEET.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-UOGUT.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-J1K98.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-OHV06.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-5SV36.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-0AS3A.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-SS3Q8.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\is-MB3S7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-89BIB.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-MKUU5.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-3Q8BH.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-V7A9J.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-A8Q85.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-U1HA7.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-K4H2Q.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-1EM51.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-VOMKC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Common
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Common\is-HB4M8.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Common\is-06D9S.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-DSBVA.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-U9FAM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-QFQ4U.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\is-9GQEE.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\is-JAMT5.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\is-BRK2U.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\is-R1OD4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\is-1DI29.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\is-FKENA.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\is-Q5JOQ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\is-I51PG.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\is-SJNR4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-VQTQI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-TIQC2.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-DAA8Q.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-TD7IO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-1177L.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-NBF0F.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-PMDDR.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-VT36S.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\is-RCCJA.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-ILHTP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-J74FA.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-RN0P9.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-OOK6A.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-RUQFN.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-N4S80.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-MNOFM.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-GJETC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-1VL61.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-7HB6K.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\Properties
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\Properties\is-CEIJS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\bin
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\bin\Release
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\bin\Release\is-QAU98.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-O71KG.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-L37DV.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-L7LJI.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-01QEO.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-PVGIS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-CUSKP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-17K0H.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-IOO6H.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-LT1SS.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-FS25O.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-27QGG.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-9SETD.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-H42I8.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-08GVN.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-83TT8.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-V8UK4.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\badassets\is-PPAMP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\is-SNPLC.tmp
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Directory created: C:\Program Files\Cheat Engine 7.5\unins000.msg
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Directory created: C:\Program Files\Cheat Engine 7.5\autorun\ceshare\server.txt

Creates a software uninstall entry

Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ReasonLabs-EPP

PE / OLE file has a valid certificate

Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe

Static file information: File size 29977368 > 1048576

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: shlwapi.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2118878537.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2173916136.00000000086F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: UxTheme.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2122434367.0000000008EED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CLBCatQ.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2163289242.000000000985B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Windows.Storage.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2194997737.00000000099C7000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2197941230.00000000099C7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: profapi.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2222821125.00000000093F6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winmm.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2137865690.0000000008EFF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntmarta.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2228947878.0000000009BD4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: glu32.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2197030680.0000000008F0B000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2128686001.0000000008F0B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\rsSyncSvc\rsSyncSvc\x64\Release\rsSyncSvc.pdb< source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, rsSyncSvc.exe, 00000019.00000000.1918136023.00007FF782567000.00000002.00000001.01000000.0000001A.sdmp, rsSyncSvc.exe, 00000019.00000002.1922544985.00007FF782567000.00000002.00000001.01000000.0000001A.sdmp, rsSyncSvc.exe, 0000001E.00000002.3276180421.00007FF782567000.00000002.00000001.01000000.0000001A.sdmp, rsSyncSvc.exe, 0000001E.00000000.1920370235.00007FF782567000.00000002.00000001.01000000.0000001A.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: shcore.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2173754543.00000000086EC000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2151062995.00000000086EC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CoreMessaging.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2228947878.0000000009BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winnsi.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2222821125.0000000009419000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net452\Microsoft.Win32.TaskScheduler.pdbSHA256 source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000002.3321945122.0000019B4CE52000.00000002.00000001.01000000.00000032.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\git\cheat-engine\Cheat Engine\bin\lua53-64.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2151918393.0000000008F11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dbghelp.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2174085824.0000000009B7F000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2228947878.0000000009B7F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: advapi32.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2133387170.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: XInput1_4.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2228947878.0000000009BAA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: netutils.pdbbbK source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2222821125.0000000009572000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sspicli.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2222821125.00000000093F0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\git\cheat-engine\Cheat Engine\bin\tcc64-32.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2174085824.0000000009911000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CLBCatQ.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2163289242.000000000985B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntmarta.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2228947878.0000000009BD4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rsDatabase.pdb source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: UxTheme.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2122434367.0000000008EED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcp_win.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2228662166.0000000007CEE000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2117545096.0000000007CAD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winnsi.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2222821125.0000000009419000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\rsStubActivator\rsStubActivator\rsStubActivator\obj\Release\net462\rsStubActivator.pdb$1>1 01_CorExeMainmscoree.dll source: prod0.exe, 00000004.00000000.1813402829.000002A3CF932000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: c:\jenkins\workspace\ebAdvisor_WABinary_release_4.1.1\build\Win32\Release\SaBsi.pdb source: saBSI.exe, 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmp, saBSI.exe, 00000005.00000000.1845266666.0000000000F8E000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: shlwapi.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2118878537.00000000086F4000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2173916136.00000000086F4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WLDP.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2201559902.0000000009A5C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\dev\sqlite\dotnet\obj\2015\System.Data.SQLite.2015\Release\System.Data.SQLite.pdb@ source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: propsys.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2184312242.0000000009AB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sspicli.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2222821125.00000000093F0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net452\Microsoft.Win32.TaskScheduler.pdb source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000002.3321945122.0000019B4CE52000.00000002.00000001.01000000.00000032.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: combase.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2220370244.0000000008594000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\rsSyncSvc\rsSyncSvc\x64\Release\rsSyncSvc.pdb source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, rsSyncSvc.exe, 00000019.00000000.1918136023.00007FF782567000.00000002.00000001.01000000.0000001A.sdmp, rsSyncSvc.exe, 00000019.00000002.1922544985.00007FF782567000.00000002.00000001.01000000.0000001A.sdmp, rsSyncSvc.exe, 0000001E.00000002.3276180421.00007FF782567000.00000002.00000001.01000000.0000001A.sdmp, rsSyncSvc.exe, 0000001E.00000000.1920370235.00007FF782567000.00000002.00000001.01000000.0000001A.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: win32u.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2148792759.0000000007CBF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gdi32full.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2117545096.0000000007CED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CoreMessaging.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2228947878.0000000009BC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bcryptprimitives.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2179075086.0000000009800000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dbghelp.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2174085824.0000000009B7F000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2228947878.0000000009B7F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\git\cheat-engine\Cheat Engine\bin\tcc64-32.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2174085824.0000000009911000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wsock32.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2178434787.0000000008EE7000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2128686001.0000000008EE7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ExplorerFrame.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2197941230.00000000098B6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: imm32.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2112822903.00000000086DE000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2151062995.00000000086DE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rsAtom.pdb source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000002.3319865235.0000019B4C9D2000.00000002.00000001.01000000.00000031.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: glu32.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2197030680.0000000008F0B000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2128686001.0000000008F0B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: opengl32.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2137865690.0000000008EF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: profapi.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2222821125.00000000093F6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: comdlg32.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2139633733.0000000008D4A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws2_32.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2116863682.0000000008712000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2227495299.0000000008712000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2117545096.0000000007CA2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\rsStubActivator\rsStubActivator\rsStubActivator\obj\Release\net462\rsStubActivator.pdb source: prod0.exe, 00000004.00000000.1813402829.000002A3CF932000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: WLDP.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2201559902.0000000009A5C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rsTime.pdb source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: imm32.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2112822903.00000000086DE000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2151062995.00000000086DE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: advapi32.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2133387170.0000000007CF3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: propsys.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2184312242.0000000009AB7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: gdi32full.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2117545096.0000000007CED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: winmm.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2137865690.0000000008EFF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msctf.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2228947878.0000000009B99000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2155421442.0000000009B22000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msctf.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2228947878.0000000009B99000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2155421442.0000000009B22000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\rsStub\rsStub\rsStubLib\obj\Release\rsStubLib.pdb source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000002D.00000002.2201075023.000001FA2F4B2000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: version.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2145426436.0000000008EDB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ole32.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2112822903.00000000086D8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ^Do not load external debug symbols like .PDB/.DBG files (Breaks tables that use these symbols) source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp
Source:	Binary string: D:\git\cheat-engine\Cheat Engine\bin\lua53-64.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2151918393.0000000008F11000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ExplorerFrame.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2197941230.00000000098B6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\A\_work\39\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.ValueTuple\netfx\System.ValueTuple.pdb source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcp_win.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2228662166.0000000007CEE000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2117545096.0000000007CAD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: opengl32.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2137865690.0000000008EF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\rsStub\rsStub\ArchiveUtility\bin\Release\x64\ArchiveUtility.pdb source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\a\rsStub\rsStub\UnifiedStub\obj\Release\UnifiedStub.pdb source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: hhctrl.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2128686001.0000000008EF3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bcryptprimitives.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2179075086.0000000009800000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Windows.Storage.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2194997737.00000000099C7000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2197941230.00000000099C7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: combase.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2220370244.0000000008594000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\dev\sqlite\dotnet\obj\2015\System.Data.SQLite.2015\Release\System.Data.SQLite.pdb source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: ws2_32.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2116863682.0000000008712000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: hhctrl.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2128686001.0000000008EF3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: added an option to skip loading .PDB files source: CheatEngine75.exe, 0000000C.00000003.1882445843.0000000002530000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.2042781311.0000000002318000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000003.2031697249.0000000003781000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000003.2030897563.00000000007FE000.00000004.00000020.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000003.2031073742.00000000007D3000.00000004.00000020.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000003.1898011309.0000000003490000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000003.2035583319.00000000022D7000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: rsLogger.pdb source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000002D.00000002.2185072195.000001FA16D82000.00000002.00000001.01000000.0000002A.sdmp, UnifiedStub-installer.exe, 0000002D.00000002.2186104264.000001FA16E9D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ole32.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2112822903.00000000086D8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\rsStub\rsStub\rsStubRunner\rsStubRunner\bin\Release\x64\rsStubRunner.pdb source: 3yq4abxg.exe, 00000006.00000003.1871952838.0000000002C00000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1871604014.0000000002A40000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.000000000326D000.00000004.00001000.00020000.00000000.sdmp, 3yq4abxg.exe, 00000006.00000003.1872499187.00000000032AE000.00000004.00001000.00020000.00000000.sdmp, Uninstall.exe, 0000001F.00000002.1971316751.00007FF62D7D6000.00000002.00000001.01000000.0000001B.sdmp, Uninstall.exe, 0000001F.00000000.1933226506.00007FF62D7D6000.00000002.00000001.01000000.0000001B.sdmp, Stub.exe, 00000020.00000003.2057681827.000000000325D000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.000000000329E000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2056875449.0000000002BF0000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2056593501.0000000002A30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: shcore.pdb0 source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2173754543.00000000086EC000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2151062995.00000000086EC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rsJSON.pdb source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000002.3282773301.0000019B32872000.00000002.00000001.01000000.00000030.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: rsLogger.pdbx source: 3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000002D.00000002.2185072195.000001FA16D82000.00000002.00000001.01000000.0000002A.sdmp, UnifiedStub-installer.exe, 0000002D.00000002.2186104264.000001FA16E9D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: comctl32.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2145426436.0000000008EE1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wsock32.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2178434787.0000000008EE7000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2128686001.0000000008EE7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdb source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2227495299.0000000008712000.00000004.00000020.00020000.00000000.sdmp, cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2117545096.0000000007CA2000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: rsAtom.dll.6.dr, y6HIThX7g6QtDvHSgF.cs	.Net Code: Type.GetTypeFromHandle(ItqYB4NP8yUiw7DZ59.OYH5ev1b2hdXs(16777354)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(ItqYB4NP8yUiw7DZ59.OYH5ev1b2hdXs(16777271)),Type.GetTypeFromHandle(ItqYB4NP8yUiw7DZ59.OYH5ev1b2hdXs(16777320))})
Source: rsDatabase.dll.6.dr, jTQUkyXTEdtNfPRZPx.cs	.Net Code: Type.GetTypeFromHandle(CJI6ksmAfV9lqr5bFV.GWHS8jinbvjcW(16777351)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(CJI6ksmAfV9lqr5bFV.GWHS8jinbvjcW(16777267)),Type.GetTypeFromHandle(CJI6ksmAfV9lqr5bFV.GWHS8jinbvjcW(16777241))})
Source: rsJSON.dll.6.dr, J0mSrijoaAO8NrjmXU.cs	.Net Code: Type.GetTypeFromHandle(AxJR7gwIYi5tigmUJL.A4QdDAiOmqhGt(16777321)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(AxJR7gwIYi5tigmUJL.A4QdDAiOmqhGt(16777256)),Type.GetTypeFromHandle(AxJR7gwIYi5tigmUJL.A4QdDAiOmqhGt(16777283))})
Source: rsLogger.dll.6.dr, xyCh32lHTXMmjS3K4X.cs	.Net Code: Type.GetTypeFromHandle(CGR99NSNwbcs3tSKLm.ofp9h2cuSyFuc(16777338)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(CGR99NSNwbcs3tSKLm.ofp9h2cuSyFuc(16777258)),Type.GetTypeFromHandle(CGR99NSNwbcs3tSKLm.ofp9h2cuSyFuc(16777305))})

Binary contains a suspicious time stamp

Source: is-H8HA6.tmp.2.dr

Static PE information: 0xD49AEFA9 [Mon Jan 11 20:08:09 2083 UTC]

Contains functionality to dynamically determine API calls

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Code function: 5_2_00F12B30 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,FreeLibrary,GetLastError,

5_2_00F12B30

PE file contains an invalid checksum

Source: 3yq4abxg.exe.4.dr	Static PE information: real checksum: 0x24d917 should be: 0x25040d
Source: is-H8HA6.tmp.2.dr	Static PE information: real checksum: 0x14f88 should be: 0x177e5
Source: botva2.dll.2.dr	Static PE information: real checksum: 0x0 should be: 0x15537
Source: zbShieldUtils.dll.2.dr	Static PE information: real checksum: 0x0 should be: 0x2053b1
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp.0.dr	Static PE information: real checksum: 0x0 should be: 0x2e0bb3

PE file contains sections with non-standard names

Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe	Static PE information: section name: .didata
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp.0.dr	Static PE information: section name: .didata
Source: CheatEngine75.exe.2.dr	Static PE information: section name: .didata
Source: saBSI.exe.2.dr	Static PE information: section name: .didat
Source: 3yq4abxg.exe.4.dr	Static PE information: section name: .sxdata
Source: installer.exe.5.dr	Static PE information: section name: _RDATA
Source: ArchiveUtilityx64.dll.6.dr	Static PE information: section name: _RDATA

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Code function: 4_2_00007FFB4B2B746E pushad ; iretd	4_2_00007FFB4B2B749D
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Code function: 4_2_00007FFB4B2C520C push esi; iretd	4_2_00007FFB4B2C526E
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Code function: 4_2_00007FFB4B2C523F push esi; iretd	4_2_00007FFB4B2C526E
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Code function: 4_2_00007FFB4B2C3A67 push edi; iretd	4_2_00007FFB4B2C3AB6
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Code function: 4_2_00007FFB4B2B812B push ebx; ret	4_2_00007FFB4B2B816A
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Code function: 4_2_00007FFB4B2C5048 push esp; iretd	4_2_00007FFB4B2C5066
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Code function: 4_2_00007FFB4B2B3CD7 push edi; ret	4_2_00007FFB4B2B3D16
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Code function: 4_2_00007FFB4B2B3CC7 pushad ; ret	4_2_00007FFB4B2B3CD6
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Code function: 4_2_00007FFB4B2B749E push eax; iretd	4_2_00007FFB4B2B74AD
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Code function: 4_2_00007FFB4B2B3D17 push edi; ret	4_2_00007FFB4B2B3D26
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_3_0556C34E push esi; retf	5_3_0556C36F
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_3_0557131C push edi; iretd	5_3_0557131D
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_3_05570807 pushfd ; retf	5_3_05570808
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_3_0556F022 push esp; iretd	5_3_0556F023
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_3_05570182 push ss; ret	5_3_055701C0
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_3_05572DA8 pushad ; ret	5_3_05572DAA
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F48DDB push ecx; ret	5_2_00F48DEE
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F77CFD push ecx; ret	5_2_00F77D12
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Code function: 6_2_00419800 push eax; ret	6_2_0041982E
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Code function: 6_2_004197D0 push eax; ret	6_2_004197EE
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Code function: 32_2_021B016B push es; iretd	32_2_021B0320
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Code function: 45_2_00007FFB4B2D00BD pushad ; iretd	45_2_00007FFB4B2D00C1
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Code function: 49_2_022002F8 push es; iretd	49_2_02200588

Source: rsAtom.dll.6.dr, ua2iaed2WgIibwVYdP.cs	High entropy of concatenated method names: 'Qw25evhhQyflM', 'wDeX7F7r7aA3CaPN4An', 'zWmIYA7jwK2TZ5GCpVM', 'RiHGOP77P5NTYjtp5OI', 'j1Htg3jSWVo0hgFJNki', 'I1AaBEjzuAPllcBc8Nj', 'Ppnwa87GoOthjYm31xt', 'XS0gJO71piY8YT7goA9', 'Gbi2Dq72UhYBeiYgLuP', 'd9MMpR7x86YMFXdvbQt'
Source: rsAtom.dll.6.dr, r7s327oS6DJve4RRwS.cs	High entropy of concatenated method names: 'qhYVAnvVC', 'qEfXMyfYI', 'PNNgJG6kG', 'kn6Mskxa2', 'c7QOhpDxfDJho77HjU', 'BCiUMWErQJ3Cmt1Uqw', 'wY5r2OLmavMloP27Hy', 'hLHCqRs2pBM7RcKT5S', 'fuEY9YbFqSP81Ys973', 'wSGnMLyQ7cdvpkOjF9'
Source: rsAtom.dll.6.dr, FRqWKxCamX1Hu3xVa9.cs	High entropy of concatenated method names: 'MoveNext', 'MoveNext', 'SetStateMachine', 'SetStateMachine', 'lep6xtjdJYfqmt8iC4I', 'A50NwdjNdtn2CGjcxU4', 'k4JFP2jkUjjDU94XnKB', 'okVLibj8XU16KLGUltu', 'xCwHtRjcObQDFAOD74I', 'pirSLgjJj0E77lCqDih'
Source: rsAtom.dll.6.dr, ItqYB4NP8yUiw7DZ59.cs	High entropy of concatenated method names: 'OYH5ev1b2hdXs', 'Lvc5ev14cA1gE', 'dVqEFZ7os1tmw5pINWY', 'yPYEbV7vXtamIehtjRa', 'oBmNIj70xCiy2c0fdhf', 'qW3VrP7dVk00fsDdN9P', 'KYLaqK7NGhqyfAwFX3B', 'dEh5oO7kCcZI2NTxikS'
Source: rsAtom.dll.6.dr, y6HIThX7g6QtDvHSgF.cs	High entropy of concatenated method names: 'SF403A7fAU9le23ZkQA', 've9QE079GrvEfQ9qUX3', 'nIDo0XmFpw', 'HcU3lm75m2v1j1fvlrp', 'B3ucZm7qFQhh0Ppt3KY', 'vtKur57DrKRg8MnlP6n', 'DJDSQ87EmRBp8756eGX', 'A6MXbx7LPfOcZF6Wlwp', 'QRr2aE7s2RxBffBS5eX', 'RjEeCj7bsNdUaV8FExD'
Source: rsAtom.dll.6.dr, AbstractAtomLogger.cs	High entropy of concatenated method names: 'DebugLog', 'Log', 'Log', 'r7so327S6', 'AddBaseFields', 'AddBaseField', 'SendToAtom', 'BJv4e4RRw', 'm5ND792vUyApHB0lSH', 'nHJtacxNTGRueEYuNP'
Source: rsAtom.dll.6.dr, FileAtomLogger.cs	High entropy of concatenated method names: 'pE6dnkjnkuu5XQTkq6y', 'bwlpQTjWLuWDtkJkoEG', 'LuBeA9jR14v213I1hm9', 'KfswKcjQ2GKlqSxT4d5', 'OH7cC7jlTyhj1Vh0JwC', 'Log', 'GetLogEntriesNum', 'StartFlushTimer', 'StopFlushTimer', 'Flush'
Source: rsAtom.dll.6.dr, uWI9QFDIorHq5kDSdx.cs	High entropy of concatenated method names: 'huu4E5RnKb', 'am94Pl6H3U', 'YjY4rq6Hbn', 'K0V4cPmABC', 'UVU42CAbO8', 'ilq4yZPd8w', 'Non4aifEa4', 'X1o4GpHMTV', 'T7c4Rmsqak', 'enx4xyVam4'
Source: rsDatabase.dll.6.dr, AbstractDatabase.cs	High entropy of concatenated method names: 'CreateCommand', 'QueryScalarStrict', 'Value', 'HwX4QGPaJ', 'QueryScalarInt', 'QueryScalarString', 'QueryInternal', 'QueryArrays', 'QueryTuples', 'QueryTuples'
Source: rsDatabase.dll.6.dr, Database.cs	High entropy of concatenated method names: 'IntegrityCheck', 'CreateTables', 'Transaction', 'GetDataSet', 'GetAllRows', 'GetRowWhere', 'GetRowsWhere', 'ExistsRowWhere', 'HasTable', 'HasColumn'
Source: rsDatabase.dll.6.dr, HwXQGP4aJfTjro772A.cs	High entropy of concatenated method names: 'BftS8jqqUFiZa', 'ouC0uH93C14OHdadeow', 'UcLMYi9XwaD7ME3kF1b', 'YcO1JU9FGnOSu9H3bo0', 'mKx7pG90lydPWs49gXQ', 'eahIYr9MXTlGNRQWqg8', 'MTN5Na9EeGZOaATtAEx', 'xyASQ59cb23xYp7Jr4w', 'rpnKES9dLC7MyiPqKlR', 'GonULa9S8nlSEeopnoh'
Source: rsDatabase.dll.6.dr, i0lCiA59BgeyIdeT9Y.cs	High entropy of concatenated method names: 'o78oTJEMpG', 'b4Vo7JxfLl', 'GwBojYjn4R', 'fIfo0EHFfC', 'RRYomaHPfD', 'dlColFx7Jw', 'l6moJOot5H', 'lOjoOpYgGR', 'Hcvo57jg5f', 'x0ionHZmrj'
Source: rsDatabase.dll.6.dr, jTQUkyXTEdtNfPRZPx.cs	High entropy of concatenated method names: 'oV6wYkl7TINa6DVpKX7', 'DnQrOSl9THgQGODdZK3', 'pFkoo4af47', 'FoQO7LlKbSlk32yWOl1', 'ajiP6Tlg2VPapXVZ8uh', 'XIj5uml6esmPZmQfeIg', 'FUnE81lW1NtDhQWpCgK', 'IJTlSblJW3Fu04fWXlN', 'sLcF9hlk4JKsnj700HM', 'UupT5ml2QJF9cM2Rrtf'
Source: rsJSON.dll.6.dr, J0mSrijoaAO8NrjmXU.cs	High entropy of concatenated method names: 'L13EmqMYwAQBQQuQp8O', 'JG8DwlMwNrfOttnpILW', 'x0xmepK9Vc', 'VK5bF2MbUUm8hJGB3XE', 'FON1ZKMonO41M94sboF', 'GY50I3MxPXY1tXfwGaJ', 'pgPNPiMeixJQWOnMZe2', 'kTvpMKMc5u87yfJOXY1', 'njkmYHMsh4vsLI6rLQE', 'WkwZeUMX1l3nYwZwPxn'
Source: rsJSON.dll.6.dr, J0Gi1W1X7HWJ2Nin4O.cs	High entropy of concatenated method names: 'eWXj7HWJ2', 'Add', 'Add', 'Equals', 'GetHashCode', 'ToString', 'ToString', 'Ams3oJraHppoTRrREcn', 'qKCcJYr5QoiZW7Jp6j5', 'YHlECyr4Zc1fLraXn0V'
Source: rsJSON.dll.6.dr, D4hYImSKfLcmbrNMIJ.cs	High entropy of concatenated method names: 'gQgalBdLmF', 'Rc5a7VT8g8', 'RsTahRp4uK', 'W5vaADwCgF', 'Fs9ayM2W5N', 'jJMaqlBdyx', 'bXWa0tpIPx', 'fEha6PpleN', 'a6Ka4GjKi9', 'PV9asEcorn'
Source: rsJSON.dll.6.dr, qWyTmNpppvREgWcHiH.cs	High entropy of concatenated method names: 'WAedDAQQbSuUp', 'iN7U5udzHO1h8AVWPtu', 'rB3o7dM8vVnWxFGlVtl', 'rcENBoM6bx1sGa50bUD', 'OG4uiLdRdiS1soUjR8K', 'Y22WOYdmVn3EAxAYkwd', 'a2EBmpMrkG0ie3n6OTE', 'PZiVUBMTGwYS9l6qWMC', 'TnM0UTMd1Op3Bd23Vlr', 'U4K0MmMMLPA5xVpsLHe'
Source: rsJSON.dll.6.dr, AxJR7gwIYi5tigmUJL.cs	High entropy of concatenated method names: 'A4QdDAiOmqhGt', 'LjDdDAiISygJk', 'IJS34xMAoUtsPADtrWe', 'eP0y8pMHInyexNW0IJC', 'v36GKBMFxOYoHQ0pUn1', 'q8OLAxMWD686cmdsqfX', 'hyCfEKMf5xTnTa7Fyte'
Source: rsJSON.dll.6.dr, JSONArray.cs	High entropy of concatenated method names: 'Dispose', 'MoveNext', 'MoveNext', '_003C_003Em__Finally1', 'Reset', 'GetEnumerator', 'GetEnumerator', 'Gvvwk0TBPg1Vsk9N1Th', 'ileAoPT0hygHKw7UVDb', 'vLc92JTGW2YFHxlB7j5'
Source: rsJSON.dll.6.dr, JSON2.cs	High entropy of concatenated method names: 'Dispose', 'MoveNext', 'MoveNext', 'Reset', 'GetEnumerator', 'GetEnumerator', 'z2lT7sTRBqNvyyu9i9O', 'XLn7VVTmDn8YrocMqMe', 'NPWuFyTnP5lc5vqleq6', 'GB7bPGTyL390jSddZy3'
Source: rsJSON.dll.6.dr, JSONBuilder.cs	High entropy of concatenated method names: 'Add', 'Add', 'Add', 'Add', 'Add', 'Add', 'Add', 'Add', 'Add', 'Add'
Source: rsJSON.dll.6.dr, JSONData.cs	High entropy of concatenated method names: 'ToString', 'V8bpeQvDE', 'aiPu9jpjD', 'ToString', 'Serialize', 'ThJoBd6fTkchDG3BCT2', 'iDwPu06v3oHT3yTgXeM', 'VroJTR6kphg46TPikOr', 'CASPQm6IcWocCXIJSfG', 'xeobLM6l2k5Mtee6URJ'
Source: rsJSON.dll.6.dr, JSONClass.cs	High entropy of concatenated method names: 'Dispose', 'MoveNext', 'MoveNext', '_003C_003Em__Finally1', 'Reset', 'GetEnumerator', 'GetEnumerator', 'os3Wk9TIqp0wfFwDQEG', 'yiL6FjTlsvaUAT7EhlX', 'n2NK4cTvoMnjnSaeXXN'
Source: rsJSON.dll.6.dr, JSONNode.cs	High entropy of concatenated method names: 'Dispose', 'MoveNext', 'MoveNext', 'Reset', 'GetEnumerator', 'GetEnumerator', 'HGpRKKTKocXg6ZeYvQW', 'zCiGpeTbvyxK2D9pnAs', 'av0TNMT1MqC3i1oNoPd', 'EZU2OYT2E9nCp85mnrZ'
Source: rsLogger.dll.6.dr, ViJ4rfNcxMOrLqjS0f.cs	High entropy of concatenated method names: 'WBogQyCh3', 'EO6jt43kZ', 'vHTsXMmjS', 'dK4kXPpQ2', 'auVP2g4ig', 'ggc6E01N7', 'LxvirwJUM', 'PhDZBcpo9osW88KCva', 'Se9cCJDwNJVrVV32uu', 'Rr77QIN3DqaqC2m7A7'
Source: rsLogger.dll.6.dr, LogzIOMemoryLogger.cs	High entropy of concatenated method names: 'ansJJudEQ1YnT3vsO3b', 'cXW5TGddLNb3BlqLqi3', 'QM9ei0dAuPfWZu33jFq', 'YZsdCIdyRspRqIrwaXO', 'Add', 'uR9NF9NNwb', 'TryFlush', 'Dispose', 'KsmMujEyWwWkdrx7c7n', 'PyI40XEdPohTkJJ0jWT'
Source: rsLogger.dll.6.dr, LogzIOLogger.cs	High entropy of concatenated method names: 'ELI6Q3E3cLBTQtkdFft', 'ajyWatEIAZW0LEo9abT', 'nBvWBBEHK5TH4abxxBN', 'fTgG8DEzHSvQIeUnhdI', 'p9cFovdVkmjPpk0SMNw', 'Add', 'AM5NCaba2B', 'itKNVpLK6o', 'TryFlush', 'Dispose'
Source: rsLogger.dll.6.dr, MultiLogger.cs	High entropy of concatenated method names: 'Add', 'Add', 'PQ0NQmIyDB', 'qsdN0DJ6CK', 'GetEnumerator', 'GetEnumerator', 'dTWykPE4sbfKR7KX3Wt', 'pKxiNGEhy7KgHqMe22k', 'lxWtQHEspTh9n7WVSQi', 'CWIw6SEgbS06k9h0M71'
Source: rsLogger.dll.6.dr, AbstractLogger.cs	High entropy of concatenated method names: 'fhD9kX7SE', 'CjZxeC4p2', 'EnableStackTrace', 'LogDebug', 'LogDebug', 'LogInfo', 'LogWarning', 'LogWarning', 'LogError', 'LogError'
Source: rsLogger.dll.6.dr, Event.cs	High entropy of concatenated method names: 'ToJSON', 'ToText', 'udmF6FWnI', 'tSISulqZQIhJ8ROSPR', 'UMT1KyC7xUoBaTfCry', 'MoVJuyodTihSUsWvO4', 'bpyem07oI0Fqp6uCDp', 'lE1hEAi8SDKRGNmnKw', 'uT97d4ZWWfK0nmPkYg', 'bL2xZmBmPNFV3V9xN7'
Source: rsLogger.dll.6.dr, LegacyLogger.cs	High entropy of concatenated method names: 'gtv99OEMqAWho2FjVEE', 'G6u15aEbMRtSqhBbZp1', 'eD677nEecDWppUw1D1s', 'Add', 'avDCCqQJ8tQbEFwAq3K', 'WEYMmoQx4MPjIAJXH2w', 'LC8oxwQqlwKcOtQAb9y', 'yg6HKsQCDpFT1ktVatZ', 'SVEnhnQoBVeUMNpQHBl', 'WkktUmQ7gWiaagQEcU9'
Source: rsLogger.dll.6.dr, nSuGBCAXy9vteo7WWm.cs	High entropy of concatenated method names: 'qXpFufuexy', 'DkNFUXXSP3', 'Ya29UDESlDL3WEMm23S', 'hyI5C6EnWHtU5YwqM5y', 'bAdIcEE0scwReASLx1i', 'BU1oc5E2oOB0cPfoPn5', 'g5ptAkEjfHErJDATrdO', 'W46yxQE5Rs5Z9nYLByi', 'PqOC5jEFKyPjLxbMx27', 'egkL4QEJ8VZVgN85s0K'
Source: rsLogger.dll.6.dr, siQvWVv73bTKJf6xq3.cs	High entropy of concatenated method names: 'kfV9h2GGHqCR8', 'iSLVvpdsEtw1F0EsBSb', 'oigxUZdgo73KuBROCHC', 'PZOLPNdULYDeLHGhGKJ', 'jtwVXldugxwGMp6FStX', 'ipHSYtd4KE9X86KCsAZ', 'zsNIpMdhGuwjWi7o8te', 'VRvr0ydK6Z96JS2PZ1A', 'qpfR2edXjIuDa9uGW5F', 'wJyYVRdk9nX0KNk76BO'
Source: rsLogger.dll.6.dr, ITw0wNPoZFWGKG4fLp.cs	High entropy of concatenated method names: 'W3MuDtMlAu', 'zCKuhstyJI', 'iPXuMUo4Dw', 'iR0uO0RUqD', 'wusuB0Uty3', 'GsZucQw0ID', 'gSIumE99pj', 'NHiu8TrBpp', 'JT1ud1JTIS', 'fyZuWDN9Jw'
Source: rsLogger.dll.6.dr, xyCh32lHTXMmjS3K4X.cs	High entropy of concatenated method names: 'bBTHJNdfpeRulNCgbZ4', 'gJqi3ldRieQT0VfAlUJ', 'BsDun8eZ8X', 'UCmSSgdn0NKBBLxgaeO', 'xIaVmQd0CpLvwo8ehU7', 'vrS7TXd5OfnCki5Qy9e', 'bPQ6P7dF2jFPHrDl1bI', 'zY9LsodJ0Ml9ONUkFjN', 'GjhYDodxI2ScvRtlyYj', 'SRrG6jdqCm4TBmhShuh'
Source: rsLogger.dll.6.dr, bMSWQC9MwGrsnVGV7s.cs	High entropy of concatenated method names: 'KZUbb4tZ9', 'kJl4ydNq0', 'Siyz5uRLS', 'O9yN88Qkn7TLEeRxANG', 'F5AoVXQ6Jrt05fxIZlb', 'KNtYFkQKTjI8WitKbXt', 'sBtBlpQXXkscAm3pORP', 'SDWJKdQTvjS9p7tXP78', 'HC84WSQwtc6aurpvuW7', 'FR5UaBQLvnP6OvRk3eq'
Source: rsLogger.dll.6.dr, ykX7SEucjZeC4p2b5g.cs	High entropy of concatenated method names: 'yKb1ngLoo', 'PCBYXlAD8', 'VlfXlQpi8', 'ENloRxQv3xEApasPTAh', 'rXofyeQmlEIE1F3JpKP', 'g0oxtlQadcaEA2G9bvM', 'slKI45QchpE4nkvXLPl', 'yXaj7OQ8WmVeGfH4m4A', 'IQHVRiQYFB8mDX4pqa4', 'clItFAQ1ajl3bE5GXD1'

Persistence and Installation Behavior

Drops PE files

Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsLogger.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	File created: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\botva2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-1HAUB.tmp	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\pl\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\hu-HU\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\el-GR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	File created: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\win32\is-A3GKJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-6LSG2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\win32\is-OH84O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\DotNetDataCollector64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\uninstall-dns.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\bin\Release\CEPluginExample.dll (copy)	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\System.ValueTuple.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Users\user\AppData\Local\Temp\is-UC9I1.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\libipt-64.dll (copy)	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\it\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-OQMOE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\nl-NL\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-AUJ8A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\cheatengine-i386.exe (copy)	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\uninstall-vpn.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-MUHHF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\uninstall-vpn.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-A5OSQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\ced3d11hook64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-5DOON.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\tcc32-32-linux.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\gtutorial-i386.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-81GE3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\allochook-i386.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\win32\is-7KKVU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-8G4IN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsqF14F.tmp\INetC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-FC05A.tmp	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\nb-NO\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\cs-CZ\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\DotNetInterface.dll (copy)	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsSyncSvc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\tcc64-32-linux.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsSyncSvc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\allochook-x86_64.dll (copy)	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\fr\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\pt-PT\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\ro-RO\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-SJKQD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\uninstall-epp.exe	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsDatabase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\Tutorial-x86_64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\el-GR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-ASU18.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\ko-KR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	File created: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\tr-TR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\ro-RO\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\pt-PT\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	File created: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	File created: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\pl\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\ced3d10hook64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\MonoDataCollector32.dll (copy)	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsAtom.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\fil-PH\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\hu-HU\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\win64\is-356FE.tmp	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\fr-FR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\UnifiedStub-installer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-7NK6B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\tcc64-64-linux.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\it-IT\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\libmikmod64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-PP0OR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\nl-NL\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\es\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\luaclient-i386.dll (copy)	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\hi-IN\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\zh-CN\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\gtutorial-x86_64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	File created: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\clibs64\is-701OU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\ja-JP\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-04JI4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\zh-Hant\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\pl\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\win64\is-HNC5I.tmp	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\da-DK\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-BQRFH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-LR956.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\winhook-i386.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-RKO1I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\sk-SK\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-O71KG.tmp	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\ru-RU\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\fi-FI\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\64\CEJVMTI.dll (copy)	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\sv-SE\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-TTU3J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\pt-PT\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	File created: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\ArchiveUtilityx64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\ceregreset.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-A30LA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\32\CEJVMTI.dll (copy)	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\zh-Hant\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\vi-VN\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-AJB6K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\de-DE\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\de-DE\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\d3dhook64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsAtom.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\win32\symsrv.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	File created: C:\Program Files (x86)\WeatherZero\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\cs-CZ\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-PMK62.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	File created: C:\Users\user\AppData\Local\Temp\Stub.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\es\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Microsoft.Win32.TaskScheduler.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\pt-BR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\fi-FI\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\hr-HR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	File created: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0 (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	File created: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\bin\Release\is-QAU98.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\fr\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsDatabase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\tcc64-aarch64-linux.dll (copy)	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\ru\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsJSON.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-9UL4R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\vehdebug-i386.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsSyncSvc.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\clibs32\is-AQQPT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\vehdebug-x86_64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-R767B.tmp	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	File created: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\zbShieldUtils.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\pt\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\de\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\uninstall-vpn.exe	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\it-IT\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsDatabase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\clibs32\lfs.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\sk-SK\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\fr-FR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\fil-PH\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\pt\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\zh-TW\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsTime.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\uninstall-epp.exe	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\es-ES\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\it-IT\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\da-DK\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\win32\dbghelp.dll (copy)	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Microsoft.Win32.TaskScheduler.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\ru\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\speedhack-i386.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	File created: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\CheatEngine75.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\ru-RU\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\uninstall-epp.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsTime.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\fi-FI\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-8HLKV.tmp	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\tr-TR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-7TSFI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\vi-VN\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	File created: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\installer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-KLETU.tmp	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\id-ID\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\uninstall-dns.exe	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\zh-TW\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\id-ID\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\tr-TR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsStubLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\sl-SI\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\unins000.exe (copy)	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\ko-KR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\es-ES\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-RUAAP.tmp	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsStubLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Microsoft.Win32.TaskScheduler.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\fil-PH\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-MRM89.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\win64\symsrv.dll (copy)	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\pl-PL\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\ced3d11hook.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\hr-HR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-IM0FE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-7DIKH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\de\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\windowsrepair.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\nb-NO\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\pl-PL\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\th-TH\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\libipt-32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\uninstall-dns.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-4H8E2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	File created: C:\Program Files (x86)\WeatherZero\WeatherZero.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\libmikmod32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-UD451.tmp	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\ja-JP\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\sv-SE\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\win64\is-F9V6M.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe	File created: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\it\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\sl\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	File created: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\is-H8HA6.tmp	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\pt\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\System.ValueTuple.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\ru\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-VADJ1.tmp	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\sl-SI\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\sl-SI\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\id-ID\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\sl\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\ced3d9hook64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\es\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\DotNetDataCollector32.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\hi-IN\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-AATAN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsTime.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\th-TH\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsLogger.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\ja-JP\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\CSCompiler.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\lua53-32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\win64\dbghelp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\tcc64-64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\lua53-64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-ERBSE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-76J7R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\el-GR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\ru-RU\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\win64\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\sk-SK\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\hu-HU\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\es-ES\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	File created: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-1U45L.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsStubLib.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsJSON.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-BGU0I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\fr\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\ArchiveUtilityx64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\speedhack-x86_64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	File created: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\ro-RO\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\zh-Hant\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\zh-TW\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsAtom.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\winhook-x86_64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\tcc32-32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\clibs64\lfs.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-JBLAJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-27N0B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\tcc64-32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-397QA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\de\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\hi-IN\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\fr-FR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\d3dhook.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-QFQ4U.tmp	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\cs-CZ\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\32\is-5VCS0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-NNHHO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\pt-BR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\zh-CN\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\ko-KR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\de-DE\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\System.ValueTuple.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsLogger.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-L3GJI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\th-TH\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\ced3d10hook.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	File created: C:\Users\user\AppData\Local\Temp\nsqF14F.tmp\WeatherZeroNSISPlugin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\MonoDataCollector64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	File created: C:\Program Files (x86)\WeatherZero\uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\nb-NO\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\pl-PL\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\luaclient-x86_64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\CheatEngine75.exe	File created: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\hr-HR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\win32\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\sv-SE\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\vi-VN\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsJSON.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-MV96K.tmp	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\it\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\da-DK\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\is-L37DV.tmp	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\ArchiveUtilityx64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\sl\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\nl-NL\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\ced3d9hook.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\Program Files\Cheat Engine 7.5\autorun\dlls\64\is-0JUIF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\pt-BR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\zh-CN\UnifiedStub.resources.dll	Jump to dropped file

Creates install or setup log file

Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\UnifiedStub-installer.exe.log

Boot Survival

Installs Task Scheduler Managed Wrapper

Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	File created: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Microsoft.Win32.TaskScheduler.dll	Jump to behavior
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Microsoft.Win32.TaskScheduler.dll
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	File created: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Microsoft.Win32.TaskScheduler.dll

Stores files to the Windows start menu directory

Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine.lnk
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine (64-bit SSE4-AVX2).lnk
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine (64-bit).lnk
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine (32-bit).lnk
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine tutorial.lnk
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine tutorial (64-bit).lnk
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine help.lnk
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Kernel stuff
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Kernel stuff\Unload kernel module.lnk
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Reset settings.lnk
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Lua documentation.lnk
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Uninstall Cheat Engine.lnk

Uses net.exe to stop services

Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp

Process created: C:\Windows\System32\net.exe "net" stop BadlionAntic

Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe

25_2_00007FF7824D4BB0

Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp

Process created: C:\Windows\System32\sc.exe "sc" delete BadlionAntic

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe

File opened: C:\Program Files\ReasonLabs\EPP\Uninstall.exe:Zone.Identifier read attributes | delete

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Code function: 5_2_00F00540 EnterCriticalSection,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LeaveCriticalSection,

5_2_00F00540

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Stores large binary data to the registry

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 Blob

Jump to behavior

Uses cacls to modify the permissions of files

Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp

Process created: C:\Windows\System32\icacls.exe "icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\CheatEngine75.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Memory allocated: 2A3CFC60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Memory allocated: 2A3E9800000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Memory allocated: 19B32730000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Memory allocated: 19B4C060000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Memory allocated: 1FA15300000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Memory allocated: 1FA2EDF0000 memory reserve \| memory write watch

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Code function: 5_2_00ED4C8E GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,FindCloseChangeNotification,

5_2_00ED4C8E

Contains long sleeps (>= 3 min)

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Thread delayed: delay time: 922337203685477

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Window / User API: threadDelayed 1783	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Window / User API: threadDelayed 1075
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Window / User API: threadDelayed 741
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Window / User API: threadDelayed 425
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Window / User API: threadDelayed 4706
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Window / User API: threadDelayed 1924
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Window / User API: threadDelayed 691
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Window / User API: windowPlacementGot 1212

Found dropped PE file which has not been started or loaded

Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsLogger.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\botva2.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\pl\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-1HAUB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\hu-HU\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\el-GR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\win32\is-A3GKJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-6LSG2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\DotNetDataCollector64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\win32\is-OH84O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\uninstall-dns.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\bin\Release\CEPluginExample.dll (copy)	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\System.ValueTuple.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\libipt-64.dll (copy)	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\it\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-OQMOE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\nl-NL\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-AUJ8A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\cheatengine-i386.exe (copy)	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\uninstall-vpn.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-MUHHF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\uninstall-vpn.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-A5OSQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\ced3d11hook64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\gtutorial-i386.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\tcc32-32-linux.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-5DOON.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\allochook-i386.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-81GE3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\win32\is-7KKVU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-8G4IN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsqF14F.tmp\INetC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-FC05A.tmp	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\nb-NO\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\cs-CZ\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\autorun\dlls\DotNetInterface.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\tcc64-32-linux.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\allochook-x86_64.dll (copy)	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\pt-PT\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\fr\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\ro-RO\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-SJKQD.tmp	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsDatabase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\Tutorial-x86_64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\el-GR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\ko-KR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-ASU18.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\tr-TR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\ro-RO\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\pt-PT\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\pl\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\ced3d10hook64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\autorun\dlls\MonoDataCollector32.dll (copy)	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsAtom.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\fil-PH\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\hu-HU\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\win64\is-356FE.tmp	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\fr-FR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-7NK6B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\it-IT\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\tcc64-64-linux.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\libmikmod64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-PP0OR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\nl-NL\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\es\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\zh-CN\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\hi-IN\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\luaclient-i386.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\gtutorial-x86_64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\clibs64\is-701OU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\ja-JP\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-04JI4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\pl\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\zh-Hant\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\win64\is-HNC5I.tmp	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\da-DK\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-LR956.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\winhook-i386.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-RKO1I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\sk-SK\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-O71KG.tmp	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\ru-RU\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\fi-FI\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\autorun\dlls\64\CEJVMTI.dll (copy)	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\sv-SE\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\pt-PT\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-TTU3J.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\ArchiveUtilityx64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\ceregreset.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-A30LA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\autorun\dlls\32\CEJVMTI.dll (copy)	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\zh-Hant\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\vi-VN\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-AJB6K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\de-DE\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\de-DE\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\d3dhook64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsAtom.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\win32\symsrv.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WeatherZero\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-PMK62.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\cs-CZ\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\es\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Microsoft.Win32.TaskScheduler.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\pt-BR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\fi-FI\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\hr-HR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\bin\Release\is-QAU98.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\fr\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsDatabase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\tcc64-aarch64-linux.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsJSON.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\ru\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-9UL4R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\vehdebug-i386.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\vehdebug-x86_64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\clibs32\is-AQQPT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\zbShieldUtils.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\de\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\pt\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\uninstall-vpn.exe	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\it-IT\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsDatabase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\clibs32\lfs.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\fr-FR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\sk-SK\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\fil-PH\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\pt\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsTime.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\zh-TW\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\es-ES\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\it-IT\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\da-DK\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\win32\dbghelp.dll (copy)	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Microsoft.Win32.TaskScheduler.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\ru\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\speedhack-i386.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\ru-RU\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsTime.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\fi-FI\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-8HLKV.tmp	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\tr-TR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-7TSFI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\vi-VN\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\installer.exe	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\id-ID\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\uninstall-dns.exe	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\zh-TW\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\id-ID\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\tr-TR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsStubLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\sl-SI\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\ko-KR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-RUAAP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\es-ES\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsStubLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Microsoft.Win32.TaskScheduler.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\fil-PH\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-MRM89.tmp	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\pl-PL\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\win64\symsrv.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\hr-HR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\ced3d11hook.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-IM0FE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-7DIKH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\de\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\nb-NO\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\pl-PL\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\th-TH\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\libipt-32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\uninstall-dns.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-4H8E2.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WeatherZero\WeatherZero.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\libmikmod32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-UD451.tmp	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\ja-JP\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\sv-SE\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\win64\is-F9V6M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\it\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\sl\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\pt\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\System.ValueTuple.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\ru\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-VADJ1.tmp	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\sl-SI\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\sl-SI\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\id-ID\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\sl\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\ced3d9hook64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\hi-IN\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\es\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\DotNetDataCollector32.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-AATAN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsLogger.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsTime.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\th-TH\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\ja-JP\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\CSCompiler.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\lua53-32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\win64\dbghelp.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-ERBSE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-76J7R.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\el-GR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\win64\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\sk-SK\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\ru-RU\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\es-ES\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\hu-HU\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsJSON.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsStubLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-BGU0I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\fr\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\ArchiveUtilityx64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\speedhack-x86_64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\ro-RO\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsAtom.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\zh-TW\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\zh-Hant\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\winhook-x86_64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\tcc32-32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\clibs64\lfs.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-JBLAJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-27N0B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-397QA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\de\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\hi-IN\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\fr-FR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\d3dhook.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-QFQ4U.tmp	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\cs-CZ\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-NNHHO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\autorun\dlls\32\is-5VCS0.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\zh-CN\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\pt-BR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\ko-KR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\de-DE\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsLogger.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\System.ValueTuple.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-L3GJI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\th-TH\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\ced3d10hook.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsqF14F.tmp\WeatherZeroNSISPlugin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\autorun\dlls\MonoDataCollector64.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WeatherZero\uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\nb-NO\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\pl-PL\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\luaclient-x86_64.dll (copy)	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\hr-HR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\win32\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\sv-SE\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\vi-VN\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsJSON.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\it\Microsoft.Win32.TaskScheduler.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\da-DK\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\is-L37DV.tmp	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\ArchiveUtilityx64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\sl\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\nl-NL\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\ced3d9hook.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\pt-BR\UnifiedStub.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Dropped PE file which has not been started: C:\Program Files\Cheat Engine 7.5\autorun\dlls\64\is-0JUIF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Stub.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\zh-CN\UnifiedStub.resources.dll	Jump to dropped file

Found evasive API chain (date check)

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_5-98666

Found evasive API chain (may stop execution after checking a module file name)

Source: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

Found large amount of non-executed APIs

Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	API coverage: 4.7 %
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	API coverage: 8.6 %
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	API coverage: 9.0 %
Source: C:\Program Files\Cheat Engine 7.5\windowsrepair.exe	API coverage: 8.8 %

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp TID: 7892	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp TID: 7896	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp TID: 7892	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe TID: 7292	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe TID: 7292	Thread sleep time: -75000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe TID: 5408	Thread sleep count: 1783 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe TID: 1824	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe TID: 3120	Thread sleep count: 1075 > 30
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe TID: 3120	Thread sleep count: 741 > 30
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe TID: 4136	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe TID: 7680	Thread sleep count: 90 > 30
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe TID: 7680	Thread sleep count: 32 > 30
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe TID: 1824	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe TID: 1824	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe TID: 4136	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe TID: 5736	Thread sleep count: 425 > 30
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe TID: 5736	Thread sleep time: -212500s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe TID: 7548	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe TID: 4844	Thread sleep time: -11765000s >= -30000s
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe TID: 4844	Thread sleep time: -1727500s >= -30000s

Queries disk information (often used to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe

File opened: PhysicalDrive0

Jump to behavior

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Windows\System32\sc.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	File Volume queried: C:\Users\user\AppData\Local\Temp\is-H908U.tmp FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	File Volume queried: C:\Users\user\AppData\Local\Temp\is-H908U.tmp FullSizeInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F69BF0 FindFirstFileExW,	5_2_00F69BF0
Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe	Code function: 6_2_00404EC1 FindFirstFileW,	6_2_00404EC1
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Code function: 7_2_00405A19 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	7_2_00405A19
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Code function: 7_2_004065CE FindFirstFileA,FindClose,	7_2_004065CE
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe	Code function: 7_2_004027AA FindFirstFileA,	7_2_004027AA
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Code function: 31_2_00007FF62D7CCA9C FindFirstFileExW,	31_2_00007FF62D7CCA9C
Source: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe	Code function: 38_2_00417980 CreateFileW,DeviceIoControl,FindFirstFileExW,FindClose,SetLastError,SetLastError,	38_2_00417980
Source: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe	Code function: 38_2_00417E10 FindFirstFileExW,FindClose,	38_2_00417E10

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Code function: 5_2_00F32782 VirtualQuery,GetSystemInfo,

5_2_00F32782

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Thread delayed: delay time: 60000
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Thread delayed: delay time: 60000
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	File opened: C:\Users\user\AppData\Local\Temp\is-H908U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	File opened: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000A90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ps://www.opera.com/he/privacy","ctu":"https://www.opera.com/he/eula/computers","ov":100,"cbfo":true,"pv":"1.23","v":3,"x":3}},{"ad":{"n":"","f":"ZB_TotalSecurity_V4","o":"TotalSecurity_AV"},"ps":{"i":"TotalSecurity_AV/images/1127/V4/EN.png","dn":"360 Total Security","u":"TotalSecurity_AV/files/1127/ts360Setup.zip","p":"/s","r":["Microsoft\\Windows\\CurrentVersion\\Uninstall\\360TotalSecurity","360TotalSecurity","360Safe","VMware, Inc."],"cp":"https://www.360totalsecurity.com/en/privacy/","ctu":"https://www.360totalsecurity.com/en/license/","pv":"1.26","cbfo":true,"v":1}},{"ad":{"n":"","f":"ZB_Opera_re_V3","o":"Opera_reengaged"},"ps":{"i":"Opera/images/DOTPS-483/ENX
Source: prod0.exe, 00000004.00000002.3288281066.000002A3E9F02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}8b}
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	Binary or memory string: cbUseDBVMDebugger
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	Binary or memory string: TDBVMDebugInterface.SetThreadContext
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	Binary or memory string: TDBVMDebugInterface
Source: UnifiedStub-installer.exe, 0000000B.00000002.3317370961.0000019B4C850000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	Binary or memory string: TDBVMDebugInterface.ContinueDebugEvent returning normal run
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	Binary or memory string: ;TDBVMDebugInterface.ContinueDebugEvent returning normal run
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002CD9000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ls\\CurrentVersion\\Uninstall\\{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}","McAfee\\SiteAdvisor","McAfee\\WebAdvisor","Microsoft\\Windows\\CurrentVersion\\Uninstall\\McAfee Security Scan"],"rvd":["HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\\PROCESSOR_ARCHITECTURE\\ARM64"],"cp":"https://www.mcafee.com/consumer/en-us/policy/global/legal.html","ctu":"https://home.mcafee.com/Root/AboutUs.aspx?id=eula","pv":"1.26","ov":63,"ud":true,"v":4}},{"ad":{"n":"","f":"ZB_Norton_BRW","o":"AVG_BRW"},"ps":{"i":"NORTON_BRW/images/1494/547x280/EN.png","dn":"Norton Private Browser","u":"NORTON_BRW/files/1506/norton_secure_browser_setup.zip","p":"/s /make-default /run_source=\"norton_ppi_is\"","c":"norton","r":["AVG\\Browser\\Installed","AVASTSoftware\\Browser\\Installed","Avira\\Browser\\Installed","Norton\\Browser\\Installed","Piriform\\Browser\\Installed","Microsoft\\Windows\\CurrentVersion\\Uninstall\\Avira Security_is1","Microsoft\\Windows\\CurrentVersion\\Uninstall\\NGC"],"a":["Avira.Spotlight.Service"],"cp":"https://www.nortonlifelock.com/us/en/privacy/","ctu":"https://www.nortonlifelock.com/us/en/legal/license-services-agreement/","pv":"1.29","ov":100,"cbfo":true,"v":3}},{"ad":{"n":"","f":"ZB_WinZip","o":"Winzip19"},"ps":{"dn":"WinZip","i":"WinZip/images/905/EN.png","u":"WinZip/files/1292/winzip28-dci5.zip","p":"/qn","c":"reg","r":["Nico Mak Computing\\WinZip"],"cp":"https://www.winzip.com/win/en/privacy.html","ctu":"https://www.winzip.com/win/en/eula.html","win64":true,"ov":100,"cbfo":true,"pv":"1.23","v":6}},{"ad":{"n":9,"nn":"Med_Ntiles","f":"ZB_Avast","o":"AVAST"},"ps":{"i":"AVAST/images/DOTPS-1511/547X280/EN.png","dn":"Avast Antivirus","u":"AVAST/files/cookie_mmm_irs_ppi_005_888_a.zip","p":"/silent /ws /psh:{pxl}","rvd":["HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\\PROCESSOR_ARCHITECTURE\\ARM64"],"r":["AVAST Software\\Avast","Microsoft\\Windows\\CurrentVersion\\Uninstall\\Avast","Microsoft\\Windows\\CurrentVersion\\Uninstall\\Avast Antivirus","Microsoft\\Windows\\CurrentVersion\\Uninstall\\AVG Antivirus","Microsoft\\Windows\\CurrentVersion\\Uninstall\\{4CB91122-AA85-4431-953C-BEFAEC86DA97}_is1","WebBar","WebDiscoverBrowser","AVG\\Antivirus\\Version","AVG\\AV\\Dir"],"a":["AvastSvc","instup","AvastUI","AVGUI","avguix","AVGSvc","avgsvca"],"ctu":"https://www.avast.com/eula-avast-consumer-products","cp":"https://www.avast.com/privacy-policy","ov":61,"cbfo":true,"avauc":true,"avur":"AvUninstallTimestamp","pv":"1.29","x":12,"disk":2560,"ram":256,"iapp":["chrome.exe"],"v":1}},{"ad":{"n":"","f":"ZB_Opera_New_ISV","o":"Opera_new"},"ps":{"i":"Opera/images/DOTPS-717/NCB/EN.png","dn":"Opera","u":"Opera/files/AutoReplaced/OperaSetup.zip","p":"--silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:opera_new_a","c":"opera_new_a","a":["OperaSetup","OperaSetup.exe","OperaGXSetup.exe","OperaGXSetup"],"r":["Opera Software"],"cp":"https://www.opera.com/he/privacy","ctu":"https://www.opera.com/he/eula/computer
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	Binary or memory string: TDBVMDebugInterface.ContinueDebugEvent returning single step
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A0A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000A54000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2456178236.0000000000A54000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.000000000314E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.00000000031B7000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000003.1994341662.0000000000795000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000003.1995145479.0000000000795000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000003.1995145479.000000000079C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	Binary or memory string: VMWare seems to be running. It's known that some versions of vmware will cause a BSOD in combination with intel IPT. Do you still want to use intel IPT?
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	Binary or memory string: cbDBVMDebugTriggerCOW
Source: prod0.exe, 00000004.00000002.3288281066.000002A3E9F94000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	Binary or memory string: debughelper.rsvmwareisrunningiptbad
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	Binary or memory string: <TDBVMDebugInterface.ContinueDebugEvent returning single step
Source: UnifiedStub-installer.exe, 0000000B.00000002.3317370961.0000019B4C850000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllv
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	Binary or memory string: DBVMDebuggerInterface
Source: UnifiedStub-installer.exe, 0000002D.00000002.2175466681.000001FA15398000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1863363539.0000000004F2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WZSetup.exe33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-0D
Source: prod0.exe, 00000004.00000002.3288281066.000002A3E9F02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll.
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	Binary or memory string: cbDBVMDebugTargetedProcessOnly
Source: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2463458065.0000000004E70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: eat Engine is a tool designed to help you with modifying single player games without internet connection so you can make them harder or easier depending on your preference."ctp":"","cep":""},"f":{"m":3,"x":"2025-03-13T22:41:55.237Z","a":"cdc2","d":"89"},"o":[{"ad":{"n":"","f":"ZB_RAV_Cross_Tri_NCB","o":"RAV_Cross"},"ps":{"i":"RAV_Triple_NCB/images/DOTPS-855/EN.png","dn":"RAV, VPN by RAV, Online Security, Safer Web","u":"https://shield.reasonsecurity.com/rsStubActivator.exe","p":"-ip:\"dui={userid}&dit={sessionid}&is_silent=true&oc={of}&p={pubid}&a=100&b={ispb}&se=true\" -vp:\"dui={userid}&dit={sessionid}&oc={of}&p={pubid}&a=100&oip=26&ptl=7&dta=true\" -dp:\"dui={userid}&dit={sessionid}&oc={of}&p={pubid}&a=100\" -i -v -d -se=true","r":["ReasonVPN","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonVPN","RAVVPN","Microsoft\\Windows\\CurrentVersion\\Uninstall\\RAVVPN","ReasonLabs\\VPN","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonLabs-VPN","ReasonSaferWeb","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonSaferWeb","SaferWeb","Microsoft\\Windows\\CurrentVersion\\Uninstall\\SaferWeb","ReasonLabs\\DNS","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonLabs-DNS","ReasonUP","RAVAntivirus","Reason\\Reason Antivirus","ReasonLabs\\EPP","Microsoft\\Windows\\CurrentVersion\\Uninstall\\ReasonLabs-EPP","VMware, Inc."],"rvd":["HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\\PROCESSOR_ARCHITECTURE\\ARM64"],"cmdu":[{"utr":"HKEY_CLASSES_ROOT","utk":"ReasonPersistentStorage","utvn":"AvUninstallTime","utvt":"SZ","umd":30,"utms":true}],"cp":"https://reasonlabs.com/policies","ctu":"https://reasonlabs.com/policies","win64":true,"pv":"1.26","disk":450,"fe":["{commonpf64}\\ReasonLabs\\EPP\\InstallerLib.dll","{commonpf64}\\RAVAntivirus\\AntivirusInstallerLib.dll","{commonpf64}\\RAVAntivirus\\AntivirusInstaller.exe"],"ov":100,"cbfo":true,"x":10,"v":1}},{"ad":{"n":"","f":"ZB_WebAdvisor_V3","o":"WebAdvisor"},"ps":{"i":"WebAdvisor/images/943/EN.png","dn":"McA
Source: prod0.exe, 00000004.00000002.3288281066.000002A3E9F94000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:N
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	Binary or memory string: cbDBVMDebugKernelmodeBreaks
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	Binary or memory string: #debughelper.rsvmwareisrunningiptbad
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	Binary or memory string: DBVMDEBUGGERINTERFACE
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	Binary or memory string: dbvmdebuggerinterface.rsdbvmfunctionneedsdbvm
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	Binary or memory string: vmware-vmx.exe
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	Binary or memory string: picked debug register vmware-vmx.exe
Source: WZSetup.exe, 00000007.00000003.1994867793.000000000075E000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000002.1998170408.000000000075E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0ly%SystemRoot%\system32\mswsock.dll
Source: UnifiedStub-installer.exe, 0000000B.00000002.3317370961.0000019B4C850000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: stringComputer System ProductComputer System ProductXUNMMG9AC52742-8547-84D6-5349-ECEC87A66D67VMware, Inc.None`
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	Binary or memory string: -dbvmdebuggerinterface.rsdbvmfunctionneedsdbvm
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	Binary or memory string: $TDBVMDebugInterface.SetThreadContext

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe

API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Code function: 5_2_00F493F2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

5_2_00F493F2

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Code function: 5_2_00EE5110 RegOpenKeyExW,RegQueryValueExW,SetLastError,RegCloseKey,RegCloseKey,GetLastError,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,LoadLibraryExW,GetLastError,

5_2_00EE5110

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Code function: 5_2_00ED4C8E GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,FindCloseChangeNotification,

5_2_00ED4C8E

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Code function: 5_2_00F77BC0 VirtualProtect ?,-00000001,00000104,?,?,?,0000001C

5_2_00F77BC0

Contains functionality to dynamically determine API calls

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Code function: 5_2_00F12B30 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,FreeLibrary,GetLastError,

5_2_00F12B30

Contains functionality to read the PEB

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F5E8FE mov eax, dword ptr fs:[00000030h]	5_2_00F5E8FE
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F67CF2 mov eax, dword ptr fs:[00000030h]	5_2_00F67CF2
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F67CAE mov eax, dword ptr fs:[00000030h]	5_2_00F67CAE
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F67C6A mov eax, dword ptr fs:[00000030h]	5_2_00F67C6A
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F67D23 mov eax, dword ptr fs:[00000030h]	5_2_00F67D23
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Code function: 33_2_01099D02 mov eax, dword ptr fs:[00000030h]	33_2_01099D02
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Code function: 33_2_0109433F mov eax, dword ptr fs:[00000030h]	33_2_0109433F

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Code function: 5_2_00ED463F GetProcessHeap,

5_2_00ED463F

Enables debug privileges

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process token adjusted: Debug
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F49018 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00F49018
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F493F2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00F493F2
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F4D453 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00F4D453
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: 5_2_00F49586 SetUnhandledExceptionFilter,	5_2_00F49586
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF78253E3BC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	25_2_00007FF78253E3BC
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: 25_2_00007FF782532A10 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	25_2_00007FF782532A10
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Code function: 31_2_00007FF62D7CA23C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_00007FF62D7CA23C
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Code function: 31_2_00007FF62D7C42B0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	31_2_00007FF62D7C42B0
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Code function: 31_2_00007FF62D7C41CC SetUnhandledExceptionFilter,	31_2_00007FF62D7C41CC
Source: C:\Program Files\ReasonLabs\EPP\Uninstall.exe	Code function: 31_2_00007FF62D7C4028 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_00007FF62D7C4028
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Code function: 33_2_0108D11E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	33_2_0108D11E
Source: C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	Code function: 33_2_01092603 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	33_2_01092603
Source: C:\Program Files\Cheat Engine 7.5\windowsrepair.exe	Code function: 39_2_0040DEC0 SetUnhandledExceptionFilter,	39_2_0040DEC0
Source: C:\Program Files\Cheat Engine 7.5\windowsrepair.exe	Code function: 39_2_0040DED0 SetUnhandledExceptionFilter,	39_2_0040DED0
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Code function: 46_2_004117F0 SetUnhandledExceptionFilter,	46_2_004117F0
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Code function: 46_2_00411810 SetUnhandledExceptionFilter,	46_2_00411810

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe

NtQueryInformationProcess: Indirect: 0x7FFBA216C34D

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe "C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe" -ip:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240727184154&is_silent=true&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100&b=&se=true" -vp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240727184154&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100&oip=26&ptl=7&dta=true" -dp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240727184154&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100" -i -v -d -se=true	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe "C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe "C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe" /S /tpchannelid=1571 /distid=App123	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Process created: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe "C:\Users\user\AppData\Local\Temp\3yq4abxg.exe" /silent	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Process created: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe "C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:10
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-UC9I1.tmp\_isetup\_setup64.tmp helper 105 0x44C
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 stop BadlionAntic
Source: C:\Windows\System32\net.exe	Process created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 stop BadlionAnticheat
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Process created: C:\Users\user\AppData\Local\Temp\Stub.exe "C:\Users\user\AppData\Local\Temp\Stub.exe" /products=epp /auto-repair=UnifiedStub
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Process created: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe "C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe"
Source: C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe	Process created: unknown unknown

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe "c:\users\user\appdata\local\temp\is-h908u.tmp\prod0.exe" -ip:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240727184154&is_silent=true&oc=zb_rav_cross_tri_ncb&p=cdc2&a=100&b=&se=true" -vp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240727184154&oc=zb_rav_cross_tri_ncb&p=cdc2&a=100&oip=26&ptl=7&dta=true" -dp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240727184154&oc=zb_rav_cross_tri_ncb&p=cdc2&a=100" -i -v -d -se=true
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe "c:\users\user\appdata\local\temp\is-h908u.tmp\prod0.exe" -ip:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240727184154&is_silent=true&oc=zb_rav_cross_tri_ncb&p=cdc2&a=100&b=&se=true" -vp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240727184154&oc=zb_rav_cross_tri_ncb&p=cdc2&a=100&oip=26&ptl=7&dta=true" -dp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240727184154&oc=zb_rav_cross_tri_ncb&p=cdc2&a=100" -i -v -d -se=true			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-UC9I1.tmp\_isetup\_setup64.tmp

Code function: 24_2_0000000140001000 GetNamedSecurityInfoW,AllocateAndInitializeSid,SetEntriesInAclW,SetNamedSecurityInfoW,LocalFree,FreeSid,LocalFree,GetLastError,

24_2_0000000140001000

Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	Binary or memory string: Shell_TrayWnd
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2122434367.0000000008896000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GetProgmanWindow
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	Binary or memory string: ToolbarWindow32Shell_TrayWnd
Source: cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000003.2122434367.0000000008896000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SetProgmanWindow

Language, Device and Operating System Detection

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Code function: 5_2_00F49215 cpuid

5_2_00F49215

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: GetLocaleInfoW,	5_2_00F645DA
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	5_2_00F6C65F
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: EnumSystemLocalesW,	5_2_00F6C9ED
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: EnumSystemLocalesW,	5_2_00F6C952
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: EnumSystemLocalesW,	5_2_00F6C907
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	5_2_00F6CA80
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: GetLocaleInfoW,	5_2_00F6CCE0
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_00F6CE06
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_00F6CFDB
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: GetLocaleInfoW,	5_2_00F6CF0C
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: GetLocaleInfoEx,	5_2_00F47E28
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe	Code function: EnumSystemLocalesW,	5_2_00F63F6D
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	25_2_00007FF78255CC00
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: GetLocaleInfoEx,_invalid_parameter_noinfo_noreturn,	25_2_00007FF7824E9C90
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: GetLocaleInfoEx,_invalid_parameter_noinfo_noreturn,	25_2_00007FF7824FFC30
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: EnumSystemLocalesW,	25_2_00007FF78255C514
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: EnumSystemLocalesW,	25_2_00007FF78254FCC0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	25_2_00007FF78255C1B8
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: _invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,GetLocaleInfoEx,OutputDebugStringW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	25_2_00007FF7824E89D0
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: GetLocaleInfoW,	25_2_00007FF782550258
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	25_2_00007FF78255CA1C
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: GetLocaleInfoEx,	25_2_00007FF782531AEC
Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe	Code function: EnumSystemLocalesW,	25_2_00007FF78255C5E4
Source: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe	Code function: GetLocaleInfoA,	38_2_00417F50
Source: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe	Code function: GetThreadLocale,GetLocaleInfoA,EnumCalendarInfoA,EnumCalendarInfoA,	38_2_004180C0
Source: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe	Code function: GetThreadLocale,GetLocaleInfoA,EnumCalendarInfoA,EnumCalendarInfoA,	38_2_004180BF
Source: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe	Code function: GetLocaleInfoHelper,	38_2_0040B3D0
Source: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,	38_2_00417E9F
Source: C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,	38_2_00417EB0
Source: C:\Program Files\Cheat Engine 7.5\windowsrepair.exe	Code function: GetLocaleInfoA,	39_2_0041F060
Source: C:\Program Files\Cheat Engine 7.5\windowsrepair.exe	Code function: GetLocaleInfoA,	39_2_0041F0C0
Source: C:\Program Files\Cheat Engine 7.5\windowsrepair.exe	Code function: GetThreadLocale,GetLocaleInfoA,EnumCalendarInfoA,EnumCalendarInfoA,	39_2_0041F230
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Code function: GetLocaleInfoA,	46_2_0042C210
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Code function: GetLocaleInfoA,	46_2_0042C270
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Code function: GetThreadLocale,GetLocaleInfoA,EnumCalendarInfoA,EnumCalendarInfoA,	46_2_0042C660
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Code function: GetLocaleInfoW,	46_2_0041F730
Source: C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe	Code function: GetLocaleInfoW,	46_2_0041F7A0

Queries the product ID of Windows

Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion DigitalProductId

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\logo.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\RAV_Cross.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\WebAdvisor.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\WeatherZero.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp	Queries volume information: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\finish.png VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsStubLib.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsLogger.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsJSON.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsAtom.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Microsoft.Win32.TaskScheduler.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsStubLib.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsLogger.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Code function: 5_2_00F64619 GetSystemTimeAsFileTime,

5_2_00F64619

Source: C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe

Code function: 25_2_00007FF782556850 _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

25_2_00007FF782556850

Source: C:\Users\user\AppData\Local\Temp\3yq4abxg.exe

Code function: 6_2_00401964 GetVersionExW,

6_2_00401964

Source: C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Adds / modifies Windows certificates

Source: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 Blob

Jump to behavior

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 32.3.Stub.exe.2ea9f48.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 49.3.Stub.exe.2ee1058.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.UnifiedStub-installer.exe.19b4c9d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.UnifiedStub-installer.exe.19b32870000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.3yq4abxg.exe.2ee1058.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.3yq4abxg.exe.2eb9f48.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.UnifiedStub-installer.exe.1fa16d80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.3.Stub.exe.2ed1058.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 49.3.Stub.exe.2eb9f48.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 49.3.Stub.exe.2e64ca4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.3yq4abxg.exe.2ee1058.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 49.3.Stub.exe.2eb9f48.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.3yq4abxg.exe.2eb9f48.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.3.Stub.exe.2ea9f48.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.3.Stub.exe.2ed1058.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 49.3.Stub.exe.2ee1058.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.3.Stub.exe.2e54ca4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 49.3.Stub.exe.2e40000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.3yq4abxg.exe.2e64ca4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.3yq4abxg.exe.2e40000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.3.Stub.exe.2e30000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002D.00000002.2185072195.000001FA16D82000.00000002.00000001.01000000.0000002A.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.2186104264.000001FA16E9D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3319865235.0000019B4C9D2000.00000002.00000001.01000000.00000031.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3282773301.0000019B32872000.00000002.00000001.01000000.00000030.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000003.2235185447.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsTime.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsAtom.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsAtom.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsLogger.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsDatabase.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsAtom.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsDatabase.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsJSON.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsJSON.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsLogger.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsJSON.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsTime.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsTime.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsDatabase.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsLogger.dll, type: DROPPED

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe

File opened: C:\Users\user\Appdata\Local\Google\Chrome\User Data\Default\Secure Preferences

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 32.3.Stub.exe.2ea9f48.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 49.3.Stub.exe.2ee1058.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.UnifiedStub-installer.exe.19b4c9d0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.UnifiedStub-installer.exe.19b32870000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.3yq4abxg.exe.2ee1058.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.3yq4abxg.exe.2eb9f48.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.UnifiedStub-installer.exe.1fa16d80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.3.Stub.exe.2ed1058.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 49.3.Stub.exe.2eb9f48.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 49.3.Stub.exe.2e64ca4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.3yq4abxg.exe.2ee1058.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 49.3.Stub.exe.2eb9f48.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.3yq4abxg.exe.2eb9f48.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.3.Stub.exe.2ea9f48.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.3.Stub.exe.2ed1058.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 49.3.Stub.exe.2ee1058.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.3.Stub.exe.2e54ca4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 49.3.Stub.exe.2e40000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.3yq4abxg.exe.2e64ca4.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.3yq4abxg.exe.2e40000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.3.Stub.exe.2e30000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002D.00000002.2185072195.000001FA16D82000.00000002.00000001.01000000.0000002A.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.2186104264.000001FA16E9D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3319865235.0000019B4C9D2000.00000002.00000001.01000000.00000031.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3282773301.0000019B32872000.00000002.00000001.01000000.00000030.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000003.2235185447.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsTime.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsAtom.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsAtom.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsLogger.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsDatabase.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsAtom.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsDatabase.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsJSON.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsJSON.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsLogger.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsJSON.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsTime.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsTime.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsDatabase.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsLogger.dll, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
1 Software	Acquire Infrastructure	1 Valid Accounts	11 Windows Management Instrumentation	1 LSASS Driver	1 Abuse Elevation Control Mechanism	21 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	131 Native API	1 DLL Side-Loading	1 LSASS Driver	11 Deobfuscate/Decode Files or Information	11 Input Capture	3 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	1 Valid Accounts	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	168 System Information Discovery	SMB/Windows Admin Shares	11 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	11 Scheduled Task/Job	26 Windows Service	1 Valid Accounts	2 Obfuscated Files or Information	NTDS	1 Query Registry	Distributed Component Object Model	1 Clipboard Data	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	23 Service Execution	11 Scheduled Task/Job	11 Access Token Manipulation	1 Software Packing	LSA Secrets	61 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	1 Registry Run Keys / Startup Folder	26 Windows Service	1 Timestomp	Cached Domain Credentials	151 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	1 Services File Permissions Weakness	12 Process Injection	1 DLL Side-Loading	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	11 Scheduled Task/Job	3 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	1 Registry Run Keys / Startup Folder	1 Valid Accounts	/etc/passwd and /etc/shadow	2 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	1 Services File Permissions Weakness	1 Modify Registry	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	151 Virtualization/Sandbox Evasion	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	11 Access Token Manipulation	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	12 Process Injection	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service
Business Relationships	Server	Trusted Relationship	Visual Basic	Container Orchestration Job	Container Orchestration Job	1 Hidden Files and Directories	Web Portal Capture	Local Groups	Component Object Model and Distributed COM	Local Email Collection	Internal Proxy	Commonly Used Port	Direct Network Flood
Identify Business Tempo	Botnet	Hardware Additions	Python	Hypervisor	Process Injection	1 Services File Permissions Weakness	Credential API Hooking	Domain Groups	Exploitation of Remote Services	Remote Email Collection	External Proxy	Transfer Data to Cloud Account	Reflection Amplification

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe	47%	ReversingLabs	Win32.Trojan.Generic
SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe	100%	Avira	PUA/OfferCore.Gen

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\WeatherZero\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Program Files (x86)\WeatherZero\WeatherZero.exe	0%	ReversingLabs
C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe	3%	ReversingLabs
C:\Program Files (x86)\WeatherZero\uninstall.exe	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\CSCompiler.dll (copy)	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe (copy)	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\DotNetDataCollector32.exe (copy)	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\DotNetDataCollector64.exe (copy)	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe (copy)	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\Tutorial-x86_64.exe (copy)	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\allochook-i386.dll (copy)	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\allochook-x86_64.dll (copy)	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\autorun\dlls\32\CEJVMTI.dll (copy)	3%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\autorun\dlls\32\is-5VCS0.tmp	3%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\autorun\dlls\64\CEJVMTI.dll (copy)	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\autorun\dlls\64\is-0JUIF.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\autorun\dlls\DotNetInterface.dll (copy)	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\autorun\dlls\MonoDataCollector32.dll (copy)	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\autorun\dlls\MonoDataCollector64.dll (copy)	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-397QA.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-BGU0I.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-UD451.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\ced3d10hook.dll (copy)	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\ced3d10hook64.dll (copy)	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\ced3d11hook.dll (copy)	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\ced3d11hook64.dll (copy)	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\ced3d9hook.dll (copy)	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\ced3d9hook64.dll (copy)	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\ceregreset.exe (copy)	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\cheatengine-i386.exe (copy)	8%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe (copy)	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64.exe (copy)	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\clibs32\is-AQQPT.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\clibs32\lfs.dll (copy)	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\clibs64\is-701OU.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\clibs64\lfs.dll (copy)	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\d3dhook.dll (copy)	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\d3dhook64.dll (copy)	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\gtutorial-i386.exe (copy)	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\gtutorial-x86_64.exe (copy)	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-04JI4.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-1HAUB.tmp	8%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-1U45L.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-27N0B.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-4H8E2.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-5DOON.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-6LSG2.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-76J7R.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-7DIKH.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-7NK6B.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-7TSFI.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-81GE3.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-8G4IN.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-8HLKV.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-9UL4R.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-A30LA.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-A5OSQ.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-AATAN.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-AJB6K.tmp	3%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-ASU18.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-AUJ8A.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-BQRFH.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-ERBSE.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-FC05A.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-IM0FE.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-JBLAJ.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-KLETU.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-L37DV.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-L3GJI.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-LR956.tmp	0%	ReversingLabs
C:\Program Files\Cheat Engine 7.5\is-MRM89.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
https://www.remobjects.com/ps	0%	URL Reputation	safe
https://www.innosetup.com/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_Error	0%	URL Reputation	safe
http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
https://sadownload.mcafee.com/n	0%	Avira URL Cloud	safe
https://www.reasonsecurity.com/safer-web/privacy-policy?utm_source=reason_safer_web_installer	0%	Avira URL Cloud	safe
https://reasonlabs.com/policiesiveEventeatherZero/images/969/EN.pngzipam	0%	Avira URL Cloud	safe
https://sadownload.mcafee.com/l	0%	Avira URL Cloud	safe
https://d3cored83b0wp2.cloudfront.net/e	0%	Avira URL Cloud	safe
https://shield.reasonsecurity.com/rsStubActivator.exe/	0%	Avira URL Cloud	safe
https://sadownload.mcafee.com/o	0%	Avira URL Cloud	safe
https://d3cored83b0wp2.cloudfront.net/f/RAV_Triple_NCB/images/DOTPS-855/EN.png	0%	Avira URL Cloud	safe
https://home.mcafee.com/Root/AboutUs.aspx?id=eula	0%	Avira URL Cloud	safe
https://shield.reasonsecurity.com/	0%	Avira URL Cloud	safe
https://localweatherfree.com/	0%	Avira URL Cloud	safe
https://www.premieropinion.com/common/termsofservice-v1	0%	Avira URL Cloud	safe
https://cheatengine.org/latestversion.txt	0%	Avira URL Cloud	safe
https://d3cored83b0wp2.cloudfront.net/?	0%	Avira URL Cloud	safe
https://sadownload.mcafee.com/products/sa/bsi/win/binary/	0%	Avira URL Cloud	safe
https://beta.reasonlabs.com/contact-us?prod=2&utm_source=vpn_uninstall&utm_medium=home_contact_suppo	0%	Avira URL Cloud	safe
https://analytics.apis.mcafee.com:443/mosaic/2.0/product-web/am/v1/recordps://sadownload.mcafee.com/	0%	Avira URL Cloud	safe
https://www.mcafee.com/consumer/v/wa-how.htmlL	0%	Avira URL Cloud	safe
https://localweatherfree.com/forecastdT	0%	Avira URL Cloud	safe
https://www.360totalsecurity.com/en/license/Z	0%	Avira URL Cloud	safe
https://reasonlabs.com/policiesr	0%	Avira URL Cloud	safe
https://sadownload.mcafee.com/products/SA/BSI/bsi_abtest.xml	0%	Avira URL Cloud	safe
https://d3cored83b0wp2.cloudfront.net/5	0%	Avira URL Cloud	safe
https://d3cored83b0wp2.cloudfront.net/0	0%	Avira URL Cloud	safe
https://reasonlabs.com/policiesq	0%	Avira URL Cloud	safe
https://reasonlabs.com/platform/packages/essential?utm_source=rav_uninstall&utm_medium=home_website_	0%	Avira URL Cloud	safe
https://d3cored83b0wp2.cloudfront.net/f/WebAdvisor/images/943/EN.pnge	0%	Avira URL Cloud	safe
https://cheatengine.org/dbkerror.phpopen	0%	Avira URL Cloud	safe
https://d3cored83b0wp2.cloudfront.net/f/WebAdvisor/images/943/EN.pngipe	0%	Avira URL Cloud	safe
https://d3cored83b0wp2.cloudfront.net/f/WebAdvisor/images/943/EN.pngc	0%	Avira URL Cloud	safe
https://sadownload.mcafee.com/products/SA/BSI/bsi_PartnerDistribution.xml	0%	Avira URL Cloud	safe
https://localweatherfree.com/forecastLnCZyJIT3VIHOjglwhzNosGx/9V1OxmW	0%	Avira URL Cloud	safe
https://shield.reasonsecurity.com/ReasonLabs-Setup-Wizard.exe	0%	Avira URL Cloud	safe
https://d3cored83b0wp2.cloudfront.net/f/WeatherZero/images/969/EN.pngzip	0%	Avira URL Cloud	safe
https://localweatherfree.com/forecasttJ	0%	Avira URL Cloud	safe
https://www.winzip.com/win/en/privacy.html	0%	Avira URL Cloud	safe
https://www.mcafee.com/consumer/en-us/policy/	0%	Avira URL Cloud	safe
https://www.mcafee.com/consumer/v/wa-how.htmlf	0%	Avira URL Cloud	safe
https://www.opera.com/he/eula/computers	0%	Avira URL Cloud	safe
https://www.avg.com/ww-en/eulaM	0%	Avira URL Cloud	safe
https://www.winzip.com/win/en/privacy.htmlc	0%	Avira URL Cloud	safe
https://d3cored83b0wp2.cloudfront.net/f/WebAdvisor/files/1489/saBSI.zip	0%	Avira URL Cloud	safe
https://localweatherfree.com/forecast32	0%	Avira URL Cloud	safe
https://sadownload.mcafee.com/products/SA/v1/installer/4.1.1/914/	0%	Avira URL Cloud	safe
https://d3cored83b0wp2.cloudfront.net/f/WebAdvisor/images/943/EN.png	0%	Avira URL Cloud	safe
https://www.mcafee.com/consumer/v/wa-how.htmlW	0%	Avira URL Cloud	safe
https://localweatherfree.com/forecastt&	0%	Avira URL Cloud	safe
https://localweatherfree.com/E	0%	Avira URL Cloud	safe
https://update.reasonsecurity.com/v2/update	0%	Avira URL Cloud	safe
https://sadownload.mcafee.com/products/SA/BSI/bsi_PartnerDistribution.xml/	0%	Avira URL Cloud	safe
https://analytics.apis.mcafee.comhttps://analytics.qa.apis.mcafee.com/mosaic/2.0/product-web/am/v1/r	0%	Avira URL Cloud	safe
https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRules.xmlB	0%	Avira URL Cloud	safe
https://reasonlabs.com/policiesrivacy-policyisor/files/1489/saBSI.zip	0%	Avira URL Cloud	safe
https://d3cored83b0wp2.cloudfront.net/f/WeatherZero/images/969/EN.pnga	0%	Avira URL Cloud	safe
https://www.cheatengine.org/	0%	Avira URL Cloud	safe
https://shield.reasonsecurity.com	0%	Avira URL Cloud	safe
https://d3cored83b0wp2.cloudfront.net/f/WeatherZero/files/969/WZSetup.zip	0%	Avira URL Cloud	safe
https://d3cored83b0wp2.cloudfront.net/o	0%	Avira URL Cloud	safe
https://update.reasonsecurity.com/v2/live	0%	Avira URL Cloud	safe
https://analytics.apis.mcafee.com/	0%	Avira URL Cloud	safe
https://sadownload.mcafee.com/products/SA/v1/bsi	0%	Avira URL Cloud	safe
https://www.mcafee.com/consumer/en-us/policy/legal.htmlD	0%	Avira URL Cloud	safe
https://www.premieropinion.	0%	Avira URL Cloud	safe
https://d3cored83b0wp2.cloudfront.net/f/WeatherZero/images/969/EN.pngc	0%	Avira URL Cloud	safe
https://shield.reasonsecurity.com/rsStubActivator.exeles/969/WZSetup.zip	0%	Avira URL Cloud	safe
https://d3cored83b0wp2.cloudfront.net/f/WeatherZero/files/969/WZSetup.zip2yhVX	0%	Avira URL Cloud	safe
https://github.com/dahall/taskscheduler	0%	Avira URL Cloud	safe
https://sadownload.mcafee.com/products/sa/bsi/win/binary	0%	Avira URL Cloud	safe
https://sadownload.mcafee.com/x	0%	Avira URL Cloud	safe
https://www.winzip.com/win/en/eula.html	0%	Avira URL Cloud	safe
https://www.reasonsecurity.com/vpn/terms?utm_source=reason_vpn_installer	0%	Avira URL Cloud	safe
https://www.patreon.com/cheatengineopenhttps://cheatengine.org/http://forum.cheatengine.org/	0%	Avira URL Cloud	safe
https://update-beta.reasonsecurity.com/v2/live	0%	Avira URL Cloud	safe
https://webcompanion.com/termsP	0%	Avira URL Cloud	safe
https://sadownload.mcafee.com/products/SA/BSI/Win/binary/4.1.0/update_bsi_self.xml/	0%	Avira URL Cloud	safe
https://www.nortonlifelock.com/us/en/legal/license-services-agreement/G	0%	Avira URL Cloud	safe
https://cheatengine.org/microtransaction.php?action=buy&amount=	0%	Avira URL Cloud	safe
https://system.data.sqlite.org/X	0%	Avira URL Cloud	safe
https://d3cored83b0wp2.cloudfront.net/f/WeatherZero/images/969/EN.pngzipam	0%	Avira URL Cloud	safe
https://d3cored83b0wp2.cloudfront.net/	0%	Avira URL Cloud	safe
http://www.cheatengine.org/?referredby=CE%.2f	0%	Avira URL Cloud	safe
https://update-beta.reasonsecurity.com/v2/update	0%	Avira URL Cloud	safe
https://reasonlabs.com/policies	0%	Avira URL Cloud	safe
https://sadownload.mcafee.com/	0%	Avira URL Cloud	safe
https://d3cored83b0wp2.cloudfront.net/zbd	0%	Avira URL Cloud	safe
https://reasonlabs.com/policiesrivacy-policy88e10f08e18ca857b7883846325fInstaller_IC201102_ISV.zip	0%	Avira URL Cloud	safe
https://update.reasonsecurity.com/v2/livelive	0%	Avira URL Cloud	safe
https://www.avast.com	0%	Avira URL Cloud	safe
http://d14mh4uvqj4iiz.cloudfront.net	0%	Avira URL Cloud	safe
https://sadownload.mcafee.com/products/SA/BSI/bsi_PaidDistribution.xml	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mosaic-orio.apis.mcafee.com	35.162.225.150	true	false	unknown
cheatengine.org	104.20.94.94	true	false	unknown
d3cored83b0wp2.cloudfront.net	18.173.206.112	true	false	unknown
localweatherfree.com	188.114.96.3	true	false	unknown
d14mh4uvqj4iiz.cloudfront.net	18.172.112.34	true	false	unknown
atom-production-collector-cyber-224812358.us-east-1.elb.amazonaws.com	3.230.219.225	true	false	unknown
shield.reasonsecurity.com	unknown	unknown	false	unknown
analytics.apis.mcafee.com	unknown	unknown	false	unknown
track.analytics-data.io	unknown	unknown	false	unknown
sadownload.mcafee.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://d3cored83b0wp2.cloudfront.net/f/RAV_Triple_NCB/images/DOTPS-855/EN.png	false	Avira URL Cloud: safe	unknown
https://cheatengine.org/latestversion.txt	false	Avira URL Cloud: safe	unknown
https://d3cored83b0wp2.cloudfront.net/f/WebAdvisor/files/1489/saBSI.zip	false	Avira URL Cloud: safe	unknown
https://d3cored83b0wp2.cloudfront.net/f/WebAdvisor/images/943/EN.png	false	Avira URL Cloud: safe	unknown
https://d3cored83b0wp2.cloudfront.net/o	false	Avira URL Cloud: safe	unknown
https://d3cored83b0wp2.cloudfront.net/f/WeatherZero/files/969/WZSetup.zip	false	Avira URL Cloud: safe	unknown
https://d3cored83b0wp2.cloudfront.net/zbd	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://reasonlabs.com/policiesiveEventeatherZero/images/969/EN.pngzipam	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.reasonsecurity.com/safer-web/privacy-policy?utm_source=reason_safer_web_installer	3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://d3cored83b0wp2.cloudfront.net/e	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1578782739.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1863363539.0000000004F35000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2059425218.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sadownload.mcafee.com/o	saBSI.exe, 00000005.00000003.1894003745.000000000320F000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1893113809.000000000320C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sadownload.mcafee.com/n	saBSI.exe, 00000005.00000003.1931266022.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1916253547.00000000031D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://home.mcafee.com/Root/AboutUs.aspx?id=eula	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2172217386.0000000004E71000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002CD9000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRules.xml/	saBSI.exe, 00000005.00000003.1895622893.00000000054D6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://sadownload.mcafee.com/l	saBSI.exe, 00000005.00000003.1895689100.000000000320D000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1893113809.000000000320C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://shield.reasonsecurity.com/rsStubActivator.exe/	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1844139575.0000000004EED000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1864310516.0000000004EED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://shield.reasonsecurity.com/	prod0.exe, 00000004.00000002.3283145627.000002A3D1801000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://localweatherfree.com/	WZSetup.exe, 00000007.00000003.1994178474.00000000007A8000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000002.1998636294.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000003.1994867793.000000000075E000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000003.1922914800.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000003.1992384218.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000003.1947310455.00000000007A9000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000002.1998170408.000000000075E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.premieropinion.com/common/termsofservice-v1	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2159882150.0000000006D36000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://analytics.apis.mcafee.com:443/mosaic/2.0/product-web/am/v1/recordps://sadownload.mcafee.com/	saBSI.exe, 00000005.00000003.2570621559.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2571183671.00000000054F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sadownload.mcafee.com/products/sa/bsi/win/binary/	saBSI.exe, 00000005.00000003.1975165861.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2442104275.00000000054EE000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2570621559.00000000054EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://beta.reasonlabs.com/contact-us?prod=2&utm_source=vpn_uninstall&utm_medium=home_contact_suppo	3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://d3cored83b0wp2.cloudfront.net/?	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://localweatherfree.com/forecastdT	WZSetup.exe, 00000007.00000003.1907678051.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.360totalsecurity.com/en/license/Z	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2171737967.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.remobjects.com/ps	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe, 00000000.00000003.1405939759.0000000002670000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe, 00000000.00000003.1407943952.000000007FB70000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000000.1409808513.0000000000401000.00000020.00000001.01000000.00000004.sdmp, CheatEngine75.exe, 0000000C.00000003.1884318482.0000000002530000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1888165639.000000007FB30000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000000.1892916012.0000000000401000.00000020.00000001.01000000.00000018.sdmp	false	URL Reputation: safe	unknown
https://www.mcafee.com/consumer/v/wa-how.htmlL	saBSI.exe, 00000005.00000002.2583025617.000000000314E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reasonlabs.com/policiesr	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000A79000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sadownload.mcafee.com/products/SA/BSI/bsi_abtest.xml	saBSI.exe, 00000005.00000003.2441868888.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2442104275.00000000054D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2451927696.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1931229204.00000000054D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2451252709.0000000003213000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1882145312.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1895689100.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2571183671.00000000054D9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1974949012.0000000003210000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2571518040.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1927510273.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1975165861.00000000054D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1927510273.000000000320E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1985361133.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1893113809.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1916114316.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1893560349.0000000003212000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reasonlabs.com/policiesq	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000A79000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.innosetup.com/	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe, 00000000.00000003.1405939759.0000000002670000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe, 00000000.00000003.1407943952.000000007FB70000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000000.1409808513.0000000000401000.00000020.00000001.01000000.00000004.sdmp, CheatEngine75.exe, 0000000C.00000003.1884318482.0000000002530000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.exe, 0000000C.00000003.1888165639.000000007FB30000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000000.1892916012.0000000000401000.00000020.00000001.01000000.00000018.sdmp	false	URL Reputation: safe	unknown
https://cheatengine.org/dbkerror.phpopen	cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	false	Avira URL Cloud: safe	unknown
https://d3cored83b0wp2.cloudfront.net/5	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508883120.0000000000A93000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://d3cored83b0wp2.cloudfront.net/0	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://d3cored83b0wp2.cloudfront.net/f/WebAdvisor/images/943/EN.pngipe	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508883120.0000000000A93000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reasonlabs.com/platform/packages/essential?utm_source=rav_uninstall&utm_medium=home_website_	3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000002.3283444796.0000019B3408C000.00000004.00000800.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	prod0.exe, 00000004.00000002.3283145627.000002A3D1801000.00000004.00000800.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000002.3283444796.0000019B3408C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://d3cored83b0wp2.cloudfront.net/f/WebAdvisor/images/943/EN.pnge	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1864310516.0000000004EA9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2124115026.0000000004EA9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2150822703.0000000004EA9000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2463662036.0000000004EAC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://d3cored83b0wp2.cloudfront.net/f/WebAdvisor/images/943/EN.pngc	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508883120.0000000000A93000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://localweatherfree.com/forecastLnCZyJIT3VIHOjglwhzNosGx/9V1OxmW	WZSetup.exe, 00000007.00000003.1992384218.00000000007AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sadownload.mcafee.com/products/SA/BSI/bsi_PartnerDistribution.xml	saBSI.exe, 00000005.00000003.2441868888.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2451927696.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2451252709.0000000003213000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1882145312.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1895689100.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1974949012.0000000003210000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2571518040.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1927510273.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1985361133.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1893113809.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1916114316.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1893560349.0000000003212000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.winzip.com/win/en/privacy.html	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002CD9000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://d3cored83b0wp2.cloudfront.net/f/WeatherZero/images/969/EN.pngzip	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1578782739.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://shield.reasonsecurity.com/ReasonLabs-Setup-Wizard.exe	prod0.exe, 00000004.00000002.3283145627.000002A3D1801000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.avast.com/eula#pc	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000A85000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1578782739.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2456178236.0000000000A94000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000A84000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A8F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508883120.0000000000A93000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000A90000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2456178236.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2172039331.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002CD9000.00000004.00001000.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000A94000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2460450691.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://localweatherfree.com/forecasttJ	WZSetup.exe, 00000007.00000003.1947310455.00000000007A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.mcafee.com/consumer/en-us/policy/	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2159882150.0000000006D27000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.mcafee.com/consumer/v/wa-how.htmlf	saBSI.exe, 00000005.00000002.2583025617.000000000314E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.avg.com/ww-en/eulaM	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000A79000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.opera.com/he/eula/computers	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002CD9000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.winzip.com/win/en/privacy.htmlc	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2171737967.00000000009E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://localweatherfree.com/forecast32	WZSetup.exe, 00000007.00000003.1922914800.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sadownload.mcafee.com/products/SA/v1/installer/4.1.1/914/	saBSI.exe, 00000005.00000003.2441980925.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1975165861.00000000054D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1975037735.000000000320C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.mcafee.com/consumer/v/wa-how.htmlW	saBSI.exe, 00000005.00000002.2583025617.000000000314E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://update.reasonsecurity.com/v2/update	3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000002.3283444796.0000019B3408C000.00000004.00000800.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://localweatherfree.com/forecastt&	WZSetup.exe, 00000007.00000003.1907678051.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_Error	WZSetup.exe, WZSetup.exe, 00000007.00000000.1865545320.000000000040A000.00000008.00000001.01000000.00000012.sdmp, WZSetup.exe, 00000007.00000002.1995533666.000000000040A000.00000004.00000001.01000000.00000012.sdmp, WZSetup.exe, 00000007.00000003.1994147598.0000000002841000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://localweatherfree.com/E	WZSetup.exe, 00000007.00000003.1907678051.00000000007AF000.00000004.00000020.00020000.00000000.sdmp, WZSetup.exe, 00000007.00000003.1922914800.00000000007AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sadownload.mcafee.com/products/SA/BSI/bsi_DistributionRules.xmlB	saBSI.exe, 00000005.00000003.1931266022.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1916253547.00000000031D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd	CheatEngine75.tmp, 0000000D.00000003.2017396988.00000000054D0000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://analytics.apis.mcafee.comhttps://analytics.qa.apis.mcafee.com/mosaic/2.0/product-web/am/v1/r	saBSI.exe, 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmp, saBSI.exe, 00000005.00000000.1845266666.0000000000F8E000.00000002.00000001.01000000.00000010.sdmp	false	Avira URL Cloud: safe	unknown
https://sadownload.mcafee.com/products/SA/BSI/bsi_PartnerDistribution.xml/	saBSI.exe, 00000005.00000003.1893113809.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1974949012.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1916114316.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2451252709.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441868888.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1985361133.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1895689100.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1927510273.0000000003228000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reasonlabs.com/policiesrivacy-policyisor/files/1489/saBSI.zip	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2172039331.0000000000AAB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://d3cored83b0wp2.cloudfront.net/f/WeatherZero/images/969/EN.pnga	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2455203792.0000000000A2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://shield.reasonsecurity.com	prod0.exe, 00000004.00000002.3283145627.000002A3D18DC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.cheatengine.org/	CheatEngine75.exe, 0000000C.00000003.2042781311.00000000023A1000.00000004.00001000.00020000.00000000.sdmp, CheatEngine75.tmp, 0000000D.00000003.2035583319.00000000023B1000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://update.reasonsecurity.com/v2/live	rsSyncSvc.exe, 0000001E.00000002.3266265212.00000245547B0000.00000004.00000020.00020000.00000000.sdmp, rsSyncSvc.exe, 0000001E.00000002.3266265212.00000245547B7000.00000004.00000020.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://analytics.apis.mcafee.com/	saBSI.exe, 00000005.00000002.2583025617.000000000314E000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.00000000031B7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sadownload.mcafee.com/products/SA/v1/bsi	saBSI.exe, 00000005.00000003.2442104275.00000000054D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1931229204.00000000054D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2571183671.00000000054D9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1975835833.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1975165861.00000000054D6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.mcafee.com/consumer/en-us/policy/legal.htmlD	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000A61000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.premieropinion.	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2159882150.0000000006CB9000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://d3cored83b0wp2.cloudfront.net/f/WeatherZero/images/969/EN.pngc	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000A90000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1578782739.0000000000A93000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://shield.reasonsecurity.com/rsStubActivator.exeles/969/WZSetup.zip	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2172039331.0000000000AAB000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://d3cored83b0wp2.cloudfront.net/f/WeatherZero/files/969/WZSetup.zip2yhVX	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1578782739.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/dahall/taskscheduler	3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000002.3321945122.0000019B4CE52000.00000002.00000001.01000000.00000032.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sadownload.mcafee.com/products/sa/bsi/win/binary	saBSI.exe, 00000005.00000003.2442104275.00000000054D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1931229204.00000000054D6000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2571183671.00000000054D9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1975165861.00000000054D6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sadownload.mcafee.com/x	saBSI.exe, 00000005.00000003.1931266022.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1916253547.00000000031D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.winzip.com/win/en/eula.html	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2171737967.00000000009E0000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2154832567.0000000002CD9000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.reasonsecurity.com/vpn/terms?utm_source=reason_vpn_installer	3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://webcompanion.com/termsP	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000A70000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000A79000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1863363539.0000000004F35000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2059425218.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://update-beta.reasonsecurity.com/v2/live	3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.patreon.com/cheatengineopenhttps://cheatengine.org/http://forum.cheatengine.org/	cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	false	Avira URL Cloud: safe	unknown
https://sadownload.mcafee.com/products/SA/BSI/Win/binary/4.1.0/update_bsi_self.xml/	saBSI.exe, 00000005.00000003.1893113809.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1974949012.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1916114316.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2451252709.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2441868888.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1985361133.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1895689100.0000000003228000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1927510273.0000000003228000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://system.data.sqlite.org/X	3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.nortonlifelock.com/us/en/legal/license-services-agreement/G	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2151300458.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1578782739.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508883120.0000000000A93000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2125493265.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cheatengine.org/microtransaction.php?action=buy&amount=	cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1863363539.0000000004F35000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.2059425218.0000000006A07000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://d3cored83b0wp2.cloudfront.net/f/WeatherZero/images/969/EN.pngzipam	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1578782739.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://d3cored83b0wp2.cloudfront.net/	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1578782739.0000000000AA5000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508931587.0000000000A42000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.cheatengine.org/?referredby=CE%.2f	cheatengine-x86_64-SSE4-AVX2.exe, 0000002F.00000000.2098562119.0000000000CBF000.00000002.00000001.01000000.00000022.sdmp	false	Avira URL Cloud: safe	unknown
https://reasonlabs.com/policies	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000002.2464054224.0000000004EC1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://update-beta.reasonsecurity.com/v2/update	3yq4abxg.exe, 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, UnifiedStub-installer.exe, 0000000B.00000000.1874742651.0000019B322F2000.00000002.00000001.01000000.00000015.sdmp, Stub.exe, 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sadownload.mcafee.com/	saBSI.exe, 00000005.00000003.1916253547.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1893113809.000000000320C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://update.reasonsecurity.com/v2/livelive	rsSyncSvc.exe, 00000019.00000002.1921438935.0000019D7C68C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reasonlabs.com/policiesrivacy-policy88e10f08e18ca857b7883846325fInstaller_IC201102_ISV.zip	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1607076503.0000000000A67000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.avast.com	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp, 00000002.00000003.1508883120.0000000000A93000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://d14mh4uvqj4iiz.cloudfront.net	prod0.exe, 00000004.00000002.3283145627.000002A3D18F4000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sadownload.mcafee.com/products/SA/BSI/bsi_PaidDistribution.xml	saBSI.exe, 00000005.00000003.1916253547.00000000031D0000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1985361133.0000000003215000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000002.2583025617.00000000031B7000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1893113809.000000000320C000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.2442884926.00000000031C9000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1916114316.0000000003212000.00000004.00000020.00020000.00000000.sdmp, saBSI.exe, 00000005.00000003.1893560349.0000000003212000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
188.114.96.3	localweatherfree.com	European Union	13335	CLOUDFLARENETUS	false
18.173.206.112	d3cored83b0wp2.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
35.162.225.150	mosaic-orio.apis.mcafee.com	United States	16509	AMAZON-02US	false
3.230.219.225	atom-production-collector-cyber-224812358.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
18.172.112.34	d14mh4uvqj4iiz.cloudfront.net	United States	3	MIT-GATEWAYSUS	false
104.20.94.94	cheatengine.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1483536
Start date and time:	2024-07-28 00:40:53 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 14m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	55
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe
Detection:	MAL
Classification:	mal46.troj.spyw.evad.winEXE@72/800@11/6
EGA Information:	Successful, ratio: 73.3%
HCA Information:	Successful, ratio: 64% Number of executed functions: 130 Number of non-executed functions: 194
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.22.242.105, 2.22.242.114, 104.18.21.226, 104.18.20.226, 2.19.126.150, 2.19.126.156
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, cdn.globalsigncdn.com.cdn.cloudflare.net, a866.dscd.akamai.net, ctldl.windowsupdate.com, secure.globalsign.com, fe3cr.delivery.mp.microsoft.com, global.prd.cdn.globalsign.com, home.mcafee.com, ocsp.digicert.com, sadownload.mcafee.com.edgesuite.net, ip-api.com, api.openweathermap.org
Execution Graph export aborted for target Stub.exe, PID 7800 because there are no executed function
Execution Graph export aborted for target Stub.exe, PID 7880 because there are no executed function
Execution Graph export aborted for target UnifiedStub-installer.exe, PID 7380 because it is empty
Execution Graph export aborted for target UnifiedStub-installer.exe, PID 7656 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtEnumerateValueKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe

Simulations

Behavior and APIs

Time	Type	Description
00:42:40	Task Scheduler	Run new task: EPPHealthCheck path: C:\Program Files\ReasonLabs\EPP\Uninstall.exe s>/auto-repair=UnifiedStub
18:43:29	API Interceptor	366x Sleep call for process: WeatherZeroService.exe modified
18:43:32	API Interceptor	90892x Sleep call for process: cheatengine-x86_64-SSE4-AVX2.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	QUOTATION_JULQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	filetransfer.io/data-package/v4mecse6/download
	Final Shipping Document.exe	Get hash	malicious	FormBook	Browse	www.artfulfusionhub.lat/qogc/
	RFQ#51281AOLAI.xls	Get hash	malicious	FormBook, PureLog Stealer	Browse	tny.wtf/
	DHL Shipment Notification 490104998009.xls	Get hash	malicious	Remcos	Browse	tny.wtf/dg4Zx
	Purchase Inquiry.xla.xlsx	Get hash	malicious	Remcos	Browse	tny.wtf/c8lH8
	AWD 490104998518.xls	Get hash	malicious	Remcos	Browse	tny.wtf/sA
	waybill_shipping_documents_original_BL_CI&PL_26_07_2024_00000000_doc.xls	Get hash	malicious	GuLoader, Remcos	Browse	hq.ax/Oi8
	RFQ#51281AOLAI.xls	Get hash	malicious	FormBook, PureLog Stealer	Browse	tny.wtf/dGa
	RFQ#51281AOLAI.xls	Get hash	malicious	FormBook, PureLog Stealer	Browse	tny.wtf/
	Quotation.xls	Get hash	malicious	Remcos	Browse	tny.wtf/jjJsPX
18.172.112.34	SecuriteInfo.com.Trojan.InstallCore.4086.24549.19610.exe	Get hash	malicious	PrivateLoader, PureLog Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mosaic-orio.apis.mcafee.com	Lisect_AVT_24003_G1B_127.exe	Get hash	malicious	PureLog Stealer	Browse	54.71.68.83
	SecuriteInfo.com.Riskware.OfferCore.5002.4698.exe	Get hash	malicious	PrivateLoader	Browse	52.25.171.187
	https://www.poweriso.net/PowerISO8-x64.exe	Get hash	malicious	Unknown	Browse	52.26.85.137
atom-production-collector-cyber-224812358.us-east-1.elb.amazonaws.com	Lisect_AVT_24003_G1B_127.exe	Get hash	malicious	PureLog Stealer	Browse	54.166.97.7
	https://www.poweriso.net/PowerISO8-x64.exe	Get hash	malicious	Unknown	Browse	54.225.153.117
	https://mozilla-firefox.fileplanet.com/download	Get hash	malicious	Unknown	Browse	54.85.139.85
	RAVUpdate-v5.2.12.0.exe	Get hash	malicious	Unknown	Browse	107.23.111.162
d14mh4uvqj4iiz.cloudfront.net	Lisect_AVT_24003_G1B_127.exe	Get hash	malicious	PureLog Stealer	Browse	18.172.112.38

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MIT-GATEWAYSUS	https://chattts-49f1.beszyrecala.workers.dev/44251fe9-ad0f-4b4c-84e3-2d=	Get hash	malicious	Unknown	Browse	18.66.147.29
	https://chattts-49f1.beszyrecala.workers.dev/d710b28d-67f4-4fc6-8225-c3=	Get hash	malicious	Unknown	Browse	18.66.147.29
	https://help-add-metamask.gitbook.io/us	Get hash	malicious	Unknown	Browse	18.66.196.38
	https://auth-start-treizor.github.io/	Get hash	malicious	Unknown	Browse	18.165.142.126
	http://oveman-austral.com/	Get hash	malicious	Unknown	Browse	18.173.205.104
	http://capitalhillblue.com/	Get hash	malicious	Unknown	Browse	18.172.112.71
	https://bnpparibasfortis.centralapp.com/	Get hash	malicious	Unknown	Browse	18.165.183.97
	file.exe	Get hash	malicious	Unknown	Browse	18.65.39.85
	file.exe	Get hash	malicious	Unknown	Browse	18.66.196.17
CLOUDFLARENETUS	https://help-metsehelp.gitbook.io/us	Get hash	malicious	Unknown	Browse	172.64.147.209
	https://nishant800.github.io/netflixclone/	Get hash	malicious	HTMLPhisher	Browse	172.64.155.119
	https://chattts-49f1.beszyrecala.workers.dev/4f0cc84a-cc5d-4813-a6b3-3f=	Get hash	malicious	Unknown	Browse	172.67.196.219
	https://chattts-49f1.beszyrecala.workers.dev/44251fe9-ad0f-4b4c-84e3-2d=	Get hash	malicious	Unknown	Browse	104.16.119.9
	https://chattts-49f1.beszyrecala.workers.dev/627c9347-142c-4ee6-9449-ca=	Get hash	malicious	Unknown	Browse	172.64.154.107
	https://chattts-49f1.beszyrecala.workers.dev/c334d550-f2d5-4302-b1a8-b3=	Get hash	malicious	Unknown	Browse	172.64.154.107
	https://chattts-49f1.beszyrecala.workers.dev/2af31485-176d-4e5a-9006-e1=	Get hash	malicious	Unknown	Browse	172.64.154.107
	https://chattts-49f1.beszyrecala.workers.dev/d710b28d-67f4-4fc6-8225-c3=	Get hash	malicious	Unknown	Browse	104.16.119.9
	https://help-add-metamask.gitbook.io/us	Get hash	malicious	Unknown	Browse	172.64.146.167
	https://dsfdgfhjkjkhjgfnmbvbjn.pages.dev/atttt	Get hash	malicious	HTMLPhisher	Browse	172.66.44.60
AMAZON-02US	https://nishant800.github.io/netflixclone/	Get hash	malicious	HTMLPhisher	Browse	54.229.239.201
	https://mvosovsky.wixsite.com/my-site-1	Get hash	malicious	Unknown	Browse	99.86.4.105
	https://chattts-49f1.beszyrecala.workers.dev/44251fe9-ad0f-4b4c-84e3-2d=	Get hash	malicious	Unknown	Browse	35.163.144.222
	https://chattts-49f1.beszyrecala.workers.dev/c334d550-f2d5-4302-b1a8-b3=	Get hash	malicious	Unknown	Browse	108.156.60.38
	https://chattts-49f1.beszyrecala.workers.dev/d710b28d-67f4-4fc6-8225-c3=	Get hash	malicious	Unknown	Browse	52.85.49.6
	https://help-add-metamask.gitbook.io/us	Get hash	malicious	Unknown	Browse	65.9.86.18
	https://dsfdgfhjkjkhjgfnmbvbjn.pages.dev/atttt	Get hash	malicious	HTMLPhisher	Browse	108.128.31.255
	https://auth-start-treizor.github.io/	Get hash	malicious	Unknown	Browse	18.244.20.40
	http://get-verified--badge.vercel.app/	Get hash	malicious	Unknown	Browse	76.76.21.22
AMAZON-AESUS	https://mvosovsky.wixsite.com/my-site-1	Get hash	malicious	Unknown	Browse	44.221.136.44
	https://chattts-49f1.beszyrecala.workers.dev/44251fe9-ad0f-4b4c-84e3-2d=	Get hash	malicious	Unknown	Browse	34.193.38.76
	https://chattts-49f1.beszyrecala.workers.dev/627c9347-142c-4ee6-9449-ca=	Get hash	malicious	Unknown	Browse	34.193.38.76
	https://chattts-49f1.beszyrecala.workers.dev/c334d550-f2d5-4302-b1a8-b3=	Get hash	malicious	Unknown	Browse	34.206.213.104
	https://chattts-49f1.beszyrecala.workers.dev/d710b28d-67f4-4fc6-8225-c3=	Get hash	malicious	Unknown	Browse	54.144.124.14
	https://help-add-metamask.gitbook.io/us	Get hash	malicious	Unknown	Browse	3.226.143.229
	https://bnpparibasfortis.centralapp.com/	Get hash	malicious	Unknown	Browse	3.209.9.89
	APA Paper. currrent.Sp 19_0.pdf	Get hash	malicious	Unknown	Browse	34.237.241.83
	https://www.kudoboard.com/boards/ZWwsi9jg	Get hash	malicious	Unknown	Browse	44.218.48.209

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	https://mvosovsky.wixsite.com/my-site-1	Get hash	malicious	Unknown	Browse	3.230.219.225 18.172.112.34
	https://chattts-49f1.beszyrecala.workers.dev/44251fe9-ad0f-4b4c-84e3-2d=	Get hash	malicious	Unknown	Browse	3.230.219.225 18.172.112.34
	https://help-add-metamask.gitbook.io/us	Get hash	malicious	Unknown	Browse	3.230.219.225 18.172.112.34
	http://get-verified--badge.vercel.app/	Get hash	malicious	Unknown	Browse	3.230.219.225 18.172.112.34
	http://telegra-m.fit/	Get hash	malicious	Telegram Phisher	Browse	3.230.219.225 18.172.112.34
	http://cctv.hotmail.cloudns.org/	Get hash	malicious	Unknown	Browse	3.230.219.225 18.172.112.34
	https://1108853.wcomhost.com/network/am/infospage.php/	Get hash	malicious	Unknown	Browse	3.230.219.225 18.172.112.34
	http://business.ismettaiidentitysconfirms.com/meta-community-standard100066651404869/	Get hash	malicious	Unknown	Browse	3.230.219.225 18.172.112.34
	https://kaslasa.ru/	Get hash	malicious	Unknown	Browse	3.230.219.225 18.172.112.34
a0e9f5d64349fb13191bc781f81f42e1	nISHvSo9E2.exe	Get hash	malicious	Unknown	Browse	18.173.206.112 35.162.225.150 18.172.112.34
	nISHvSo9E2.exe	Get hash	malicious	Unknown	Browse	18.173.206.112 35.162.225.150 18.172.112.34
	YuQu Loader.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	18.173.206.112 35.162.225.150 18.172.112.34
	Main.exe	Get hash	malicious	LummaC	Browse	18.173.206.112 35.162.225.150 18.172.112.34
	7XU2cRFInT.exe	Get hash	malicious	Remcos, DBatLoader	Browse	18.173.206.112 35.162.225.150 18.172.112.34
	Setup.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer	Browse	18.173.206.112 35.162.225.150 18.172.112.34
	SvpnLong2.exe	Get hash	malicious	Unknown	Browse	18.173.206.112 35.162.225.150 18.172.112.34
	SvpnLong2.exe	Get hash	malicious	Unknown	Browse	18.173.206.112 35.162.225.150 18.172.112.34
	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	18.173.206.112 35.162.225.150 18.172.112.34
37f463bf4616ecd445d4a1937da06e19	777.exe	Get hash	malicious	Stealc, Vidar	Browse	104.20.94.94 188.114.96.3
	AacAmbientLighting.exe	Get hash	malicious	Unknown	Browse	104.20.94.94 188.114.96.3
	SecuriteInfo.com.Trojan.Siggen19.37568.5083.12845.exe	Get hash	malicious	Unknown	Browse	104.20.94.94 188.114.96.3
	SecuriteInfo.com.Win32.TrojanX-gen.29632.18649.exe	Get hash	malicious	Unknown	Browse	104.20.94.94 188.114.96.3
	AacAmbientLighting.exe	Get hash	malicious	Unknown	Browse	104.20.94.94 188.114.96.3
	file.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	104.20.94.94 188.114.96.3
	d34e1p5zD2.exe	Get hash	malicious	Unknown	Browse	104.20.94.94 188.114.96.3
	Mu7iyblZk8.exe	Get hash	malicious	Unknown	Browse	104.20.94.94 188.114.96.3
	Ycj3d5NMhc.exe	Get hash	malicious	Unknown	Browse	104.20.94.94 188.114.96.3

Process:	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	447488
Entropy (8bit):	6.049704714571602
Encrypted:	false
SSDEEP:	12288:Pf2wvmWyF2kVbFNCK9FGFMSvmEzBIyDInI:19yFpbfcFBIyDInI
MD5:	E346FCECD037F0BE2777231949977587
SHA1:	50E571B3AEA31DB3DF2610A1CA4DFC94612A2CC4
SHA-256:	EFD8CF9A3BC2AB4E15FA33D42771E18D78539759CBF30652DF4C43E6825CE5F0
SHA-512:	FFC183626899D1AD1806786BC95C4809AAB3947C78FBFDB38A01D312F2F679DC7DC82F8389074CBCC470D055982CFC370D482FF4D0B3B91532CA409B1FCA32A9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....^W.........." ..0.............&.... ........... .......................@......y.....@.....................................O.......d.................... ....................................................... ............... ..H............text........ ...................... ..`.rsrc...d...........................@..@.reloc....... ......................@..B........................H.......d...`...............X.............................................(......(8..."..(9.....(...."..(....&...(....&...(....F...(.......s......{...."..}......{...."..}....V.(......(......(.......}".....(....}%.....}#.....}$.....0..E........{"......YE................+..{$...o.....X.{#...j(.....Xr...ps....z....0...........{"......YE........R...R....{$.....~!...o......!.r...po....&..o....&.r...po....&.o.....1....o....&..o....&*..[o....&..{#...o....&..]o....&

C:\Program Files (x86)\WeatherZero\WeatherZero.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2876688
Entropy (8bit):	7.928270982940127
Encrypted:	false
SSDEEP:	49152:g6+PPRw4iT/VLUBIGR6KmgG5sMU+Fojk7DcPfKZOHUULruOdHqDOAfCFkw:6nq44Az8gB22jkXufKs0ULruMHcOAfCp
MD5:	7DC1C6AB3BF2DD1C825914F7F6F31B45
SHA1:	50DA5DF89A759DD1D6F123B98B8AA35298699B3B
SHA-256:	9B92A8F962D7F8FFC9A06BAFECAFF854D88999107641229B17B68D5532E6E17C
SHA-512:	695FFAC94223F5419229D84C5E46BACA22C9AC5C57E27B87CDE347A80F343926A529F9EA008390053F7306E8140D421FCBE7789D636B2E489C089F0CB7B7F752
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Program Files (x86)\WeatherZero\WeatherZero.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....b..............0..D)..F......6c).. ....)...@.. ........................,.....c.,...@..................................b).O.....).\|C............+..Y....+......a).............................................. ............... ..H............text...<C).. ...D)................. ..`.rsrc...\|C....)..D...F).............@..@.reloc........+.......+.............@..B.................c).....H.......d_..H.......r........O(...........................................(.....~....-.r...p.....(....o....s.........~.....~............~......(....Vs....( ...t..........0..5........s!...}.....(......}.....s"...}.....{....(#...o$...(%...o&.....('......{...........s(...o)....{...........s(...o....{.....o+....{...........s,...o-...rE..ps.............s,...o/....{....o0....o1...&rO..ps.............s,...o/....{....o0....o1...&.{.....{....o2....{...........s,...o3....{.....

C:\Program Files (x86)\WeatherZero\WeatherZero.exe.config

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.747046586710027
Encrypted:	false
SSDEEP:	6:TMVBd1IGMfVKNS7VNQAofS7V2bofJuAW4QIm:TMHdGGsVOAzofLSJ93xm
MD5:	3F15E291A768459274F9B10338692974
SHA1:	F1BFC8F7525487B18E05B99C40249C7873C75E4F
SHA-256:	4C246E60C38399126CA36408BDA7E63BF43B9ECB18F9DAA6E224D36633DC0B69
SHA-512:	0CDA1129BD34EB72E4927782C3D9BDF3BE7B5E2FE92279E73DE068FC7E4BF4035323AEBB9578CDE8F7630248B47CC67A5EF64AF7B144621CAB10E86010BCF85B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <startup>.. <supportedRuntime version="v2.0.50727"/>.. <supportedRuntime version="v4.0"/>.. </startup>..</configuration>..

C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3385616
Entropy (8bit):	7.769464020201907
Encrypted:	false
SSDEEP:	98304:EuOjRHrd1zBPC474Iz8pEeVJmUXyevkUL38/cSUJ9yElx7W91a8G8C:91VzF38/LUJ9yE37KGH
MD5:	2B149BA4C21C66D34F19214D5A8D3067
SHA1:	8E02148B86E4B0999E090667EF9B926A19B5CA7D
SHA-256:	95F0E021C978DDD88E2218A7467579255A5AE9552AF2508C4243A4ADEC52D2B8
SHA-512:	C626F89BC01FDB659F4EE2CF86BA978F04E4BF0DEC2624170C83C21D5AD29E20335566B1F7545D9BADC4E47CA2EA90535C4CB08B4AFA3457B72A5801053706D8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........................^..........................................u...T.....T.D....,...T.....Rich..........................PE..L.....b.................&...4)..............@....@...........................3.......4...@...........................................2.0............P3..Y...`3.X,......8...........................@...@............@..(............................text....$.......&.................. ..`.rdata.......@.......*..............@..@.data....d'..0...X'.................@....rsrc...0.....2......h2.............@..@.reloc..X,...`3......"3.............@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WeatherZero\uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	320035
Entropy (8bit):	7.891495118554517
Encrypted:	false
SSDEEP:	6144:V1ssjvm3L1cBg+0FaZLqKxIyCMVr8ozzirUi:gsoL1c++0FCGKTCkpm
MD5:	44C6F7F2084D37AAD08C078A43F2E7BC
SHA1:	FBD6EB7B7BCADD6257CCB30FDC5344B895AFB5BA
SHA-256:	010D36593138E29B90EE5D344BA720369B9D21C20FDBDA93FC5A6C2AA1E46FA3
SHA-512:	A8806E66405B9AE160CB2F41332506659FAE3594CE6906B6B53153F4BC884A4ADA99532828F075E68C0886F9C4AF2A99879B7C4BDA8FC6CBC8FA519DE253B741
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG.sw..PG..VA..PG.Rich.PG.........PE..L...<.Oa.................f...\|.......3............@.......................... ........`...@.................................D...........HD...........2_..Y...........................................................................................text....e.......f.................. ..`.rdata...............j..............@..@.data...8U...........~..............@....ndata...................................rsrc...HD.......F..................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WeatherZero\wz.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe
File Type:	MS Windows icon resource - 11 icons, 32x32, 16 colors, 4 bits/pixel, 16x16, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	146222
Entropy (8bit):	6.2734588250494
Encrypted:	false
SSDEEP:	3072:I0GLQ/1t912mCTFpbEoAu6QRG38ulhJ/eSk91MjXYqMFgK1s2BylAvKirweQpeUB:IFE5Nli9Ux2K
MD5:	D1DE53F6C0818C7137207D5B6A95158F
SHA1:	64FEFD3B51375198E52D932E193AB3BC0790A60D
SHA-256:	6F8107DB61996754E700964B2716E055914D2ADF475BE8FDA12234B5B98DC4E4
SHA-512:	2F4A2E586A133173540768081A4CA681001CBF5E37B5F55140CF26F919898F0B4D2F83366B38E81E14DEAE6084A32F2E08B7165F7908D272358730B1B681EDD4
Malicious:	false
Preview:	...... ......................(.......00.............. ..........n...........h............. .(...~!..``.... ......)..@@.... .(B..N...00.... ..%..v... .... ......&........ .h....6..(... ...@.................................................................................................ssssssssssss...s...........17..0.............0...............8s...............0..............7q...............1..............7p...............1...............p...............1.w....w@.......0H.......wwwv.w.0wggvwvw.gww.ww.pxww.wwwwxww.xw.1(.......wRwwwr.p.x.............0.......q1......q.....wws0......0.....{{........q....s...70.....0....1..........q....s[.s.......0......07.......q......p........0...............q...............1..............#...............8...............p..............7....3ss77777777..................................................................................................................................(....... .................................................................

C:\Program Files\Cheat Engine 7.5\CSCompiler.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33688
Entropy (8bit):	7.20956664617613
Encrypted:	false
SSDEEP:	768:zVYdpNkp9TvDXy2XmVEV3GPkjVvDXy2ulqwVEV3GPkjL:zVY1+nCDOEECDbOEw
MD5:	4ACE42D6530AF699FEB2372F805A6A40
SHA1:	FB8C7352808F104E851468F25D0DD14A25B8CFCA
SHA-256:	13DCE393B59B9EF4A5D4FCDC27267D018B350BDC44A62AACC5DBC7F1DF7F7A1C
SHA-512:	8BB770F304CD8BA23FB2A64370D74AC3FDC134235FF39802983B9BABDE12AB00E49A746F3C2113520F0E135CDFD1473C0B4B64272279D13E576912126AA556D2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0............."3... ...@....... ....................................`..................................2..O....@...................g...`...... 2..8............................................ ............... ..H............text...(.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................3......H........"..............................................................R..{....o.....o....&&...}......0............r...p(......,.....r...po.......8.....{.....o......{....r...p(........,..{.....{....o.....r;..p(.......{..........%...o......o....o...........,e....+F....o......o....o........(....rI..p.o......o....o....(....o........X.....o....o..........-...+....+....(.......s ...}.....{.....o!.....{.....o".....0............\|....(#.....,..\|....($....*....0..............(%..

C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	399264
Entropy (8bit):	6.025523802176381
Encrypted:	false
SSDEEP:	12288:G0N02KsbnIU70vYrRHAjC0Y0glwgugEnoSE5jq:U2tIUYArRv0Y0glwgugEnoSE5jq
MD5:	F921416197C2AE407D53BA5712C3930A
SHA1:	6A7DAA7372E93C48758B9752C8A5A673B525632B
SHA-256:	E31B233DDF070798CC0381CC6285F6F79EA0C17B99737F7547618DCFD36CDC0E
SHA-512:	0139EFB76C2107D0497BE9910836D7C19329E4399AA8D46BBE17AE63D56AB73004C51B650CE38D79681C22C2D1B77078A7D7185431882BAF3E7BEF473AC95DCE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.......................P....)...-................@.......................... ..................................................d........................k..................................P.......................0................................text...P........................... ..`.data....).......*..................@....rdata.............................@..@.bss.....-...............................CRT................................@....idata..............................@....rsrc...............................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\CheatEngine.chm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	306758
Entropy (8bit):	7.936079952495831
Encrypted:	false
SSDEEP:	6144:/UuFqUYSsTDiKebI7F03RPf2rB84daXcXrcURJo8tGgqQdB5+cbsQe/zQXE9LA2:tFhYSsnl0I7FG8S4daC/RGg1bnerQILf
MD5:	BB80FEC3B6E843B61859914480706CD9
SHA1:	0CED874BEE5BDA6059B5195911AA117693D9D2DE
SHA-256:	2D52F9D59211F8906ACE16525721B1400343BDF720F062CF111D84089F129009
SHA-512:	78D8A024DABD111B59BEEA4DC21150C7FBB3A6924201D2F3FF9E720E4BBC967BBFF285BA2064BC35C260FFDE433C639FDC0252C47AE29B43398117EDA21CF648
Malicious:	false
Preview:	ITSF....`........2.........\|.{.......".....\|.{......."..`...............x.......T0.......0..............F...............ITSP....T...........................................j..].!......."..T...............PMGLS................/..../#IDXHDR..t.../#ITBITS..../#IVB...B.,./#STRINGS...O.r./#SYSTEM..v.6./#TOPICS...t.../#URLSTR...t.[./#URLTBL...t.../#WINDOWS...2.../$FIftiMain...<..8./$OBJINST...}.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property...y../$WWKeywordLinks/..../$WWKeywordLinks/BTree..z.L./$WWKeywordLinks/Data...F.../$WWKeywordLinks/Map...G../$WWKeywordLinks/Property...Y ./0-ptaddresslist.html...8.S./1-ptmemoryview.html......./2-ptondebugevent.html...".../3-ptprocesswatcherevent.html...;.i$/3Dpinballforwindowspointercode.html.....s /4-ptfunctionpointerschange.html...$.2./5-ptmainmenu.html...V.]./aa_addextracommand.html...v.../aa_removeextracommand.html......./About.html...q."./Aboutb1.JPG...*.i./AboutCheatEngine.html.....U./Aboutthedebugger.html.....V./address.html...9.../Ad

C:\Program Files\Cheat Engine 7.5\DotNetDataCollector32.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	183200
Entropy (8bit):	6.842191242335636
Encrypted:	false
SSDEEP:	3072:KAm/u5ImKJacvUOQC2mCDiGuTEG2BiERGNcCYOqtwyROYeoHVP0bkHnP0z:Niu5MJa9hZun2BiERaEwyOM2Qsz
MD5:	F1C9C9A8B035DA9385D88CA34CD49305
SHA1:	77E48F73C224949EC8BD8A32087609B7BF217E94
SHA-256:	4168D6408994A297665AEEA68ABB6C062D58EA00851751959557E7F8A8BAC17D
SHA-512:	D7BD2FC8592E18CA46CDF1DC74496CF3CB5EF991F4BD9E141DEEABA0F665E731A5953CAAF1CD39859817EB6D0C1B77700FE08EEED15320757B3FA36D798C4C7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......cK..'..'..'....[.-....Y....uB.....uB..6..uB..5....X.=....a.,..'..V...C..!...CU.&...C..&..Rich'..................PE..L....(.c............................$U............@.................................(D....@..................................F..x....p...............`...k......d....7..p............................7..@............................................text............................... ..`.rdata..^...........................@..@.data........P.......@..............@....rsrc........p.......J..............@..@.reloc..d............L..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\DotNetDataCollector64.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	210336
Entropy (8bit):	6.575377720318411
Encrypted:	false
SSDEEP:	3072:vWMJUr2f2Im9kj/FqgmHpJ1/YCVuIB9Vxv7bn1UC9gfkCeEWHFP0jHzP0Q:vWc02f2R6FqgoJ1boIPRUsfGjQQ
MD5:	A2C0B5D0D9E5C2A2C774E8B587850447
SHA1:	C8AA4CB01676D57B34AAB22C7FD018B63DFF6892
SHA-256:	F0F3D0FAD632D9DDAC8FF0B4EAEC20094FA0F9ABDDF784954DFBB0723A997F21
SHA-512:	85F4AEB562424ABF0E2BC5EDE0CDF0052FBB15E7DF70F691C11B06171A8A45A6672C2C688CD5B6FFEBEE16C36FDAC7978E39CA04F8C29F75D588D2ACA3599395
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@..........rZ.....rX.:..................rY....f.`..........(......(.T....(......Rich...........PE..d....(.c..........".................<X.........@....................................^.....`.................................................L...x........................k..............p...............................................(............................text............................... ..`.rdata..............................@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	242616
Entropy (8bit):	6.432754517349666
Encrypted:	false
SSDEEP:	3072:Bj9mOBuELLZXBJPCR6ygny56rs+iO2AwCNCtALb44TPk3Ap1rleY/DptNH/P0uHV:fn7LhBJ9W56A+iOlfN/LbZnbptN0uZH
MD5:	9AF96706762298CF72DF2A74213494C9
SHA1:	4B5FD2F168380919524ECCE77AA1BE330FDEF57A
SHA-256:	65FA2CCB3AC5400DD92DDA5F640445A6E195DA7C827107260F67624D3EB95E7D
SHA-512:	29A0619093C4C0ECF602C861EC819EF16550C0607DF93067EAEF4259A84FD7D40EB88CD5548C0B3B265F3CE5237B585F508FDD543FA281737BE17C0551163BD4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........H..................$...t.................@.............................................................................d....................H...k..................................P.......................4................................text............................... ..`.data...$...........................@....rdata..............................@..@.bss....t....P...........................CRT.................,..............@....idata..............................@....rsrc................:..............@.../4......$............F..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\Tutorial-i386.cepack (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	data
Category:	dropped
Size (bytes):	1112834
Entropy (8bit):	7.995534990823338
Encrypted:	true
SSDEEP:	24576:H1XCCswrgMlbH4v3Cj6N3yHORtmV7VJPX/uPQDNDcpLwBlxaZm5g5Gvh6at0:ACRlbHhj6N3vR4Vt/uSN2L6LaZAgcvHC
MD5:	38B22DEDFBCAFE1376ACEB7A0722FB8F
SHA1:	6C96AA4E7C71C82A82951443BA6DAE9019601E55
SHA-256:	F092D81531B8603A52F70245D041E2C43B020280BD9F358172330FF405E451CD
SHA-512:	135EF19161572A57AE1BC618C6CC7FDE889BD1A5C88E6125080C3712E7F0AE96F2A9B7728765C1B115F91CE48200CA47CA0C43E31625CBD11DFFA181610F03CA
Malicious:	false
Preview:	CEPACK..&..}\|T.7~Nf.L...@..".2(..Di....M#.....(meJ.(7...'..'.f.0.k..V.....k...QQf...HqB(N.b@jO.T..&C.2...93.....y>...=s.w.....k...R..zN.q...H..8._....U.3i.[...i.........5{K.3.-.....\|...g.{cv..t....^..U..yb..'...4JD.[...I...t.x]f...c.y#8.....U..;I.....ro....M..Qo..?&.....g......\|.?.^w#......%@OV.wO....r.x..7.#.PFJP...B...9n.O\|..-.F>.w....1...[.....^6..q......p..~{.V..<-Xp.z..z....m..........=5......n.......}..).....x...........,.m...0......1.....>..^._d...~...<.........b=...62...L.g1x6...lf.B./fp...0x)..1.....\.....a.j..c.z.o`..........v..`p9...\..Z..dp=.w1.E..a.^..c.~..`p...2......a....3...>..b...g......V.... ....bp...Q..3..`#.M..dp..g38..f./d.b..2x...2x.........^.....f.z.o`..........v..`p9...\..Z..dp=.w1.E..e.>..g...70. ...\|.....ap;.;..c.)...\|......`.....2x..!.....c.7...62...L.g1x6...lf.B./fp...0x)..1.....\.....a.j..c.z.o`..........v..`p9...\..Z..dp=.w1.E..a.^..c.~..`p...2......a....3...>..b...g......V.... ....bp...q..3..`#.M..dp..g38..f./d.b..2x...2x...

C:\Program Files\Cheat Engine 7.5\Tutorial-x86_64.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3403192
Entropy (8bit):	6.035185815441339
Encrypted:	false
SSDEEP:	49152:ar2V9BrWblVbqS1+Cxz0MB95D//ocnaMo6WuDgRPZO/Y12y6Pu:aqV9BqzbqSR009StqG
MD5:	1C1630B241D5A6BE07BFBA2B3EA97A25
SHA1:	7203255D1A6021874D41A48FCD5719FD7034F34C
SHA-256:	526CDDD0D843F5984AC6CB98D28F22B090682C3A8704122B644EC8AE2C9A10E5
SHA-512:	BDDEDB575FEBF8C8103CFBB1981FD1D5F20D2E0F1D6F4252A98930D587420A69750DDC1BE46932CDF979B8633054321F462557D88349459E111BE43139BEFF4A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........3......./..... z..tN...j..0,.......................................@4.......4.......................................................2.......2..3... 0.......3..k..................................p...(.....................2..............................text... z.......\|.................. ..`.data...tN.......P..................@....rdata...7....!..8....!.............@..@.pdata....... 0.......0.............@..@.bss.....j...02..........................CRT..........2.......2.............@....idata...;....2..<....2.............@....rsrc....3....2..4...L2.............@.../4...........04.......3.............@..B........................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\allochook-i386.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	336600
Entropy (8bit):	6.344264969706984
Encrypted:	false
SSDEEP:	3072:6LYEDJlXw5pAnHp2ukwTX6N8B4A84zMtEl1knxgaPZ3nbanlYZn2l1S2CAYOpIOs:6LYEDJAAnHp2uk2KNO0tEQV+b3n6
MD5:	19D52868C3E0B609DBEB68EF81F381A9
SHA1:	CE365BD4CF627A3849D7277BAFBF2F5F56F496DC
SHA-256:	B96469B310BA59D1DB320A337B3A8104DB232A4344A47A8E5AE72F16CC7B1FF4
SHA-512:	5FBD53D761695DE1DD6F0AFD0964B33863764C89692345CAB013C0B1B6332C24DCF766028F305CC87D864D17229D7A52BF19A299CA136A799053C368F21C8926
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!...G.3..D....G...C.......P.......................................E...............................P.......@..P...................@....g...`...$...................................................A..t............................text....3.......4.................. ..`.data...D....P.......8..............@....rdata...a...p...b...L..............@..@.bss.....G...............................CRT.........0......................@....idata..y....@......................@....edata.......P......................@..@.reloc...$...`...&..................@..B.stab... ...........................@..B.stabstr............................@..B................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\allochook-x86_64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	479536
Entropy (8bit):	5.994666279988566
Encrypted:	false
SSDEEP:	6144:Tch6UtcJYg8yRAkB+vsoqOvfkv+y3ilZkaCeMG:e6Utc6gdcfkv+KIR
MD5:	DAA81711AD1F1B1F8D96DC926D502484
SHA1:	7130B241E23BEDE2B1F812D95FDB4ED5EECADBFD
SHA-256:	8422BE70E0EC59C962B35ACF8AD80671BCC8330C9256E6E1EC5C07691388CD66
SHA-512:	9EAA8E04AD7359A30D5E2F9256F94C1643D4C3F3C0DFF24D6CD9E31A6F88CB3B470DD98F01F8B0F57BB947ADC3D45C35749ED4877C7CBBBCC181145F0C361065
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................& ...G.......XJ..P................................................................................................`.......P..P...............t1.......g...p..(...................................................`S...............................text.............................. ..`.data...............................@....rdata..............................@..@.pdata..t1.......2..................@..@.bss....XJ...............................CRT.........@......................@....idata.......P......................@....edata.......`......................@..@.reloc..(....p......................@..B/4..................................@..B/16.................................@..B/30.................................@..B/42.....@...........................@..B........................................................................................

C:\Program Files\Cheat Engine 7.5\autorun\DotNetInject.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8088
Entropy (8bit):	5.172167677485522
Encrypted:	false
SSDEEP:	192:zuiTTPEYya1gq5jfFEYQhRIA03xB97cq1fvhEN:ztTzyapKRiG
MD5:	B5AE011C70C1D26CC31A5D818D60E53C
SHA1:	7BE6AD86FCC9208D6F21B9F1D464B6334E64922B
SHA-256:	31ED4209776DBFAD74EC811326439D26C02B6AB653056D5E171D952C12D3F25B
SHA-512:	440B1AFC72D671D8AA663B6672371AC365029525EE055CF380A9C9C84625FD5FA2B328110633A183F87CECF8D1D2CACB62E49A7EB382B30AAA75DA5B3D2F3054
Malicious:	false
Preview:	--[[..You have a d:\bla.dll with namespace ClassLibraryX, with a class named "MyClass"..That class contains a function defined as:..public static int MyInitFunctionName(string parameters)....then you do: injectDotNetDLL('d:\\bla.dll','ClassLibraryX.MyClass','MyInitFunctionName','Something')....--]]....local DotNetCoreInjectScript=[[..[enable]..alloc(injectdotnetdll, 2048)..alloc(IID_ICLRRuntimeHost4,16)..alloc(RuntimeHost,8)....alloc(paramstr,256)..alloc(methodname,256)..alloc(classname,256)..alloc(dllpath,512)....alloc(returnvalue,4)..alloc(errorvalue,4)..label(error)....dllpath:..dw '%s',0....classname:..dw '%s',0....methodname:..dw '%s',0....paramstr:..dw '%s',0......IID_ICLRRuntimeHost4:..db 66 d3 f6 64 c2 d7 1f 4f b4 b2 e8 16 0c ac 43 af....injectdotnetdll:..[64-bit]..sub rsp,6*8+8..mov rcx,IID_ICLRRuntimeHost4..mov rdx,RuntimeHost..[/64-bit]....[32-bit]..push RuntimeHost..push IID_ICLRRuntimeHost4..[/32-bit]....call GetCLRRuntimeHost..cmp eax,0..jne error....[64-bit]..mov rcx,[Ru

C:\Program Files\Cheat Engine 7.5\autorun\DotNetInterface.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20837
Entropy (8bit):	4.996731854830045
Encrypted:	false
SSDEEP:	192:Rmi4uQRgQgAgm2+CXgSKgKghmg60gGg4tgKplg/Dhrf+1e5l7jTRgzKgIgmoJMQZ:y3KQBHvSo9a452TZ0YgkP
MD5:	04CDE30D6AA9999A846B5FC3CFC1F56C
SHA1:	2187AB73161EE8A516D25F8295BB4C7E3DA2F7E3
SHA-256:	EAE2A91808BB58B386F3BDDE75176C7208C22BF5515C5D6E467C583DF2E72E15
SHA-512:	FB2F27F3981E587DDD379D54999067092DC2FBE2F243E4A49B2F9D4DA172907D169BC708AA0840631C951FB01CCB9E69A403EB2E19A5F1AFF1BE3FF0EEC27C62
Malicious:	false
Preview:	..--same as monodatacollector but for .net and .netcore..--can theoretically be used on mono as well....if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'dotnetforceddatacollector.po')..end......local pathsep..local libfolder....if getOperatingSystem()==0 then.. pathsep=[[\]].. libfolder='dlls'..else.. pathsep='/'.. libfolder='dylibs'..end....dotnet_timeout=3000....DOTNETCMD_TEST=0..DOTNETCMD_INITMODULELIST=1..DOTNETCMD_GETMETHODENTRYPOINT=2..DOTNETCMD_GETFIELDTYPENAME=3..DOTNETCMD_GETFIELDVALUE=4..DOTNETCMD_SETFIELDVALUE=5..DOTNETCMD_LOADMODULE=6..DOTNETCMD_GETMETHODPARAMETERS=7..DOTNETCMD_WRAPOBJECT=8..DOTNETCMD_UNWRAPOBJECT=9..DOTNETCMD_INVOKEMETHOD=10....DOTNETCMD_FIND_MODULEID_WITH_CLASSLIST=11......DOTNETCMD_EXIT=255......dotnetmodulelist={}....function dotnet_findDotNetMethodAddress(namespace, classname, methodname, modulename).. --print(string.format("dotnet_findDotNetMethodAddress('%s','%s','%s','%s')",namespace,classname, methodname, modulenam

C:\Program Files\Cheat Engine 7.5\autorun\addtonewgroup.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2018
Entropy (8bit):	4.845505891620365
Encrypted:	false
SSDEEP:	24:8LRZCSs+dJPHoSLI0zAXFqfzhPR3sAuH7vMTCRTnoH7ADR09ZWgsAU1HTfHU1EP:IRZ7umKgl5s2+cZPs81u
MD5:	3E20F1013FB48A67FE59BEDE7B8E341B
SHA1:	8C8A4CB49C3B29DB2C47F84AAFD0416101722BFE
SHA-256:	96E4429192F9AB26F8BF9F9429F36B388AA69C3624781C61EA6DF7E1BCA9B49B
SHA-512:	99CF3F88C8B06DA0DBE8085DEE796BEC7A9533990A55FBCE7524A4F941B5ECF0E8EC975A4B032EB2AAABD116C0804995A75036C98A5E4058F25D78D08A11F3F2
Malicious:	false
Preview:	local pm=AddressList.PopupMenu..local pmAddToNewGroup=createMenuItem(pm)..pmAddToNewGroup.Caption=translate('Add to new group')..pmAddToNewGroup.ImageIndex=MainForm.CreateGroup.ImageIndex..pm.Items.insert(MainForm.CreateGroup.MenuIndex, pmAddToNewGroup)....local oldOnPopup=AddressList.PopupMenu.OnPopup..AddressList.PopupMenu.OnPopup=function(s).. if oldOnPopup then.. oldOnPopup(s).. end.. pmAddToNewGroup.Visible=AddressList.SelCount>=1..end....pmAddToNewGroup.OnClick=function(s).. local i.. local count=0.. local selcount=0.. local withAddress=false.. local hasAddressSupport=false.... if AddressList.SelCount==0 then.. messageDialog('Please select at least one entry first', mtError, mbOK).. return.. end.... hasAddressSupport=AddressList[0].IsAddressGroupHeader~=nil.... for i=0,AddressList.Count-1 do.. if AddressList[i].IsGroupHeader then.. count=count+1.. end.. end...... local groupname=translate(string.format('Group %d',count+1)).. if (isKeyPressed(VK_

C:\Program Files\Cheat Engine 7.5\autorun\alternateSpeedhack.LUA (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7632
Entropy (8bit):	4.883983761190223
Encrypted:	false
SSDEEP:	192:peDFQNTce2Qt5q/sn2Wdk7RlxJKTiZjYsfUv:p3ue2F7RlxJfYP
MD5:	459B793E0DC43A993F03D8B612F67CEC
SHA1:	F14AE9AFBE97AF534A11BF98AC1CC096269F1474
SHA-256:	E2CBB4C2F46305BB07D84222231012FD4C800FE8E1B43E0AA1AF9B6C5D111F7F
SHA-512:	1740068E3419D153ECBD9D1A6AADA20AABE71915E7422DCE1A83E616E8D2A1084922A81741591A682531E1F8146E437D8688521C7707A4909E5721768A3F956E
Malicious:	false
Preview:	--Copyright Cheat Engine......local function getOriginalCodeAndFiller(address).. local original,filler.... if type(address)~='number' then.. address=getAddressSafe(address).. end.... if address==nil then.. return nil, 'invalid address'.. end.... local sl=createStringList().. local d=createDisassembler().. local size=0.. while size<5 do.. d.disassemble(address).. local ldd=d.LastDisassembleData.. local inst=ldd.opcode..' '..ldd.parameters.. sl.add(inst).. size=size+#ldd.bytes.. address=address+#ldd.bytes.. end.... original=sl.Text.. if size-5>0 then.. filler=string.format("nop %x", size-5).. else.. filler=''.. end.... sl.destroy().. d.destroy().. return original,filler..end......local function hookSpeedFunctions().. if speedhack and speedhack.processid==getOpenedProcessID() then .. return true.. end.... local result, data=autoAssemble([[.. alloc(speedhack_wantedspeed,4).. registersymbol(speedhack_wantedspeed).. speedhack_w

C:\Program Files\Cheat Engine 7.5\autorun\autosave.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9243
Entropy (8bit):	4.766574177681985
Encrypted:	false
SSDEEP:	192:C64/8dXYKgLNhpwHmFUazyI+Q4Om1q/Qt:t4nHUKUa0Out
MD5:	40D6BFE593194CF938E19622A3C13A5E
SHA1:	761257E8EF492431CF0E04DBCA396FABB25FE1AE
SHA-256:	C4CEF60489B067C8E7ABCDD5594643A27D0720B21523753DD462D53024287116
SHA-512:	1D1AAA9DE74B0BB08CC4CECED5DBFA4C589347EAC098D7AE013D5A1BEAAE0EEACA4D314E2591560C6DF14A93DD4E9316CA317D21EFADCCA57D11EEE72F4C6E16
Malicious:	false
Preview:	if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'autosave.po')..end....require("lfs")....autosave={} --todo make local....local AutoSaveSettings=getSettings('Auto Save')..local AutoSaveVersion=1....autosave.getPath=function().. local path=AutoSaveSettings['SavePath'].. if (path==nil) or (path=='') then.. .. path=os.getenv("LOCALAPPDATA").. if (path==nil) or (path=='') then.. path=getCheatEngineDir() --last attempt .. end.. end.. .. if string.sub(path,#path)~='\\' then.. path=path..'\\'.. end.. .. return path..end....function autosave.saveState().... .. local pid=AutoSaveSettings['ProcessID'].. if pid and pid~='' then.. pid=tonumber(pid).. if pid~=getCheatEngineProcessID() then.. --another CE has done an autosave.. if getProcessList()[pid]==nil then.. --it doesn't exist anymore... messageDialog(translate('Another instance of Cheat Engine has crashed and it created an autosave. Autosave disabled until y

C:\Program Files\Cheat Engine 7.5\autorun\bigendian.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7917
Entropy (8bit):	5.014591940837417
Encrypted:	false
SSDEEP:	192:sQJpltyKlR4ZtoOQ9pttWKlR4vtGTQPpMlyFuVCQc6c0RhBmg:stKY59KYQ5JhUg
MD5:	E76FCD2ECD5B956D4579A676AA3EEA01
SHA1:	49ECBA5CCC531A40AD7805A126D38B44B4A36576
SHA-256:	0339BA0043AF5C058CF3A19DE9F90312D18F6BB2728F454EF403B531BD57AE42
SHA-512:	8443C213D4A626A358631F76A0CC4C106543CE58C94D34A96B88574B3E32AE742F28878B259A17823CA07EC521B06E32E572E7BC77E10951BC0984B07C0571C6
Malicious:	false
Preview:	local scripts={}....local function registerBigEndianInt16()..scripts['2 Byte Big Endian'].type=registerCustomTypeAutoAssembler([[..alloc(TypeName,256)..alloc(ByteSize,4)..alloc(ConvertRoutine,1024)..alloc(ConvertBackRoutine,1024)....TypeName:..db '2 Byte Big Endian',0....ByteSize:..dd 2....//The convert routine should hold a routine that converts the data to an integer (in eax)..//function declared as: stdcall int ConvertRoutine(unsigned char *input);..//Note: Keep in mind that this routine can be called by multiple threads at the same time...ConvertRoutine:..//jmp dllname.functionname..[64-bit]..//or manual:..//parameters: (64-bit)..//rcx=address of input..xor eax,eax..mov ax,[rcx] //eax now contains the bytes 'input' pointed to..xchg ah,al //convert to big endian....ret..[/64-bit]....[32-bit]..//jmp dllname.functionname..//or manual:..//parameters: (32-bit)..push ebp..mov ebp,esp..//[ebp+8]=input..//example:..mov eax,[ebp+8] //place the address that contains the bytes into eax..mov a

C:\Program Files\Cheat Engine 7.5\autorun\ceshare.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14247
Entropy (8bit):	4.757455540825877
Encrypted:	false
SSDEEP:	192:p1mEfPL5ThWRM8vLdyWR1hHS+6stplX7ZbaFYBY6tnGb:VfPjylLNkKW6tE
MD5:	26C0E56ABEBFB550A9D208D6191816E0
SHA1:	8F2392846633AC48A0168AFE9F20AFC124699F4C
SHA-256:	A825F660DF2E6C13DBECE0A0F8DC306129BD784F8DC4EFC37E67E9CDD00CE65F
SHA-512:	4FC8A18E2F24374953694CB9230D9DDBA7A1B69B3BA5574AE143CB79B8D0F7CD94E9DD7337EC58EA40769A4B552A583C466781AC7EFF50C9199EAB39AD2076A9
Malicious:	false
Preview:	if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'CeShare.po')..end....ceshare={}....function ceshare.getInternet().. if ceshare.internet==nil then.. ceshare.internet=getInternet('ceshare').. end.. return ceshare.internet..end....local pathsep..if getOperatingSystem()==0 then.. pathsep=[[\]]..else.. pathsep=[[/]]..end....ceshare.version=-1..ceshare.path=getAutoRunPath()..'ceshare'..pathsep..ceshare.formpath=ceshare.path..pathsep..'forms'..pathsep..ceshare.imagepath=ceshare.path..pathsep..'images'..pathsep....if package.loaded.xmlSimple==nil then.. package.path=package.path..';'..getAutoRunPath()..'xml'..pathsep..'?.lua'..else.. package.loaded.xmlSimple=nil..end..ceshare.xmlParser = require("xmlSimple").newParser()......package.path=package.path..';'..ceshare.path..[[?.lua]]....function loadCEShare().. ceshare.settings=getSettings('ceshare').. ceshare.secondaryIdentifierCode=getSettings('ceshare\\secondaryIdentifierCode').... require("ceshare_account

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\ceshare_account.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6583
Entropy (8bit):	4.856845566130843
Encrypted:	false
SSDEEP:	192:2m3dOvyXANbHC7jmHmQr2LHymHG21h5rSTW/S4XHhOLOxInDLnrTH2n8ruHqhV4Z:2m3UvyW9mL/N5XYFCoKmo
MD5:	0B5180BD64689788EBEAA8E705A264AC
SHA1:	43A5CC401EE6C4FF4A94697112B1BC1D4345FC19
SHA-256:	8FD38A5E6C0408CA77E0E7A0EE179B4391758EC6DA94EA289E3A2CBC1AB1EC59
SHA-512:	CC26E2E36B93BF89AA16C744B2DB60D855DE616DB7A67F4FB24135545104459338C3EDEAB42BB316B1ECB0DB9E31970B1415A1BF638EA3E53AE31471330AEADB
Malicious:	false
Preview:	..function ceshare.login(username,password).. local i=ceshare.getInternet().. local parameters='';.. if username then.. parameters=parameters..'username='..ceshare.url_encode(username).. end .. .. if password then.. parameters=parameters..'&password='..ceshare.url_encode(password).. end.. .. local r=i.postURL(ceshare.base..'login.php',parameters).. if r then.. if (r:sub(1,2)=='<?') then.. local s=ceshare.xmlParser:ParseXmlText(r).. if s then.. if s.Valid then.. ceshare.LoggedIn=true.. return true .. else.. if s.error then.. ceshare.showError(s.error:value()).. end.. end.. else.. ceshare.showError(r).. end.. else.. ceshare.showError(r);.. end.. else.. ceshare.showError('Login system failure').. end..end....function ceshare.logout().. local i=ceshare.getInternet().. local parameters='';.. i.postURL(ceshare.base..'logout.php',parameters).. ceshare.Lo

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\ceshare_comments.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4018
Entropy (8bit):	4.735117902416751
Encrypted:	false
SSDEEP:	48:5ASgbBrZUxqShyY92Tm1E+J7YYI0+9+DKeRA453wxQRBhqvr5OOeCYBhSj:5ARB2hhPE+WY9+AzE5XsBhSj
MD5:	0D4D1B597712015EF1B0EC8ADC26495F
SHA1:	3584779C06619F545B47A27703AA2F47455D50DE
SHA-256:	89C8FCCC16D2AA0A3004DC1B477A5C1DCBBA539769B2A4558F7C7D9B9809B133
SHA-512:	AE26BBB2C3F74C143A01EC3B296A26699C679D51BC68C8C7B8C460616D1A0AA065500EBCA83E972A720BD7A3C5A7B63A673EAECEF1391A2E717208EF8DA0796F
Malicious:	false
Preview:	function ceshare.QueryTableComments(entry, startindex).. local result=nil.. local parameters='id='..entry.ID.. if startindex then.. parameters=parameters..'startindex='..startindex.. end.. local s=ceshare.QueryXURL('QueryTableComments.php', parameters).. if s then.. if s.Comments then.. result={}.. .. for i=1, s.Comments:numChildren() do.. local comment=s.Comments:children()[i].. local entry={}.. entry.ID=tonumber(comment["@ID"]).. entry.Username=comment["@username"].. entry.Message=comment["@message"].. entry.Time=comment["@time"].. table.insert(result, entry).. end .. end.. end .. return result..end......function ceshare.createCommentPanel(comment).. local panel=createPanel(ceshare.CommentsFrm.MessageBox).. panel.Align='alTop' .. panel.Tag=comment.ID .. .. local pnlMessage=createPanel(panel).. pnlMessage.align='alClient'.. .. local lblUsername=createLabel(pnlMessage).. lblUsername.

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\ceshare_fulltablelist.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12865
Entropy (8bit):	4.882563186282491
Encrypted:	false
SSDEEP:	192:08NVYz/SCrsKrYrygrL5UHsCYBv2S5OVhxPSidLhHYWZHHYzHuxN5FoXQuHNVcbU:Xod1grbuz9hHYWJaQCHqC
MD5:	665BB2E55E2A13157D1DBFEF05D1B905
SHA1:	408FEA33F574BD0FA9E4CB71958363398E0699BC
SHA-256:	DA6ECCE3DB7D305813FFE80CA994663D43F1068F0FB67399A4C66D1F28684BFA
SHA-512:	8FE95E22680E1E802D0CEEECBBD6B098526468B8CF4D838301D2833247D94E4F3B3A4B76A68F9FAAA2177B42FF2FFEA2DF46EF56A4A0CE501D126135CE8EE985
Malicious:	false
Preview:	local DPIMultiplier=(getScreenDPI()/96)..local ThumbnailWidth=240DPIMultiplier..local ThumbnailHeight=80DPIMultiplier....local DummyBitmap=createBitmap()..DummyBitmap.Canvas.Font.Size=12....local getListItemData,getThumbnail,generateListItemBitmap,getListItemBitmap..local cleanPage, setPage,getFullProcessList,filterList....--[[..ceshare.FullProcessList is the downloaded list which contains all entries..ceshare.FullProcessListView is the searchresult....--]]....local backgroundcolor....local darkMode=1..local windowColor,listColor,searchFieldColor,fontColor, fontSize, linkColor, highlightColor..if darkMode==1 then.. listColor=clBlack.. searchFieldColor=clBlack.. fontColor=clWhite.. windowColor=clBlack.. linkColor=0x0000ff.. highlightColor=0x00ff00..else .. listColor=clDefault.. searchFieldColor=clDefault.. fontColor=clDefault.. windowColor=clDefault.. linkColor=0xff0000.. highlightColor=clDefault..end....fontSize=12........function getListItemData(index).. local width..

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\ceshare_permissions.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3720
Entropy (8bit):	4.600809001198686
Encrypted:	false
SSDEEP:	48:5JPi+sMwj8PiwwVtZw/FHesmsd6e2g8Qp18RHB0vjjmmNDARNbMymMNPuZdMUX28:5J6+sd4aw2ze/bPWh0RNaoy5uUY2hrEF
MD5:	65C8D4EDDFE05267A72EAE3DDB2CF02A
SHA1:	EEF2928D355C8B669F8854DA37162BA1FE32740A
SHA-256:	15B0C7682E5E8D2E2C2B8CB00C0C03B7DFA9439AC80C37F8E96A4F86652246F9
SHA-512:	1C151D5A44482362430FBC6ED4550671AD96E768942E4EC2A4C487182BED9D0326A0D40A1AC43F2C8A3DE1E18E33B055CE7126D80FEE9B5B7091ED83A22A41AD
Malicious:	false
Preview:	--Responsible for editing permissions on tables and changing the owner....function ceshare.ManageAccessList(entry).. if entry then.. .. if ceshare.Permissions==nil then.. local f=createFormFromFile(ceshare.formpath..'Permissions.FRM') .. ceshare.PermissionsFrm=f.. .. f.OnDestroy=function(s).. ceshare.settings.Value['PermissionsFrm.x']=s.left.. ceshare.settings.Value['PermissionsFrm.y']=s.top.. end.. .. f.lbUserNames.Width=f.canvas.getTextWidth('this is a very long username wtf').. f.lbUserNames.Height=f.canvas.getTextHeight('QWERTYjkl')*10.. .. f.lbUsernames.OnDblClick=function(s).. if s.ItemIndex~=-1 then.. s.Items.delete(s.ItemIndex).. end .. end.. .. f.btnAddUSer.OnClick=function(s).. local name=f.EdtUsername.Text.. if name~='' then.. f.lbUserNames.Items.add(name) .. end.. end.. .... local newx=ceshare.settings.Valu

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\ceshare_processlistextention.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10057
Entropy (8bit):	4.490014854752693
Encrypted:	false
SSDEEP:	192:ejQ2511mA/SZ1aHe768NxSnLuYd42QRDwdmxst8mHWVZyjqb/9rPj4Y8JYs5Rjkc:eH7eeeBJZhbN0X1R
MD5:	607A7C1AB93026D94916F21779D0D645
SHA1:	3D5A64B256FC44086E6E190EA0BC45B5999E1979
SHA-256:	EA61EEA6289C2FEBA7B7D0CC24DB5277E383102F24784E6BF7254AF41829599C
SHA-512:	D6749E2DBE46466A1CB1C464CE3F237836EF6B572EF897C7F5C9D12F80A6C0C7A5DFEA54C3499A91E14B29C8BBF0809CCE433C379F9E5DC0072E436F641C59AD
Malicious:	false
Preview:	..function ceshare.GetCurrentProcessList().. ceshare.currentprocesslist={}.. .. for pid,name in pairs(getProcessList()) do.. local md5name=stringToMD5String(string.lower(name)).. --search processlist for this.. if ceshare.processlist and ceshare.processlist[md5name] then.. local e={}.. e.pid=pid.. e.name=name.. e.md5=md5name.. table.insert(ceshare.currentprocesslist,e).. end.. end.. .. return ceshare.currentprocesslist..end....function ceshare.DownloadProcessList().. --Downloads the processlist .. local i=ceshare.getInternet().. local processlist=i.getURL(ceshare.base..'processlist.txt').. .. if processlist==nil then.. return.. end.. .. if processlist:sub(1,1)=='<' then.. return --it returned html code instead of a md5 list.. end.. .. local f=io.open(ceshare.path..[[processlist.txt]],'wb').. if f then.. f:write(processlist).. f:close().... synchronize(function() ceshare.settings.Value.LastProcessListDownload=os.time(

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\ceshare_publish.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	21455
Entropy (8bit):	4.719034004905997
Encrypted:	false
SSDEEP:	384:K3KK7BDUUhaWlvyDep8IcDsfUPrBUpJRg:K3hDUUh3Kqp8X9UpPg
MD5:	87CD08B16891E0DBE3D47BB71CA91691
SHA1:	55D98338B4AA0DF3566CD2E721B3D3F86A3836AA
SHA-256:	6BFD35AA64AB566DDB68D0675AD3B4A093649010A9C30DF3A30A7F9DC2ED7702
SHA-512:	847BECF1D3066A3E185001035B68496B91876BDEB323734782C41FC9B2BDF665BF33C728CEBBE78E820654D87B1969C09B5D1FAED7498538CB5F761984108614
Malicious:	false
Preview:	local function isWindowVisible(winhandle).. return executeCodeLocal('IsWindowVisible',winhandle)~=0..end....local function getBaseParentFromWindowHandle(winhandle).. local i=0.. local last=winhandle.... while winhandle and (winhandle~=0) and (i<10000) do.. last=winhandle.. winhandle=getWindow(winhandle, GW_HWNDOWNER).. i=i+1.. end;.... return last..end....function ceshare.getProcessTitle(pid).. local w=getWindow(getForegroundWindow(), GW_HWNDFIRST).... local bases={}.... while w and (w~=0) do.. if getWindowProcessID(w)==pid then.. if isWindowVisible(w) then.. local h=getBaseParentFromWindowHandle(w).. local c=getWindowCaption(h).. if isWindowVisible(h) and (c~='') then.. bases[h]=c.. end.. end.. end.. w=getWindow(w,GW_HWNDNEXT).. end...... for h,n in pairs(bases) do.. return n --just hope for the best..... end..end....function ceshare.getCurrentProcessTitle().. return ceshare.getProcessTitle(getOpenedProce

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\ceshare_querycheats.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	25075
Entropy (8bit):	4.523124761905836
Encrypted:	false
SSDEEP:	384:RYDUUhQNWv2rzc3lytSv5ooI0/r5cCAn9zZMf4gybrby15VZ3faxLao0iH+WpeCC:uDUUhQ0OrbBKGYU63
MD5:	623B89F1E13C54A1F560B254317948B5
SHA1:	B90E2DE7A5CFF0B14738F2FB4F6A3A4E1EE1A17C
SHA-256:	0C6E90C2525F1560ACEA3F4BDAE056D11DF1C2F675C2335594DC80BB910A1B17
SHA-512:	F80CD50F860A5F8D5C6D6AB7BA8691B443DA91573F3F0FC8D5B82B79556C5AC02ACCC610870EA61A886ECB8A4491457965D082F8F41DF781DED1DB84F7157A3F
Malicious:	false
Preview:	function ceshare.enumModules2().. local m=enumModules().. local r={}.. .. for i=1,#m do.. r[m[i].Name:lower()]=m[i].. end.. .. return r..end....function ceshare.QueryProcessCheats(processname, headermd5, updatableOnly).. local modulelist=ceshare.enumModules2().. local result=nil.. local parameters='processname='..ceshare.url_encode(processname).. .. if isKeyPressed(VK_CONTROL)==false then --control lets you get a new script if needed.. local secondaryIdentifierCode=ceshare.secondaryIdentifierCode.Value[processname:lower()].. if secondaryIdentifierCode and secondaryIdentifierCode~='' then.. local value,param=loadstring(secondaryIdentifierCode)().. if value and param then.. parameters=parameters..'&secondaryidentifier='..ceshare.url_encode(param).. end.. end.. end.. .. if updatableOnly then.. parameters=parameters..'&updatableOnly=1';.. end.... .. .. .. --local r=ceshare.getInternet().postURL(url,parameters).. --local s=ceshare

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\ceshare_requests.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5622
Entropy (8bit):	4.880391114169657
Encrypted:	false
SSDEEP:	96:5cHxYq8COheJHVFvNmAYVL9rAaDu+WYtUX8T794B:5cLJHVF0AGBli+LtcYSB
MD5:	6CF99831E2AAAFB97E975EAE06A705FF
SHA1:	B6E71F7D3C779575598B65A6E4FB341344A3DDD2
SHA-256:	E9D57ACB17502AC169DEB37F211E472F68CD6E8A69E071D384B989FA45E9FA7F
SHA-512:	F6467C4C9DCAB563DBB5A337C76616208D1A1058D704B222E616E5A0809A156B1A29198919F4BF0D40C55A6E972439722C02AAC8A156C53572B6D7EF80986405
Malicious:	false
Preview:	function ceshare.QueryProcessRequests(processname, startindex).. local result=nil.. if processname==nil or processname=='' then return end.. .. local parameters='processname='..ceshare.url_encode(processname).. if startindex then.. parameters=parameters..'startindex='..startindex.. end.. local s=ceshare.QueryXURL('QueryProcessRequests.php', parameters).. if s then.. if s.RequestList then.. result={}.. .. for i=1, s.RequestList:numChildren() do.. local request=s.RequestList:children()[i].. local entry={}.. entry.ID=tonumber(request["@ID"]).. entry.Username=request["@username"].. entry.Message=request["@message"].. entry.Score=tonumber(request["@score"]).. entry.Time=request["@time"].. .. table.insert(result, entry).. end .. end.. end.. .. return result..end....function ceshare.createRequestPanel(request).. local panel=createPanel(ceshare.RequestsFrm.MessageBox).. panel.Align='al

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\BrowseCheats.FRM (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (8956), with CRLF line terminators
Category:	dropped
Size (bytes):	9023
Entropy (8bit):	6.421978633663277
Encrypted:	false
SSDEEP:	192:bmmNyxgIf4EwW+rLEUeD0qdYKjj4vxs78t+ojoFv3VU:bmniIf4ERWrPM+O8zjoFv3VU
MD5:	D4F5FE5A2F5FEEB3D97B2FDF4AE7E6BC
SHA1:	EEF59C5A8AACD86F993E2BB3F8E5892817A9F7EB
SHA-256:	9CB25C63AB41BE2BA3984DF20686DD27BF937E029EBFAA56EBE88BAC6DFC53B6
SHA-512:	B00E9467A5203B04A958A69B20152AD5907E5337A43E3FF8F9209A01D7874DD477BB8596E93B3ACAF7354EE7CE76E742F4A72F598473A9C8CC36BBDBB240BB43
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <frmCEShareCheatBrowser Class="TCEForm" Encoding="Ascii85">wR#CWlw0]!JBwM2C0mxHv1BJor9!e#+^)IR4PFdmhMBQtR{#urq9RgV#kEvaQcTH}rPWf1D1?=9ma[cDQq/,%]{:,V_93t!=;px[:Q,;vJ/mDkeU6R/0GJu.C=L%:wROl8(-E?8Pfcx8H#]N?bOZ4.4GP)h3R2,upbHJ:14Zb81Xnj23:4(sk-cDF047U/GtCXA4##MaDb64T:R[t@FWS+)+P/B@fUlTJ@e@==oe!NeI;jme=hpESf_DNTU7Zh+_vqgCT%oh-8c;fkf2OU2#DQDDXpwtH8Vv({A8z[7MrLBqS4[$S7yl0DVECkq-?_AQ6tfhGY];YmZlf-,Dxu.T=[Um4E@Zo$KQr7dl[KE3V(1a(jY6ObO25ycqJDWD/:,CL)]I$Foep:;G5Zi[+iEq:#aE5k3LnTr^Am7v70La,O}s^%JZEV,z;]q+6)EPjENJnBg80O[NL^Q(1}pWg_Kgm+?-]bpIgnqDox95zIdz)ReCFgG^55J:a!fvH2n;(H$?w1SS5nLd@aPmpteX^-zFQUL69JW/db]P)/Ga%uxSTmwywM@Vj.^ROMZ,HJR7t?80A7o#HnRe9QHV1@/.C6eEG^E86R?kM-Nmms1FM:mm.VwmtAj2Z.qW4-_r?39}e3h%MVhB4sCL=2HQl=^U0:R,f#5OmtpN3}LBhZN8l9LR9kqMGB1S).G:$Y?jC}x51g9k$hgE5qOr6M-A6+=/m4wRzq-[TSOUoz@a2=[B-a]0A%%!O(MbxbY9{;zA6oJGu8l4b8:fE3R#s1u1[F(EKwW0JJWJ.LIojsc2R]hF=rUBIq/vh)a5ay=ngpLm3j]/v9.clnID.HX.!N({b8}-y$V=MfgC@W7m]xKm=H{U#bb^MW*aIU@

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\CommentsOrRequests.FRM (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1145), with CRLF line terminators
Category:	dropped
Size (bytes):	1212
Entropy (8bit):	6.394471687276162
Encrypted:	false
SSDEEP:	24:2dqQ7rMmbWa4nYCr0eZK8kNIkhXKLBq0IykSiHqVMywpvh:cqQ8ha4v0eZ9kexM+kP6Svh
MD5:	CD4D7AEE15163AB407B4F18D8F93DCC3
SHA1:	676E3EEA53646F221DCB4C9B7DCC2CB5315F36BC
SHA-256:	D8DE8120C14DA094FEDDB24C46C3E729D99696CCCE9C2D479797FFBBF34BD20B
SHA-512:	17EDE3DB62A9D2ABFB8D2715E5ED816A7BADF1EB7EAD79E5B48AB6DB7DCD8215B40CDD03D4A3CFD5EDE4567FA5092D9F7406FB25BC82DCAA26CBEA57C2207F69
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <ceshare_frmComments Class="TCEForm" Encoding="Ascii85">t)DDk,cpr#A/7c=p(aVCac_YJCM=gGd/Y)eX$#io:=Udus-wRuV:apn#yqb]QPxJ@Bc{[mdvqKCdmL4qHm#,r26oJcGdi}s)10sLwsGz,fI?XUXGC1m[Of?Do3ykE-L7jX/,B{Y=Os]l9GjAV$s^Osyo^4Sy-s:2F7i!(pp/6I6ukpqa3ux9cKimCgsi_D3Aq3^i3Cr-kgRHi2@.zQ-po8RaEfqNx4m5$i9RRDI[ZC]HX5=wV]Lmqa/d(:sH27:mEZ^sXyFe_ift$pYf?!P)(D.0)F5Fw%0@NZh-HApM)XW1%vckF6^j3st$Cji/I77^s[?JK=Y(uSevX96A1YMnHVVJw7NJ1=5nnIzGM?_AO^MXINRHo3AO:A)fGh^k;Y!havbbP@t#7?L6VM$V@yg+lwtK4kcGctdhRl!0C+{BXD.lO%Dt?1$:iN+5r^?JRKEkb3QX,Ooa0l#dszBoI^O)$CXcWw1d-bX^v^2S+Zy++]le]%6Xf0$(7m):}lwH2[,^.,#Z@8Io3m?USLYYUO@57?9g._,[[UtA$rM%r?Lcf[[}NVD!L0bCjKXbiBZJZ_QNGHX;zjhZ%5dyPrMG/:$S6rWd4_Ja#c3jm=-Gj9Gq{VBHcCv6ZDIwF@g/JZ]$%OmVMH,nxNKhE7(2hP!Xxi=(#ks?ReGZ9Wo[zV9zw#K+AjrX;xvXfPVwdLCAHLx[(AX-K$/C$Am8eLAf(5%TGrov.OXZw0[:0R/c4+XI?/@Ua7r+e(JqeAp;)t,:z^Znr7a^9I6Kfp0]ZiaUG6P4ybW^Tr/dg=HxRIPX7x^!_P//Yp:NuBEcHz3?NM!(z#dmz/-=jZ(QkFVEb,0e9$F]#Lbl(x6$/^Jlc;ZI1Bk0@u+5Zc33

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\InitialSetup.FRM (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1222), with CRLF line terminators
Category:	dropped
Size (bytes):	1289
Entropy (8bit):	6.4066800193563065
Encrypted:	false
SSDEEP:	24:2dIQ7TXr3F7R/8TDt3E/IlGZ264FeZqE1OieF5MiVM6wJAHWMzX4i0pdp:cIQHr35MMIlGZ264FzIjQ5jS2TSpdp
MD5:	23CC858DA49A7BDA9E9FE3ABF8D86D1D
SHA1:	9D869496104ACFFF0C5CB572628085666DC53486
SHA-256:	D5786540891C411BC34A5505A6CEE0E747DF2E5CD410ABFEB94E6D4169C85069
SHA-512:	B5650AB1AE463F97F5681DD3FDFF7015C963703A7437AC5F71A158F3E0BDC045E69151897D0EC75AA9DD4CCAC5475E6E492CE46A296BCAB8C4C329720E3C002A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <ceshare_InitialSetup Class="TCEForm" Encoding="Ascii85">wN:e-,eQ$kD9Ms,:TOJVp^GGFDT-EToc7S1YS9iF+scsqg?Im+B^;qeS=.pCOS_er@cngXeS_z#W_tHdxPcO:s@)oZ_3^H]F8g0FbL,=uf874qw]lv:f=={jA^Jkwd9sFF,+Dxy-Qr!=$6:g56G99=M@z}xhlH-PXCstHtT-YAD)0(G.WU8bqwHT+/vB)fQ0pf.tlTP:{G:C}Xtypc:2@1Vh4c$zl{4]v1949uDi:A-L2bR^l,[fG_1%0ZtAnm=K-ouZx/Ea7rFu1,=Ho}^ukD$h$owSu2,E=+v810C5:xUA_3GlE6,!SZ2.@i1lnOPi0fRLjLIEpP!aWxPVgwco1goGdgkmW$nL=]Wr5^8YG7EFJ#lS,VoZ^3q1B3bw@?dH,3:Q--D+}hws3sW:Ggr!?FcU3AbI#[CkW2CNd6L;X$Ij(:4oWXEUzTuL]C}]3kEUyXBQ%mC6FK#1xc/oN.OCN27Q{2eBr8E_Y3g.u^{V!!m-NCo#yYbGfy9o1,GB?K@-tFXo.2Y+(f@a7e:]SsC1518}atv@G6]exl.2Mxf8A/xssVVZOU==SZK}HeWy8;,+r+lWm5}kp[cwWQ%w}$vLy4RtQiO^-vF2XJ66[G=X+HoFXm_Rnn8R^uH6qt4I5f[OAspgC03ctUvBJ5]QAF(g[aupmT;QqvYqnSLv_:4i$^eQ-cNh+Tb^iTeF8iEBTS9UoZ!bMJ:lYd0KyfEymSCvSY1.r=rj]T80S$.4BDGVw^UNh,);HnWUJ)WqO@o+zILXIP%uay__r.h342dnO5Fk)hW^)e2#EEB?!Y-9JM[Ih*A.;%L=yKmS1E/Ew:=r]1i^th/n=vpl8CsXgZJy+pHd.1f-LoqE0-e51j]%y]3b.Iz

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\Permissions.FRM (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1189), with CRLF line terminators
Category:	dropped
Size (bytes):	1256
Entropy (8bit):	6.4186272262096935
Encrypted:	false
SSDEEP:	24:2ddlQ7Be7XyJpQUDdX+ZdEjY6JFxhiVFtGgtkyO3FwBod6cGcNNnpvrAJX:c3QMOJpQUd+Zq1FnsPtKW2RNNnpMh
MD5:	7FFD1E1B425636CFA08CDA89429C69A6
SHA1:	EC6A75FCA2BC4F2E8CB7AB9644D1BEDB1D686221
SHA-256:	44E9BC08A3F919DA8689C4703E77324568F3902E95F8F3F92CCF234BCF7BF649
SHA-512:	DBA72B7A8F1A3D72101E4F735E0CEA1BE8E72236A81E6FC2CE18E7F93715B5C1F21AA384790C7E0097A23AEB6D52E954CE7C7ADF7C6189A855DCD6FADADE7C9B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <ceshare_permissions Class="TCEForm" Encoding="Ascii85">y[U.z):Zf/9oey,ro#-q)5,Vt!!R9S$+xJ8X]!W:Ix=3[Gx3HNEut^gJ_?8=a(32Vu,0?Bqk]uNgV+l+:lPk0t(8cXV]gv#M#M.o!M7;hBF$G,p.09@)i.%pjVEaU3!l8.5Yl@]E-A58=Tk;z_N5Vl){FtNlI/[+gfPy*.]4L=Jt,hb7x)Sa_/byvO6y@c9dkATj#EadWQ0,#K=Zb.9=Qy/T]SjAjBoduYKGb_Tg=UN8FFP81f_HZ097Kh1L;%ok/egr]KA]FqXBHSE=G4HXfF7Zxdh$x.y^Ah;zV-}q#0EwmTKBGKh#A,X3QiwLosIXTAS3FL4f+[e;t@P(wYjtoO@%(:DnqoqBPU(mQ+bgZ.H,R_GBjA)JpE#U35lq/yNP:2M?K/XsgEPavz[Kl.dRTuch9G0T^[Z4M3w3Ng0fr}X%B]Xft0(rc9_%!=fj]?kFa-}3]d%#B]MzvLf)ad:ZKmJRVg-bvcth$K^l@%4nx#ko!rJxO4pi.UG{%aT+X-8P/xh;0i3[ZFU^6KV:-wvw7r.%M0{5SQaf.OmITL!jq.jI?U%xZ)-Afl%3JghiI,lODnTq!yB!,B{PUj0Bq25omjJVV721^UdJGNCw%q{rnTmsU;pX[YLxUI1GVEz4WQwy0oR7/J{COUYI2Gdrn8;.bWfM-FyJSNvXOD1(lm7]c8Yo+0[w@T*BsEVkNj1G3YvRcyQ,7-F(RPK[3AgLnZXMN$D1=WwA(v8gkCu(bGlm_nhUy5w9kcb=GoWK)3g@b%_-sSLHNX,BR#I[.[sPvFZZ1P}_9^yb;s,g3=$bIZDPevhiSw3;9[s,+^$AxTx%6z:ed/;T7Bb_Q1L+6Wk/@NAQ^:Apm:{0USE[:-(;oqsG@%}]dD33q:

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\PublishCheat.FRM (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (2354), with CRLF line terminators
Category:	dropped
Size (bytes):	2421
Entropy (8bit):	6.429603749104613
Encrypted:	false
SSDEEP:	48:cFQ46+MhmKUEJ4Luu8nEq61PwmKekYxRfEQWtJSmhfQl:M0hm9o41bpPRkoEfScIl
MD5:	D6FCB383A27920083054DD42003BEC4D
SHA1:	3941A986929680D50B8B74E61323D1D6C20AEC27
SHA-256:	A8611471651393E17090167C5B6CADE46EAE9FEE8841DB0816BF36A4F43FBE16
SHA-512:	405CBB3823344BC321E135C8084710352506A342FF22A2C356B0629EB6E929AC44C0098BD6E90256BC0814A7693D367E6E4AEA8BF277B122654E19A185D52938
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <frmCESharePublishCheat Class="TCEForm" Encoding="Ascii85">y.6f8${pi=/W3.1,zArU6k,d!d!ufQl-ls,Y!fNFZO-X-g#{G,vLhtBhx=-Ekaq/H#SVsCq+c68]]WTsU(!!kr5zeg+IBtoO@iYsXEHBFEnOc.Dxp:Xq!Lokuq]=eJjp/I-WRzR8]:wYJl#f+Oe$U)13ZP%)/1dEv,)iX:3LUD]ON0u/Ex@c,6#@2iP3%eyO.{5/3xF;kS^,3j#8^BCTXWQh:t/E;=#:sS%vrAY^E7fpU+qjxY^K=TC:[Aj:e2v/KiD3S!]aPUpD{#eOxJl;(ZPEjWo5XeZaEDxb%uI[r4ZB68kLxwggu]iRcE8Vvb2V%Qe{l#a)h]w5uEcxE_D[6cof/em91pub/3raMC35_y0/LdgQD[?oY{K-UGuc(ihsvSb11IfT%K2/CHsPO[L$tB@@HBc_u(%vAq#laLPXVPcje%=O9khxDdRv8n!-[XcFOCNj4^jUk{@WgJ66SR@^2#op]K[rGiJ3ABHsfT]#E[-0CbohNdDumLp2_+t1v0$7[{IUZK8RiC+E:3L:mn,bP+Jl2b,[/!3Gvcl^gae3Lh+7WqR1i,)dHT@xJfs#/Cco93s$W1A#UzVBS5YOp$(l?p/kM+B!!,U}M%mWL+(7oCP_-jL-,!3#8if7buNv#]k^w@hW]su6=/UP,%lQ+(KLH,nEDbMsZQoM:r5APbS%@i+u-Bg+E=h)!JNw2(Crhq+@z@J4OE!ROQE#Q;TrjSKpQd{hNlLi95]U)}:.gT$azf}S50ICN(67RONGv)(Yq8wMhl5l(=+po74x}KV1Aa%ihg8GGZL+p[rk=qM#3n?kNL/ph)HLzLF5la70LdE#h[s,@%6{5{N6C2rQF0DwdOiIv5KoEz8apm7gJE_G],m1w

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\UpdateOrNew.FRM (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (869), with CRLF line terminators
Category:	dropped
Size (bytes):	936
Entropy (8bit):	6.410328130247008
Encrypted:	false
SSDEEP:	24:2d3Q7M2RqjiEC8Fpohhnh13sAy/jtaos59:c3QAkqeP0poh1b3Ivs
MD5:	5AD30685C039C115C346D24223C3EAE4
SHA1:	814C5B02040E87906E7A64F4355B8A35101BDACF
SHA-256:	BD3E07DECC17007796403191246AB0F3585F51532FBF16D496E541C3107D7E0E
SHA-512:	DE29C279573C7CC542E8A9AC427594E067D47DE390A7D41AC2E7CCDDD646550B5ED6D2ECAE39B2C7B798649B6D61BA5BD259FD0A8814D35B508D3AE96DD19BC1
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <frmCEShareUpdateOrNew Class="TCEForm" Encoding="Ascii85">os;.-):Zgr6,4OTNt(59EwId?!-7TO0xTN0rObpT#G!1F=Uz]?kvx+pOgRb+ZopkQ0?q-NY(l9{LORopKlDEI-tYaTk4:OoqpLU0#J^^@d}q]63.!{mFo#cBj3o@D4Xo,_m]eM:Ze9bKCDQ(=vnMRGzt/X^Nh{ll)rz]kAc6B7!_E^NP;GIVetXz5..E3Bw?7K)HUQ7%P:J)Y5OSwDox6k^$FQwM?+1B(go//h(TZCl@Hl^sagj[$Xfy^H?^z+0Orr%{RqKw]+=J?XlroTW{/xT3(MHda-+F{gg_H63l,@S9$,!TU?}ws@j:j]LzG$(ah%O8AS7T]!n.kB1]-qabY6+MM(dz{9KW[pR.d9HQ00b7g7bc@:@4d9kC5:Q:Yw)sKwh91%J?)@/RQi$#c4cYKyE7gTg:=g%)fP4eb%(IXVG6lW8b%S:fG{V$Ssq]VceTw#=)(xgpYAPip,0)q#+l${P,9hkYP,rWJVz[vwlU$d(fyUAQXgmaIG+0kV2HZy6zZoJf!Kp:ZDuY2wUhr@tRRr7KY1?b-x$GsC^$QYLhwI@d76V[iUrqqb!NfOh;=eSWt#dJ}G//H$yGwrtZ[C1M1Ri:]AG;7.;6Ub4Yfn:FiseB]@CzbAnlKKf[.+sOAN8cvHE(wP-ygq])RZorM-+,=9F]6CD6BM}4HruZLtPam3scH_7Tt:}@r_nP_DiIZpNi[ANtE[V0){#_tgS5DnR}NgZ#4x/mMn9ZX=aL:pJvc:?]p3ppVPTd)B(m?dBoJnLa#GHbUqx</frmCEShareUpdateOrNew>..</FormData>..

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-4M6BM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (2354), with CRLF line terminators
Category:	dropped
Size (bytes):	2421
Entropy (8bit):	6.429603749104613
Encrypted:	false
SSDEEP:	48:cFQ46+MhmKUEJ4Luu8nEq61PwmKekYxRfEQWtJSmhfQl:M0hm9o41bpPRkoEfScIl
MD5:	D6FCB383A27920083054DD42003BEC4D
SHA1:	3941A986929680D50B8B74E61323D1D6C20AEC27
SHA-256:	A8611471651393E17090167C5B6CADE46EAE9FEE8841DB0816BF36A4F43FBE16
SHA-512:	405CBB3823344BC321E135C8084710352506A342FF22A2C356B0629EB6E929AC44C0098BD6E90256BC0814A7693D367E6E4AEA8BF277B122654E19A185D52938
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <frmCESharePublishCheat Class="TCEForm" Encoding="Ascii85">y.6f8${pi=/W3.1,zArU6k,d!d!ufQl-ls,Y!fNFZO-X-g#{G,vLhtBhx=-Ekaq/H#SVsCq+c68]]WTsU(!!kr5zeg+IBtoO@iYsXEHBFEnOc.Dxp:Xq!Lokuq]=eJjp/I-WRzR8]:wYJl#f+Oe$U)13ZP%)/1dEv,)iX:3LUD]ON0u/Ex@c,6#@2iP3%eyO.{5/3xF;kS^,3j#8^BCTXWQh:t/E;=#:sS%vrAY^E7fpU+qjxY^K=TC:[Aj:e2v/KiD3S!]aPUpD{#eOxJl;(ZPEjWo5XeZaEDxb%uI[r4ZB68kLxwggu]iRcE8Vvb2V%Qe{l#a)h]w5uEcxE_D[6cof/em91pub/3raMC35_y0/LdgQD[?oY{K-UGuc(ihsvSb11IfT%K2/CHsPO[L$tB@@HBc_u(%vAq#laLPXVPcje%=O9khxDdRv8n!-[XcFOCNj4^jUk{@WgJ66SR@^2#op]K[rGiJ3ABHsfT]#E[-0CbohNdDumLp2_+t1v0$7[{IUZK8RiC+E:3L:mn,bP+Jl2b,[/!3Gvcl^gae3Lh+7WqR1i,)dHT@xJfs#/Cco93s$W1A#UzVBS5YOp$(l?p/kM+B!!,U}M%mWL+(7oCP_-jL-,!3#8if7buNv#]k^w@hW]su6=/UP,%lQ+(KLH,nEDbMsZQoM:r5APbS%@i+u-Bg+E=h)!JNw2(Crhq+@z@J4OE!ROQE#Q;TrjSKpQd{hNlLi95]U)}:.gT$azf}S50ICN(67RONGv)(Yq8wMhl5l(=+po74x}KV1Aa%ihg8GGZL+p[rk=qM#3n?kNL/ph)HLzLF5la70LdE#h[s,@%6{5{N6C2rQF0DwdOiIv5KoEz8apm7gJE_G],m1w

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-645IR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (869), with CRLF line terminators
Category:	dropped
Size (bytes):	936
Entropy (8bit):	6.410328130247008
Encrypted:	false
SSDEEP:	24:2d3Q7M2RqjiEC8Fpohhnh13sAy/jtaos59:c3QAkqeP0poh1b3Ivs
MD5:	5AD30685C039C115C346D24223C3EAE4
SHA1:	814C5B02040E87906E7A64F4355B8A35101BDACF
SHA-256:	BD3E07DECC17007796403191246AB0F3585F51532FBF16D496E541C3107D7E0E
SHA-512:	DE29C279573C7CC542E8A9AC427594E067D47DE390A7D41AC2E7CCDDD646550B5ED6D2ECAE39B2C7B798649B6D61BA5BD259FD0A8814D35B508D3AE96DD19BC1
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <frmCEShareUpdateOrNew Class="TCEForm" Encoding="Ascii85">os;.-):Zgr6,4OTNt(59EwId?!-7TO0xTN0rObpT#G!1F=Uz]?kvx+pOgRb+ZopkQ0?q-NY(l9{LORopKlDEI-tYaTk4:OoqpLU0#J^^@d}q]63.!{mFo#cBj3o@D4Xo,_m]eM:Ze9bKCDQ(=vnMRGzt/X^Nh{ll)rz]kAc6B7!_E^NP;GIVetXz5..E3Bw?7K)HUQ7%P:J)Y5OSwDox6k^$FQwM?+1B(go//h(TZCl@Hl^sagj[$Xfy^H?^z+0Orr%{RqKw]+=J?XlroTW{/xT3(MHda-+F{gg_H63l,@S9$,!TU?}ws@j:j]LzG$(ah%O8AS7T]!n.kB1]-qabY6+MM(dz{9KW[pR.d9HQ00b7g7bc@:@4d9kC5:Q:Yw)sKwh91%J?)@/RQi$#c4cYKyE7gTg:=g%)fP4eb%(IXVG6lW8b%S:fG{V$Ssq]VceTw#=)(xgpYAPip,0)q#+l${P,9hkYP,rWJVz[vwlU$d(fyUAQXgmaIG+0kV2HZy6zZoJf!Kp:ZDuY2wUhr@tRRr7KY1?b-x$GsC^$QYLhwI@d76V[iUrqqb!NfOh;=eSWt#dJ}G//H$yGwrtZ[C1M1Ri:]AG;7.;6Ub4Yfn:FiseB]@CzbAnlKKf[.+sOAN8cvHE(wP-ygq])RZorM-+,=9F]6CD6BM}4HruZLtPam3scH_7Tt:}@r_nP_DiIZpNi[ANtE[V0){#_tgS5DnR}NgZ#4x/mMn9ZX=aL:pJvc:?]p3ppVPTd)B(m?dBoJnLa#GHbUqx</frmCEShareUpdateOrNew>..</FormData>..

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-ESJ6U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1222), with CRLF line terminators
Category:	dropped
Size (bytes):	1289
Entropy (8bit):	6.4066800193563065
Encrypted:	false
SSDEEP:	24:2dIQ7TXr3F7R/8TDt3E/IlGZ264FeZqE1OieF5MiVM6wJAHWMzX4i0pdp:cIQHr35MMIlGZ264FzIjQ5jS2TSpdp
MD5:	23CC858DA49A7BDA9E9FE3ABF8D86D1D
SHA1:	9D869496104ACFFF0C5CB572628085666DC53486
SHA-256:	D5786540891C411BC34A5505A6CEE0E747DF2E5CD410ABFEB94E6D4169C85069
SHA-512:	B5650AB1AE463F97F5681DD3FDFF7015C963703A7437AC5F71A158F3E0BDC045E69151897D0EC75AA9DD4CCAC5475E6E492CE46A296BCAB8C4C329720E3C002A
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <ceshare_InitialSetup Class="TCEForm" Encoding="Ascii85">wN:e-,eQ$kD9Ms,:TOJVp^GGFDT-EToc7S1YS9iF+scsqg?Im+B^;qeS=.pCOS_er@cngXeS_z#W_tHdxPcO:s@)oZ_3^H]F8g0FbL,=uf874qw]lv:f=={jA^Jkwd9sFF,+Dxy-Qr!=$6:g56G99=M@z}xhlH-PXCstHtT-YAD)0(G.WU8bqwHT+/vB)fQ0pf.tlTP:{G:C}Xtypc:2@1Vh4c$zl{4]v1949uDi:A-L2bR^l,[fG_1%0ZtAnm=K-ouZx/Ea7rFu1,=Ho}^ukD$h$owSu2,E=+v810C5:xUA_3GlE6,!SZ2.@i1lnOPi0fRLjLIEpP!aWxPVgwco1goGdgkmW$nL=]Wr5^8YG7EFJ#lS,VoZ^3q1B3bw@?dH,3:Q--D+}hws3sW:Ggr!?FcU3AbI#[CkW2CNd6L;X$Ij(:4oWXEUzTuL]C}]3kEUyXBQ%mC6FK#1xc/oN.OCN27Q{2eBr8E_Y3g.u^{V!!m-NCo#yYbGfy9o1,GB?K@-tFXo.2Y+(f@a7e:]SsC1518}atv@G6]exl.2Mxf8A/xssVVZOU==SZK}HeWy8;,+r+lWm5}kp[cwWQ%w}$vLy4RtQiO^-vF2XJ66[G=X+HoFXm_Rnn8R^uH6qt4I5f[OAspgC03ctUvBJ5]QAF(g[aupmT;QqvYqnSLv_:4i$^eQ-cNh+Tb^iTeF8iEBTS9UoZ!bMJ:lYd0KyfEymSCvSY1.r=rj]T80S$.4BDGVw^UNh,);HnWUJ)WqO@o+zILXIP%uay__r.h342dnO5Fk)hW^)e2#EEB?!Y-9JM[Ih*A.;%L=yKmS1E/Ew:=r]1i^th/n=vpl8CsXgZJy+pHd.1f-LoqE0-e51j]%y]3b.Iz

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-FJD1M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1189), with CRLF line terminators
Category:	dropped
Size (bytes):	1256
Entropy (8bit):	6.4186272262096935
Encrypted:	false
SSDEEP:	24:2ddlQ7Be7XyJpQUDdX+ZdEjY6JFxhiVFtGgtkyO3FwBod6cGcNNnpvrAJX:c3QMOJpQUd+Zq1FnsPtKW2RNNnpMh
MD5:	7FFD1E1B425636CFA08CDA89429C69A6
SHA1:	EC6A75FCA2BC4F2E8CB7AB9644D1BEDB1D686221
SHA-256:	44E9BC08A3F919DA8689C4703E77324568F3902E95F8F3F92CCF234BCF7BF649
SHA-512:	DBA72B7A8F1A3D72101E4F735E0CEA1BE8E72236A81E6FC2CE18E7F93715B5C1F21AA384790C7E0097A23AEB6D52E954CE7C7ADF7C6189A855DCD6FADADE7C9B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <ceshare_permissions Class="TCEForm" Encoding="Ascii85">y[U.z):Zf/9oey,ro#-q)5,Vt!!R9S$+xJ8X]!W:Ix=3[Gx3HNEut^gJ_?8=a(32Vu,0?Bqk]uNgV+l+:lPk0t(8cXV]gv#M#M.o!M7;hBF$G,p.09@)i.%pjVEaU3!l8.5Yl@]E-A58=Tk;z_N5Vl){FtNlI/[+gfPy*.]4L=Jt,hb7x)Sa_/byvO6y@c9dkATj#EadWQ0,#K=Zb.9=Qy/T]SjAjBoduYKGb_Tg=UN8FFP81f_HZ097Kh1L;%ok/egr]KA]FqXBHSE=G4HXfF7Zxdh$x.y^Ah;zV-}q#0EwmTKBGKh#A,X3QiwLosIXTAS3FL4f+[e;t@P(wYjtoO@%(:DnqoqBPU(mQ+bgZ.H,R_GBjA)JpE#U35lq/yNP:2M?K/XsgEPavz[Kl.dRTuch9G0T^[Z4M3w3Ng0fr}X%B]Xft0(rc9_%!=fj]?kFa-}3]d%#B]MzvLf)ad:ZKmJRVg-bvcth$K^l@%4nx#ko!rJxO4pi.UG{%aT+X-8P/xh;0i3[ZFU^6KV:-wvw7r.%M0{5SQaf.OmITL!jq.jI?U%xZ)-Afl%3JghiI,lODnTq!yB!,B{PUj0Bq25omjJVV721^UdJGNCw%q{rnTmsU;pX[YLxUI1GVEz4WQwy0oR7/J{COUYI2Gdrn8;.bWfM-FyJSNvXOD1(lm7]c8Yo+0[w@T*BsEVkNj1G3YvRcyQ,7-F(RPK[3AgLnZXMN$D1=WwA(v8gkCu(bGlm_nhUy5w9kcb=GoWK)3g@b%_-sSLHNX,BR#I[.[sPvFZZ1P}_9^yb;s,g3=$bIZDPevhiSw3;9[s,+^$AxTx%6z:ed/;T7Bb_Q1L+6Wk/@NAQ^:Apm:{0USE[:-(;oqsG@%}]dD33q:

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-KK89E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1145), with CRLF line terminators
Category:	dropped
Size (bytes):	1212
Entropy (8bit):	6.394471687276162
Encrypted:	false
SSDEEP:	24:2dqQ7rMmbWa4nYCr0eZK8kNIkhXKLBq0IykSiHqVMywpvh:cqQ8ha4v0eZ9kexM+kP6Svh
MD5:	CD4D7AEE15163AB407B4F18D8F93DCC3
SHA1:	676E3EEA53646F221DCB4C9B7DCC2CB5315F36BC
SHA-256:	D8DE8120C14DA094FEDDB24C46C3E729D99696CCCE9C2D479797FFBBF34BD20B
SHA-512:	17EDE3DB62A9D2ABFB8D2715E5ED816A7BADF1EB7EAD79E5B48AB6DB7DCD8215B40CDD03D4A3CFD5EDE4567FA5092D9F7406FB25BC82DCAA26CBEA57C2207F69
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <ceshare_frmComments Class="TCEForm" Encoding="Ascii85">t)DDk,cpr#A/7c=p(aVCac_YJCM=gGd/Y)eX$#io:=Udus-wRuV:apn#yqb]QPxJ@Bc{[mdvqKCdmL4qHm#,r26oJcGdi}s)10sLwsGz,fI?XUXGC1m[Of?Do3ykE-L7jX/,B{Y=Os]l9GjAV$s^Osyo^4Sy-s:2F7i!(pp/6I6ukpqa3ux9cKimCgsi_D3Aq3^i3Cr-kgRHi2@.zQ-po8RaEfqNx4m5$i9RRDI[ZC]HX5=wV]Lmqa/d(:sH27:mEZ^sXyFe_ift$pYf?!P)(D.0)F5Fw%0@NZh-HApM)XW1%vckF6^j3st$Cji/I77^s[?JK=Y(uSevX96A1YMnHVVJw7NJ1=5nnIzGM?_AO^MXINRHo3AO:A)fGh^k;Y!havbbP@t#7?L6VM$V@yg+lwtK4kcGctdhRl!0C+{BXD.lO%Dt?1$:iN+5r^?JRKEkb3QX,Ooa0l#dszBoI^O)$CXcWw1d-bX^v^2S+Zy++]le]%6Xf0$(7m):}lwH2[,^.,#Z@8Io3m?USLYYUO@57?9g._,[[UtA$rM%r?Lcf[[}NVD!L0bCjKXbiBZJZ_QNGHX;zjhZ%5dyPrMG/:$S6rWd4_Ja#c3jm=-Gj9Gq{VBHcCv6ZDIwF@g/JZ]$%OmVMH,nxNKhE7(2hP!Xxi=(#ks?ReGZ9Wo[zV9zw#K+AjrX;xvXfPVwdLCAHLx[(AX-K$/C$Am8eLAf(5%TGrov.OXZw0[:0R/c4+XI?/@Ua7r+e(JqeAp;)t,:z^Znr7a^9I6Kfp0]ZiaUG6P4ybW^Tr/dg=HxRIPX7x^!_P//Yp:NuBEcHz3?NM!(z#dmz/-=jZ(QkFVEb,0e9$F]#Lbl(x6$/^Jlc;ZI1Bk0@u+5Zc33

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\forms\is-UV0PJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (8956), with CRLF line terminators
Category:	dropped
Size (bytes):	9023
Entropy (8bit):	6.421978633663277
Encrypted:	false
SSDEEP:	192:bmmNyxgIf4EwW+rLEUeD0qdYKjj4vxs78t+ojoFv3VU:bmniIf4ERWrPM+O8zjoFv3VU
MD5:	D4F5FE5A2F5FEEB3D97B2FDF4AE7E6BC
SHA1:	EEF59C5A8AACD86F993E2BB3F8E5892817A9F7EB
SHA-256:	9CB25C63AB41BE2BA3984DF20686DD27BF937E029EBFAA56EBE88BAC6DFC53B6
SHA-512:	B00E9467A5203B04A958A69B20152AD5907E5337A43E3FF8F9209A01D7874DD477BB8596E93B3ACAF7354EE7CE76E742F4A72F598473A9C8CC36BBDBB240BB43
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <frmCEShareCheatBrowser Class="TCEForm" Encoding="Ascii85">wR#CWlw0]!JBwM2C0mxHv1BJor9!e#+^)IR4PFdmhMBQtR{#urq9RgV#kEvaQcTH}rPWf1D1?=9ma[cDQq/,%]{:,V_93t!=;px[:Q,;vJ/mDkeU6R/0GJu.C=L%:wROl8(-E?8Pfcx8H#]N?bOZ4.4GP)h3R2,upbHJ:14Zb81Xnj23:4(sk-cDF047U/GtCXA4##MaDb64T:R[t@FWS+)+P/B@fUlTJ@e@==oe!NeI;jme=hpESf_DNTU7Zh+_vqgCT%oh-8c;fkf2OU2#DQDDXpwtH8Vv({A8z[7MrLBqS4[$S7yl0DVECkq-?_AQ6tfhGY];YmZlf-,Dxu.T=[Um4E@Zo$KQr7dl[KE3V(1a(jY6ObO25ycqJDWD/:,CL)]I$Foep:;G5Zi[+iEq:#aE5k3LnTr^Am7v70La,O}s^%JZEV,z;]q+6)EPjENJnBg80O[NL^Q(1}pWg_Kgm+?-]bpIgnqDox95zIdz)ReCFgG^55J:a!fvH2n;(H$?w1SS5nLd@aPmpteX^-zFQUL69JW/db]P)/Ga%uxSTmwywM@Vj.^ROMZ,HJR7t?80A7o#HnRe9QHV1@/.C6eEG^E86R?kM-Nmms1FM:mm.VwmtAj2Z.qW4-_r?39}e3h%MVhB4sCL=2HQl=^U0:R,f#5OmtpN3}LBhZN8l9LR9kqMGB1S).G:$Y?jC}x51g9k$hgE5qOr6M-A6+=/m4wRzq-[TSOUoz@a2=[B-a]0A%%!O(MbxbY9{;zA6oJGu8l4b8:fE3R#s1u1[F(EKwW0JJWJ.LIojsc2R]hF=rUBIq/vh)a5ay=ngpLm3j]/v9.clnID.HX.!N({b8}-y$V=MfgC@W7m]xKm=H{U#bb^MW*aIU@

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\images\is-F7D0S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 128 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1101
Entropy (8bit):	7.686753451899311
Encrypted:	false
SSDEEP:	24:1f3v5+q2UtliFJGJVpHczJCMQFwdDC2oDCtEnPkEJA:Z3/tligVlccMQUDCpGtEnPkE6
MD5:	0212208FD406500388F08BC4189CC57E
SHA1:	79A82F1AC86D6C4BE3C3E4B0A790BFD4E2F6B27E
SHA-256:	A85170D26B9344DCA793C3B2326EC709D2F2D01578E78B855E82B14795B0025C
SHA-512:	33E7E2AE0B3D36D8E909CFFC993E6B36923E8775E780832F5D689C15D04712EA412B62CC709C53128D9ACAD34F1922CB9FEE90304DA2F879BEBEB4F3A67B9523
Malicious:	false
Preview:	.PNG........IHDR.......(.....6q.H....bKGD..............pHYs...#...#.x.?v....tIME.....7.6`......tEXtComment.Created with GIMPW.......IDATx..\1o.1.}g.?....J..L.XaA..:7.H,,.....0.2...R.t.TE....b....+...p...;..tCN...=?......uaRs.K%..[N9F.W....`[H.-...t.I...L.;.........!...?.\..\|..{x.Z.@e}.....Jo......0zA..{<c...J=.8......YN...8[./G....o.9../.`F.....)PL.......s.&...Y.Hy.S.:.W..........9.^....h.w..8U b.O....zc..4...../ %..OD..8.5....{.XY{..............d.<...tP.1..{o...%.f$F.....(.........D.....D6.i.....~v..m.2e.QS.k!V..K...xT.1}e.............\.y.u.1.>.pO...5.oZ...Ce.C.e.5}..l........[*39........:.E...[.....}...pOd#v..MK..)....S..5....{.T.N...l.M.ue..O.....`/........8.\|.a7.T%.R5.x... .)U...:dw....9r.tJ..........N....N..^.S..R..W..Y.4....'...}...P.........0$Q;0',.bU@........A..Q.....<.L.)...`FDwhVX8..~.#...e.."a:6..L.P.-...".......K...a.T....r..Da0.T..=../...G.C...b.x....W....D.S....oFa...L..3....a,...u..].!.z...@+..NP......./.&...aX...9....`.R...:....w..{.`

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\images\link.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 128 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1101
Entropy (8bit):	7.686753451899311
Encrypted:	false
SSDEEP:	24:1f3v5+q2UtliFJGJVpHczJCMQFwdDC2oDCtEnPkEJA:Z3/tligVlccMQUDCpGtEnPkE6
MD5:	0212208FD406500388F08BC4189CC57E
SHA1:	79A82F1AC86D6C4BE3C3E4B0A790BFD4E2F6B27E
SHA-256:	A85170D26B9344DCA793C3B2326EC709D2F2D01578E78B855E82B14795B0025C
SHA-512:	33E7E2AE0B3D36D8E909CFFC993E6B36923E8775E780832F5D689C15D04712EA412B62CC709C53128D9ACAD34F1922CB9FEE90304DA2F879BEBEB4F3A67B9523
Malicious:	false
Preview:	.PNG........IHDR.......(.....6q.H....bKGD..............pHYs...#...#.x.?v....tIME.....7.6`......tEXtComment.Created with GIMPW.......IDATx..\1o.1.}g.?....J..L.XaA..:7.H,,.....0.2...R.t.TE....b....+...p...;..tCN...=?......uaRs.K%..[N9F.W....`[H.-...t.I...L.;.........!...?.\..\|..{x.Z.@e}.....Jo......0zA..{<c...J=.8......YN...8[./G....o.9../.`F.....)PL.......s.&...Y.Hy.S.:.W..........9.^....h.w..8U b.O....zc..4...../ %..OD..8.5....{.XY{..............d.<...tP.1..{o...%.f$F.....(.........D.....D6.i.....~v..m.2e.QS.k!V..K...xT.1}e.............\.y.u.1.>.pO...5.oZ...Ce.C.e.5}..l........[*39........:.E...[.....}...pOd#v..MK..)....S..5....{.T.N...l.M.ue..O.....`/........8.\|.a7.T%.R5.x... .)U...:dw....9r.tJ..........N....N..^.S..R..W..Y.4....'...}...P.........0$Q;0',.bU@........A..Q.....<.L.)...`FDwhVX8..~.#...e.."a:6..L.P.-...".......K...a.T....r..Da0.T..=../...G.C...b.x....W....D.S....oFa...L..3....a,...u..].!.z...@+..NP......./.&...aX...9....`.R...:....w..{.`

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-6JEUL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3720
Entropy (8bit):	4.600809001198686
Encrypted:	false
SSDEEP:	48:5JPi+sMwj8PiwwVtZw/FHesmsd6e2g8Qp18RHB0vjjmmNDARNbMymMNPuZdMUX28:5J6+sd4aw2ze/bPWh0RNaoy5uUY2hrEF
MD5:	65C8D4EDDFE05267A72EAE3DDB2CF02A
SHA1:	EEF2928D355C8B669F8854DA37162BA1FE32740A
SHA-256:	15B0C7682E5E8D2E2C2B8CB00C0C03B7DFA9439AC80C37F8E96A4F86652246F9
SHA-512:	1C151D5A44482362430FBC6ED4550671AD96E768942E4EC2A4C487182BED9D0326A0D40A1AC43F2C8A3DE1E18E33B055CE7126D80FEE9B5B7091ED83A22A41AD
Malicious:	false
Preview:	--Responsible for editing permissions on tables and changing the owner....function ceshare.ManageAccessList(entry).. if entry then.. .. if ceshare.Permissions==nil then.. local f=createFormFromFile(ceshare.formpath..'Permissions.FRM') .. ceshare.PermissionsFrm=f.. .. f.OnDestroy=function(s).. ceshare.settings.Value['PermissionsFrm.x']=s.left.. ceshare.settings.Value['PermissionsFrm.y']=s.top.. end.. .. f.lbUserNames.Width=f.canvas.getTextWidth('this is a very long username wtf').. f.lbUserNames.Height=f.canvas.getTextHeight('QWERTYjkl')*10.. .. f.lbUsernames.OnDblClick=function(s).. if s.ItemIndex~=-1 then.. s.Items.delete(s.ItemIndex).. end .. end.. .. f.btnAddUSer.OnClick=function(s).. local name=f.EdtUsername.Text.. if name~='' then.. f.lbUserNames.Items.add(name) .. end.. end.. .... local newx=ceshare.settings.Valu

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-CNEHS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12865
Entropy (8bit):	4.882563186282491
Encrypted:	false
SSDEEP:	192:08NVYz/SCrsKrYrygrL5UHsCYBv2S5OVhxPSidLhHYWZHHYzHuxN5FoXQuHNVcbU:Xod1grbuz9hHYWJaQCHqC
MD5:	665BB2E55E2A13157D1DBFEF05D1B905
SHA1:	408FEA33F574BD0FA9E4CB71958363398E0699BC
SHA-256:	DA6ECCE3DB7D305813FFE80CA994663D43F1068F0FB67399A4C66D1F28684BFA
SHA-512:	8FE95E22680E1E802D0CEEECBBD6B098526468B8CF4D838301D2833247D94E4F3B3A4B76A68F9FAAA2177B42FF2FFEA2DF46EF56A4A0CE501D126135CE8EE985
Malicious:	false
Preview:	local DPIMultiplier=(getScreenDPI()/96)..local ThumbnailWidth=240DPIMultiplier..local ThumbnailHeight=80DPIMultiplier....local DummyBitmap=createBitmap()..DummyBitmap.Canvas.Font.Size=12....local getListItemData,getThumbnail,generateListItemBitmap,getListItemBitmap..local cleanPage, setPage,getFullProcessList,filterList....--[[..ceshare.FullProcessList is the downloaded list which contains all entries..ceshare.FullProcessListView is the searchresult....--]]....local backgroundcolor....local darkMode=1..local windowColor,listColor,searchFieldColor,fontColor, fontSize, linkColor, highlightColor..if darkMode==1 then.. listColor=clBlack.. searchFieldColor=clBlack.. fontColor=clWhite.. windowColor=clBlack.. linkColor=0x0000ff.. highlightColor=0x00ff00..else .. listColor=clDefault.. searchFieldColor=clDefault.. fontColor=clDefault.. windowColor=clDefault.. linkColor=0xff0000.. highlightColor=clDefault..end....fontSize=12........function getListItemData(index).. local width..

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-G7CFT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	21455
Entropy (8bit):	4.719034004905997
Encrypted:	false
SSDEEP:	384:K3KK7BDUUhaWlvyDep8IcDsfUPrBUpJRg:K3hDUUh3Kqp8X9UpPg
MD5:	87CD08B16891E0DBE3D47BB71CA91691
SHA1:	55D98338B4AA0DF3566CD2E721B3D3F86A3836AA
SHA-256:	6BFD35AA64AB566DDB68D0675AD3B4A093649010A9C30DF3A30A7F9DC2ED7702
SHA-512:	847BECF1D3066A3E185001035B68496B91876BDEB323734782C41FC9B2BDF665BF33C728CEBBE78E820654D87B1969C09B5D1FAED7498538CB5F761984108614
Malicious:	false
Preview:	local function isWindowVisible(winhandle).. return executeCodeLocal('IsWindowVisible',winhandle)~=0..end....local function getBaseParentFromWindowHandle(winhandle).. local i=0.. local last=winhandle.... while winhandle and (winhandle~=0) and (i<10000) do.. last=winhandle.. winhandle=getWindow(winhandle, GW_HWNDOWNER).. i=i+1.. end;.... return last..end....function ceshare.getProcessTitle(pid).. local w=getWindow(getForegroundWindow(), GW_HWNDFIRST).... local bases={}.... while w and (w~=0) do.. if getWindowProcessID(w)==pid then.. if isWindowVisible(w) then.. local h=getBaseParentFromWindowHandle(w).. local c=getWindowCaption(h).. if isWindowVisible(h) and (c~='') then.. bases[h]=c.. end.. end.. end.. w=getWindow(w,GW_HWNDNEXT).. end...... for h,n in pairs(bases) do.. return n --just hope for the best..... end..end....function ceshare.getCurrentProcessTitle().. return ceshare.getProcessTitle(getOpenedProce

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-LUTQ1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	25075
Entropy (8bit):	4.523124761905836
Encrypted:	false
SSDEEP:	384:RYDUUhQNWv2rzc3lytSv5ooI0/r5cCAn9zZMf4gybrby15VZ3faxLao0iH+WpeCC:uDUUhQ0OrbBKGYU63
MD5:	623B89F1E13C54A1F560B254317948B5
SHA1:	B90E2DE7A5CFF0B14738F2FB4F6A3A4E1EE1A17C
SHA-256:	0C6E90C2525F1560ACEA3F4BDAE056D11DF1C2F675C2335594DC80BB910A1B17
SHA-512:	F80CD50F860A5F8D5C6D6AB7BA8691B443DA91573F3F0FC8D5B82B79556C5AC02ACCC610870EA61A886ECB8A4491457965D082F8F41DF781DED1DB84F7157A3F
Malicious:	false
Preview:	function ceshare.enumModules2().. local m=enumModules().. local r={}.. .. for i=1,#m do.. r[m[i].Name:lower()]=m[i].. end.. .. return r..end....function ceshare.QueryProcessCheats(processname, headermd5, updatableOnly).. local modulelist=ceshare.enumModules2().. local result=nil.. local parameters='processname='..ceshare.url_encode(processname).. .. if isKeyPressed(VK_CONTROL)==false then --control lets you get a new script if needed.. local secondaryIdentifierCode=ceshare.secondaryIdentifierCode.Value[processname:lower()].. if secondaryIdentifierCode and secondaryIdentifierCode~='' then.. local value,param=loadstring(secondaryIdentifierCode)().. if value and param then.. parameters=parameters..'&secondaryidentifier='..ceshare.url_encode(param).. end.. end.. end.. .. if updatableOnly then.. parameters=parameters..'&updatableOnly=1';.. end.... .. .. .. --local r=ceshare.getInternet().postURL(url,parameters).. --local s=ceshare

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-N4PLP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4018
Entropy (8bit):	4.735117902416751
Encrypted:	false
SSDEEP:	48:5ASgbBrZUxqShyY92Tm1E+J7YYI0+9+DKeRA453wxQRBhqvr5OOeCYBhSj:5ARB2hhPE+WY9+AzE5XsBhSj
MD5:	0D4D1B597712015EF1B0EC8ADC26495F
SHA1:	3584779C06619F545B47A27703AA2F47455D50DE
SHA-256:	89C8FCCC16D2AA0A3004DC1B477A5C1DCBBA539769B2A4558F7C7D9B9809B133
SHA-512:	AE26BBB2C3F74C143A01EC3B296A26699C679D51BC68C8C7B8C460616D1A0AA065500EBCA83E972A720BD7A3C5A7B63A673EAECEF1391A2E717208EF8DA0796F
Malicious:	false
Preview:	function ceshare.QueryTableComments(entry, startindex).. local result=nil.. local parameters='id='..entry.ID.. if startindex then.. parameters=parameters..'startindex='..startindex.. end.. local s=ceshare.QueryXURL('QueryTableComments.php', parameters).. if s then.. if s.Comments then.. result={}.. .. for i=1, s.Comments:numChildren() do.. local comment=s.Comments:children()[i].. local entry={}.. entry.ID=tonumber(comment["@ID"]).. entry.Username=comment["@username"].. entry.Message=comment["@message"].. entry.Time=comment["@time"].. table.insert(result, entry).. end .. end.. end .. return result..end......function ceshare.createCommentPanel(comment).. local panel=createPanel(ceshare.CommentsFrm.MessageBox).. panel.Align='alTop' .. panel.Tag=comment.ID .. .. local pnlMessage=createPanel(panel).. pnlMessage.align='alClient'.. .. local lblUsername=createLabel(pnlMessage).. lblUsername.

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-ON5UP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5622
Entropy (8bit):	4.880391114169657
Encrypted:	false
SSDEEP:	96:5cHxYq8COheJHVFvNmAYVL9rAaDu+WYtUX8T794B:5cLJHVF0AGBli+LtcYSB
MD5:	6CF99831E2AAAFB97E975EAE06A705FF
SHA1:	B6E71F7D3C779575598B65A6E4FB341344A3DDD2
SHA-256:	E9D57ACB17502AC169DEB37F211E472F68CD6E8A69E071D384B989FA45E9FA7F
SHA-512:	F6467C4C9DCAB563DBB5A337C76616208D1A1058D704B222E616E5A0809A156B1A29198919F4BF0D40C55A6E972439722C02AAC8A156C53572B6D7EF80986405
Malicious:	false
Preview:	function ceshare.QueryProcessRequests(processname, startindex).. local result=nil.. if processname==nil or processname=='' then return end.. .. local parameters='processname='..ceshare.url_encode(processname).. if startindex then.. parameters=parameters..'startindex='..startindex.. end.. local s=ceshare.QueryXURL('QueryProcessRequests.php', parameters).. if s then.. if s.RequestList then.. result={}.. .. for i=1, s.RequestList:numChildren() do.. local request=s.RequestList:children()[i].. local entry={}.. entry.ID=tonumber(request["@ID"]).. entry.Username=request["@username"].. entry.Message=request["@message"].. entry.Score=tonumber(request["@score"]).. entry.Time=request["@time"].. .. table.insert(result, entry).. end .. end.. end.. .. return result..end....function ceshare.createRequestPanel(request).. local panel=createPanel(ceshare.RequestsFrm.MessageBox).. panel.Align='al

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-SKFQ5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10057
Entropy (8bit):	4.490014854752693
Encrypted:	false
SSDEEP:	192:ejQ2511mA/SZ1aHe768NxSnLuYd42QRDwdmxst8mHWVZyjqb/9rPj4Y8JYs5Rjkc:eH7eeeBJZhbN0X1R
MD5:	607A7C1AB93026D94916F21779D0D645
SHA1:	3D5A64B256FC44086E6E190EA0BC45B5999E1979
SHA-256:	EA61EEA6289C2FEBA7B7D0CC24DB5277E383102F24784E6BF7254AF41829599C
SHA-512:	D6749E2DBE46466A1CB1C464CE3F237836EF6B572EF897C7F5C9D12F80A6C0C7A5DFEA54C3499A91E14B29C8BBF0809CCE433C379F9E5DC0072E436F641C59AD
Malicious:	false
Preview:	..function ceshare.GetCurrentProcessList().. ceshare.currentprocesslist={}.. .. for pid,name in pairs(getProcessList()) do.. local md5name=stringToMD5String(string.lower(name)).. --search processlist for this.. if ceshare.processlist and ceshare.processlist[md5name] then.. local e={}.. e.pid=pid.. e.name=name.. e.md5=md5name.. table.insert(ceshare.currentprocesslist,e).. end.. end.. .. return ceshare.currentprocesslist..end....function ceshare.DownloadProcessList().. --Downloads the processlist .. local i=ceshare.getInternet().. local processlist=i.getURL(ceshare.base..'processlist.txt').. .. if processlist==nil then.. return.. end.. .. if processlist:sub(1,1)=='<' then.. return --it returned html code instead of a md5 list.. end.. .. local f=io.open(ceshare.path..[[processlist.txt]],'wb').. if f then.. f:write(processlist).. f:close().... synchronize(function() ceshare.settings.Value.LastProcessListDownload=os.time(

C:\Program Files\Cheat Engine 7.5\autorun\ceshare\is-VGUUS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6583
Entropy (8bit):	4.856845566130843
Encrypted:	false
SSDEEP:	192:2m3dOvyXANbHC7jmHmQr2LHymHG21h5rSTW/S4XHhOLOxInDLnrTH2n8ruHqhV4Z:2m3UvyW9mL/N5XYFCoKmo
MD5:	0B5180BD64689788EBEAA8E705A264AC
SHA1:	43A5CC401EE6C4FF4A94697112B1BC1D4345FC19
SHA-256:	8FD38A5E6C0408CA77E0E7A0EE179B4391758EC6DA94EA289E3A2CBC1AB1EC59
SHA-512:	CC26E2E36B93BF89AA16C744B2DB60D855DE616DB7A67F4FB24135545104459338C3EDEAB42BB316B1ECB0DB9E31970B1415A1BF638EA3E53AE31471330AEADB
Malicious:	false
Preview:	..function ceshare.login(username,password).. local i=ceshare.getInternet().. local parameters='';.. if username then.. parameters=parameters..'username='..ceshare.url_encode(username).. end .. .. if password then.. parameters=parameters..'&password='..ceshare.url_encode(password).. end.. .. local r=i.postURL(ceshare.base..'login.php',parameters).. if r then.. if (r:sub(1,2)=='<?') then.. local s=ceshare.xmlParser:ParseXmlText(r).. if s then.. if s.Valid then.. ceshare.LoggedIn=true.. return true .. else.. if s.error then.. ceshare.showError(s.error:value()).. end.. end.. else.. ceshare.showError(r).. end.. else.. ceshare.showError(r);.. end.. else.. ceshare.showError('Login system failure').. end..end....function ceshare.logout().. local i=ceshare.getInternet().. local parameters='';.. i.postURL(ceshare.base..'logout.php',parameters).. ceshare.Lo

C:\Program Files\Cheat Engine 7.5\autorun\dlls\32\CEJVMTI.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	50456
Entropy (8bit):	6.548128089503794
Encrypted:	false
SSDEEP:	768:+B4cf1fqCWPiiyDf+TTmhX2cnX3/OtC2MD0OK9BRbAlQ4z:El38CfKmhXv/Ott20OKvR
MD5:	B02FA5C8EEFBCD010AAAC97A94FF62BB
SHA1:	FD88F2FC529515252CBCAB507F322B080853C38B
SHA-256:	7BD0D77FD790215BB67337F9F210B05AAAB0193D105B8FF86EC422E9875EB033
SHA-512:	1D18CB2CFFBF83EF949C2A34FA28C4E011C623C62CE743C7F320DB1ACFBD41BEA2EA6D3F0D93A34874973FC43367D6562C630F8B7912B22BE7CCC61851001A18
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6Nf;W 5;W 5;W 5...5:W 5%..58W 5%..56W 5%..5?W 5%..5?W 5..58W 5;W!5.W 5%..5=W 5%..5:W 5%..5:W 5Rich;W 5........PE..L...T.sS...........!.........(.......................................................=....@......................... .......T...P...............................p... ...................................@............................................text...2........................... ..`.rdata..............................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\autorun\dlls\32\is-5VCS0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	50456
Entropy (8bit):	6.548128089503794
Encrypted:	false
SSDEEP:	768:+B4cf1fqCWPiiyDf+TTmhX2cnX3/OtC2MD0OK9BRbAlQ4z:El38CfKmhXv/Ott20OKvR
MD5:	B02FA5C8EEFBCD010AAAC97A94FF62BB
SHA1:	FD88F2FC529515252CBCAB507F322B080853C38B
SHA-256:	7BD0D77FD790215BB67337F9F210B05AAAB0193D105B8FF86EC422E9875EB033
SHA-512:	1D18CB2CFFBF83EF949C2A34FA28C4E011C623C62CE743C7F320DB1ACFBD41BEA2EA6D3F0D93A34874973FC43367D6562C630F8B7912B22BE7CCC61851001A18
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6Nf;W 5;W 5;W 5...5:W 5%..58W 5%..56W 5%..5?W 5%..5?W 5..58W 5;W!5.W 5%..5=W 5%..5:W 5%..5:W 5Rich;W 5........PE..L...T.sS...........!.........(.......................................................=....@......................... .......T...P...............................p... ...................................@............................................text...2........................... ..`.rdata..............................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\autorun\dlls\64\CEJVMTI.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	62232
Entropy (8bit):	6.014187026705995
Encrypted:	false
SSDEEP:	768:wm0hfdOrlHVzBkzORZN2UE0TjwNwqGN4cOlA/eQ4z:wNuVBaOohMFOlA/
MD5:	CEFC5C56720CA850CCB20FAF47733BD2
SHA1:	55F25CF4A7DE12607B085E8CFDBA0383F0207E9D
SHA-256:	F107DD69B4115864D289F364FAFC0E045FD3E9FC4BDE5586CE8C1BCF59CC65A7
SHA-512:	1B6FBA56FEAC4F4345B2F6CED82A3DDDACC3C0CB6F49C1D30105A8156B8DE851E34B9E31478C658C60D907C9F26237D2EFB7C2AB85ADB49905FDCCA6349A4DEE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.n.x...x...x......y...f...y...f...q...f...\|...f...\|......{...x...E...f...~...f...y...f...y...Richx...........................PE..d...I.sS.........." .........8...... ........................................ ............@.....................................................P...............................D... ................................................................................text...?........................... ..`.rdata...%.......&..................@..@.data...`...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\autorun\dlls\64\is-0JUIF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	62232
Entropy (8bit):	6.014187026705995
Encrypted:	false
SSDEEP:	768:wm0hfdOrlHVzBkzORZN2UE0TjwNwqGN4cOlA/eQ4z:wNuVBaOohMFOlA/
MD5:	CEFC5C56720CA850CCB20FAF47733BD2
SHA1:	55F25CF4A7DE12607B085E8CFDBA0383F0207E9D
SHA-256:	F107DD69B4115864D289F364FAFC0E045FD3E9FC4BDE5586CE8C1BCF59CC65A7
SHA-512:	1B6FBA56FEAC4F4345B2F6CED82A3DDDACC3C0CB6F49C1D30105A8156B8DE851E34B9E31478C658C60D907C9F26237D2EFB7C2AB85ADB49905FDCCA6349A4DEE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.n.x...x...x......y...f...y...f...q...f...\|...f...\|......{...x...E...f...~...f...y...f...y...Richx...........................PE..d...I.sS.........." .........8...... ........................................ ............@.....................................................P...............................D... ................................................................................text...?........................... ..`.rdata...%.......&..................@..@.data...`...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\autorun\dlls\DotNetInterface.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39840
Entropy (8bit):	7.158632953476479
Encrypted:	false
SSDEEP:	768:3N8So6jKJjZr25rm7V1VaXLkjYr25rm3V1VaXLkjn:3N8FaeF2m7P012m3P0A
MD5:	ED7867296697880928F297914D80F211
SHA1:	1CC9B65D8F94A04EA59B7511DF522FCB68C275E9
SHA-256:	3DC9EA4350E99E6216DA0840C53ED8CCCA39BA7DF7A4146B47AFFCAB128A4432
SHA-512:	044FDECCB4A46EDF37BBEF8E6CBB36AC586A2AA505B34F71977A2E404FFF088A60FF8277D0251B23C7F5D090A337B4CB5AF1FEA1A638B408EEC6F334BC416AD8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..(...........G... ...`....... ...............................?....@..................................G..O....`...............0...k...........F..8............................................ ............... ..H............text....'... ...(.................. ..`.rsrc........`.....................@..@.reloc..............................@..B.................G......H.......L1..............................................................R.{.....(......o........0..'.........#.....{.......o.....3....r...ps....zR.{.....(......o.....0............#.....{.......o....&..(....R.{.....(......o......0............#.....{.......o....&..(....R.{.....(......o......0............#.....{.......o....&..(.......0..&.......(.....o........i(.....{........io.......0..)........(.......#.....{.......o....&(.....o....*....0..R........(......(.....rG..p.

C:\Program Files\Cheat Engine 7.5\autorun\dlls\MonoDataCollector32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	417184
Entropy (8bit):	6.7644491521368
Encrypted:	false
SSDEEP:	12288:CLM9vziuDEVmqU2Im5/P1OhGKexP+gVuQ:lLiuDEV15/tVP+ouQ
MD5:	C5B870CE07DA5206D8A81E139920B7DC
SHA1:	F868450ED5F886F084C00345C75143C65FD9338E
SHA-256:	EB26B38A604CF98B95A39FD249C0771E351061A9894D22284CDFE984E8FC7A6C
SHA-512:	7DFB3E9940EC0D14B42C77483F71274701C46483E65EE57A0853A31F688CC5C3D0C0AF2050229BA196D9BEFF9813F259E3F92EEC9D8352CC0E416FEB4EB1A6BE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f.1t"o_'"o_'"o_'..'/o_'..'.o_'..'?o_'p.Z&.o_'p.[&.o_'p.\&4o_'+..'!o_'"o^'Go_'..V&'o_'.._&#o_'...'#o_'..]&#o_'Rich"o_'........................PE..L....".c...........!.....D..........T........`...............................0.......&....@.........................0...X.......(........................k.......>..0V..p............................V..@............`..l............................text....B.......D.................. ..`.rdata...N...`...P...H..............@..@.data....&..........................@....rsrc...............................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\autorun\dlls\MonoDataCollector64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	548768
Entropy (8bit):	6.397563059744258
Encrypted:	false
SSDEEP:	12288:7dShHq6xdR8zWUjwmoRb2qORTCKTJ7PYn:Z6xdqzWUjwmr8n
MD5:	4237719534B21BB179480ED8BB23C0CC
SHA1:	A1C8DB76137B6131B7B8FE379841CB3DF62F3B7D
SHA-256:	15EE5851FF1B33E369B43C66D44E3D1452A212C2A37F337B680FE8BD88DF8748
SHA-512:	4ACE9A2CA9BEAF64A3B097922300E6BF46729375CB4DFA4BC3D81B0420FF28CD45C2CFDB9C05E4885DDD39CB6BF160D932BE4711C219302D684D23AFEADB4F72
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...P...P...P..n.S..P..n.Q.YP..n.P..P..D.e..P...8...P...8...P...8...P...(1..P...P...P..I9...P..I9...P..I9]..P..I9...P..Rich.P..................PE..d....".c.........." .....X...................................................P............`.............................................X...h...(.... ..........h:.......k...0..........p...........................p................p...............................text....W.......X.................. ..`.rdata...)...p...*...\..............@..@.data...H7..........................@....pdata..h:.......<..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\autorun\dlls\dnd.dat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 64 kbps, 44.1 kHz, Stereo
Category:	dropped
Size (bytes):	54895
Entropy (8bit):	7.768231173906507
Encrypted:	false
SSDEEP:	1536:TEzw27ZEqFXUUj2CGLHfwa8OMerCYvLKtO0iEaF:TEzw27LFXXqBHfwa8OsZC
MD5:	C07B2CE2256D4DDE62F92CB684E23C02
SHA1:	1D1A234A9C1BDE7DC32867BEB8197A4BD8C6802B
SHA-256:	3F7948BFADE1F6A4F744580FB825330FB85668CD645CD6EE9F5915742584E932
SHA-512:	E0DEE259BCCF78D8EA64A2C0B7136FE5BC749564E9574DAD496AEEC6BC0DEF460A1CB2D5E63DA7CB62E6A2C31D497A8FF355305C58AA4A4BF9F9EE0C07636273
Malicious:	false
Preview:	ID3.......TXXX.......major_brand.isom.TXXX.......minor_version.512.TXXX... ...compatible_brands.isomiso2mp41.TSSE.......Lavf58.45.100.............P.................................Info.......\................."$',/2479<>ACEHJMPSUXZ]_bdgilnqtvy\|~......................................................Lavc58.91............$...........X....................0d....1...-.... ...... .....4.....`.1. x&1...O..~.B....0...N./..A....~...]k.ZD.B.E.`........=.n..3..)g.I.@.(..P!.....?5./\|>.....!{.fGj*L'c............V..2d#...1...j.... ...... .....@.....B........?...%2....<...`,..5..s.>a..hU..A2....d\.......#..(6.?/../.}+.......bn........>..S...`.7r.$..`......S.....E...2DA...1!..n .F$A.-..X.@..@J.....HO....c... .1..@....]..Wk3....0.."...~...w..%.n.i.;................O.s......_..}....zldY...5..............rd.7=0 ....2DY...1 ..n .&$1.-..H.. .J..... ......(....A.. .$..2j'`.0...i.B" ,..:{..h0..92.df. ......94...."...Wt........'.^..o.6.X.&..8.X~!.aX.G..nUy...q....q,.e.(.'..0D]...3C..6.B.(X..L

C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-397QA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	417184
Entropy (8bit):	6.7644491521368
Encrypted:	false
SSDEEP:	12288:CLM9vziuDEVmqU2Im5/P1OhGKexP+gVuQ:lLiuDEV15/tVP+ouQ
MD5:	C5B870CE07DA5206D8A81E139920B7DC
SHA1:	F868450ED5F886F084C00345C75143C65FD9338E
SHA-256:	EB26B38A604CF98B95A39FD249C0771E351061A9894D22284CDFE984E8FC7A6C
SHA-512:	7DFB3E9940EC0D14B42C77483F71274701C46483E65EE57A0853A31F688CC5C3D0C0AF2050229BA196D9BEFF9813F259E3F92EEC9D8352CC0E416FEB4EB1A6BE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f.1t"o_'"o_'"o_'..'/o_'..'.o_'..'?o_'p.Z&.o_'p.[&.o_'p.\&4o_'+..'!o_'"o^'Go_'..V&'o_'.._&#o_'...'#o_'..]&#o_'Rich"o_'........................PE..L....".c...........!.....D..........T........`...............................0.......&....@.........................0...X.......(........................k.......>..0V..p............................V..@............`..l............................text....B.......D.................. ..`.rdata...N...`...P...H..............@..@.data....&..........................@....rsrc...............................@..@.reloc...>.......@..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-B180O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 64 kbps, 44.1 kHz, Stereo
Category:	dropped
Size (bytes):	54895
Entropy (8bit):	7.768231173906507
Encrypted:	false
SSDEEP:	1536:TEzw27ZEqFXUUj2CGLHfwa8OMerCYvLKtO0iEaF:TEzw27LFXXqBHfwa8OsZC
MD5:	C07B2CE2256D4DDE62F92CB684E23C02
SHA1:	1D1A234A9C1BDE7DC32867BEB8197A4BD8C6802B
SHA-256:	3F7948BFADE1F6A4F744580FB825330FB85668CD645CD6EE9F5915742584E932
SHA-512:	E0DEE259BCCF78D8EA64A2C0B7136FE5BC749564E9574DAD496AEEC6BC0DEF460A1CB2D5E63DA7CB62E6A2C31D497A8FF355305C58AA4A4BF9F9EE0C07636273
Malicious:	false
Preview:	ID3.......TXXX.......major_brand.isom.TXXX.......minor_version.512.TXXX... ...compatible_brands.isomiso2mp41.TSSE.......Lavf58.45.100.............P.................................Info.......\................."$',/2479<>ACEHJMPSUXZ]_bdgilnqtvy\|~......................................................Lavc58.91............$...........X....................0d....1...-.... ...... .....4.....`.1. x&1...O..~.B....0...N./..A....~...]k.ZD.B.E.`........=.n..3..)g.I.@.(..P!.....?5./\|>.....!{.fGj*L'c............V..2d#...1...j.... ...... .....@.....B........?...%2....<...`,..5..s.>a..hU..A2....d\.......#..(6.?/../.}+.......bn........>..S...`.7r.$..`......S.....E...2DA...1!..n .F$A.-..X.@..@J.....HO....c... .1..@....]..Wk3....0.."...~...w..%.n.i.;................O.s......_..}....zldY...5..............rd.7=0 ....2DY...1 ..n .&$1.-..H.. .J..... ......(....A.. .$..2j'`.0...i.B" ,..:{..h0..92.df. ......94...."...Wt........'.^..o.6.X.&..8.X~!.aX.G..nUy...q....q,.e.(.'..0D]...3C..6.B.(X..L

C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-BGU0I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	548768
Entropy (8bit):	6.397563059744258
Encrypted:	false
SSDEEP:	12288:7dShHq6xdR8zWUjwmoRb2qORTCKTJ7PYn:Z6xdqzWUjwmr8n
MD5:	4237719534B21BB179480ED8BB23C0CC
SHA1:	A1C8DB76137B6131B7B8FE379841CB3DF62F3B7D
SHA-256:	15EE5851FF1B33E369B43C66D44E3D1452A212C2A37F337B680FE8BD88DF8748
SHA-512:	4ACE9A2CA9BEAF64A3B097922300E6BF46729375CB4DFA4BC3D81B0420FF28CD45C2CFDB9C05E4885DDD39CB6BF160D932BE4711C219302D684D23AFEADB4F72
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...P...P...P..n.S..P..n.Q.YP..n.P..P..D.e..P...8...P...8...P...8...P...(1..P...P...P..I9...P..I9...P..I9]..P..I9...P..Rich.P..................PE..d....".c.........." .....X...................................................P............`.............................................X...h...(.... ..........h:.......k...0..........p...........................p................p...............................text....W.......X.................. ..`.rdata...)...p...*...\..............@..@.data...H7..........................@....pdata..h:.......<..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\autorun\dlls\is-UD451.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39840
Entropy (8bit):	7.158632953476479
Encrypted:	false
SSDEEP:	768:3N8So6jKJjZr25rm7V1VaXLkjYr25rm3V1VaXLkjn:3N8FaeF2m7P012m3P0A
MD5:	ED7867296697880928F297914D80F211
SHA1:	1CC9B65D8F94A04EA59B7511DF522FCB68C275E9
SHA-256:	3DC9EA4350E99E6216DA0840C53ED8CCCA39BA7DF7A4146B47AFFCAB128A4432
SHA-512:	044FDECCB4A46EDF37BBEF8E6CBB36AC586A2AA505B34F71977A2E404FFF088A60FF8277D0251B23C7F5D090A337B4CB5AF1FEA1A638B408EEC6F334BC416AD8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..(...........G... ...`....... ...............................?....@..................................G..O....`...............0...k...........F..8............................................ ............... ..H............text....'... ...(.................. ..`.rsrc........`.....................@..@.reloc..............................@..B.................G......H.......L1..............................................................R.{.....(......o........0..'.........#.....{.......o.....3....r...ps....zR.{.....(......o.....0............#.....{.......o....&..(....R.{.....(......o......0............#.....{.......o....&..(....R.{.....(......o......0............#.....{.......o....&..(.......0..&.......(.....o........i(.....{........io.......0..)........(.......#.....{.......o....&(.....o....*....0..R........(......(.....rG..p.

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Common\Pipe.cpp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	5.315181220757938
Encrypted:	false
SSDEEP:	24:Z4mZHEKQU5rJeoOIqGSAARYqdVpPaKQ673pD56aLFs6cG4YUXC/ArOdt2qFjQ02y:h5DO/GsnxHsnG7U0ArytNjQMf8W
MD5:	9F6258B7C0FAFDE9B1D0ED44FFEA7070
SHA1:	FDBF716E6FD03BB3D2671F854A997EA46EFAE26F
SHA-256:	D020D9CF2563F8B6021593FA604E9CFBE54BCB8B7361CCDBC220E543A6995045
SHA-512:	DD00A5F40CAA128CCAED782E6ABA697DBD24CA194F051EF1FA542B3ACAAA618E08C822ECEC45EAC4A37FB29C889DC4DF5BB99CA6F328F010C4F4931D88A3EE7B
Malicious:	false
Preview:	....#ifdef _WINDOWS..#include <Windows.h>..#else..#include "macport.h"....#define ReadFile ReadFilePipeWrapper..#define WriteFile WriteFilePipeWrapper..#endif....#include "Pipe.h"....//superclass to make pipe handling easier to work with....Pipe::Pipe(void)..{...pipehandle=0;...InitializeCriticalSection(&cs);..}....Pipe::~Pipe(void)..{...//check if someone forgot to clean it up...if ((pipehandle!=0) && (pipehandle!=INVALID_HANDLE_VALUE))...{..#ifdef _WINDOWS....CloseHandle(pipehandle);..#else.. ClosePipe(pipehandle);..#endif....pipehandle=0;...}..... ..}....void Pipe::Lock(void)..{...EnterCriticalSection(&cs);..}....void Pipe::Unlock(void)..{...LeaveCriticalSection(&cs);..}....void Pipe::Read(PVOID buf, unsigned int count)..{...DWORD br;...if (count==0) return;...if (ReadFile(pipehandle, buf, count, &br, NULL)==FALSE)....throw("Read Error");..}....void Pipe::Write(PVOID buf, unsigned int count)..{...DWORD bw;...if (count==0) return;...if (WriteFile(pipehandle, buf, count, &bw

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Common\Pipe.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	507
Entropy (8bit):	5.260462788158599
Encrypted:	false
SSDEEP:	12:lb1HAq75T1m1une2Vevm7vmp3jmuWjs5rCTLz:lVBYUwmTmp3jmuWjsaz
MD5:	956C9C67FE3FA489547C1767AFB50EC4
SHA1:	BC76C3E7DF811B582EE153C43B986C8ED107E72A
SHA-256:	65DF81AA1A72667285733FF7515632D7C003B2C21B37D623FC3F6663738137C0
SHA-512:	3FD906CB79B534FC63336005A605EE092FB8B028AD660882C3324F72D794CB1198C13FC23390B1FA1E0E895C1963F293B3411EC4599D67A5B8B8FDFD77840200
Malicious:	false
Preview:	#pragma once....#ifndef _WINDOWS..#include "macport.h"..#endif....class Pipe..{..private:.. CRITICAL_SECTION cs;..protected:...HANDLE pipehandle;..public:...void Read(PVOID buf, unsigned int count);...void Write(PVOID buf, unsigned int count);...BYTE ReadByte();...WORD ReadWord();...DWORD ReadDword();...UINT64 ReadQword();...void WriteByte(BYTE b);...void WriteWord(WORD b);...void WriteDword(DWORD b);...void WriteQword(UINT64 b);.....void Lock();...void Unlock();.....Pipe(void);...~Pipe(void);..};..

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Common\is-06D9S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	507
Entropy (8bit):	5.260462788158599
Encrypted:	false
SSDEEP:	12:lb1HAq75T1m1une2Vevm7vmp3jmuWjs5rCTLz:lVBYUwmTmp3jmuWjsaz
MD5:	956C9C67FE3FA489547C1767AFB50EC4
SHA1:	BC76C3E7DF811B582EE153C43B986C8ED107E72A
SHA-256:	65DF81AA1A72667285733FF7515632D7C003B2C21B37D623FC3F6663738137C0
SHA-512:	3FD906CB79B534FC63336005A605EE092FB8B028AD660882C3324F72D794CB1198C13FC23390B1FA1E0E895C1963F293B3411EC4599D67A5B8B8FDFD77840200
Malicious:	false
Preview:	#pragma once....#ifndef _WINDOWS..#include "macport.h"..#endif....class Pipe..{..private:.. CRITICAL_SECTION cs;..protected:...HANDLE pipehandle;..public:...void Read(PVOID buf, unsigned int count);...void Write(PVOID buf, unsigned int count);...BYTE ReadByte();...WORD ReadWord();...DWORD ReadDword();...UINT64 ReadQword();...void WriteByte(BYTE b);...void WriteWord(WORD b);...void WriteDword(DWORD b);...void WriteQword(UINT64 b);.....void Lock();...void Unlock();.....Pipe(void);...~Pipe(void);..};..

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Common\is-HB4M8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	5.315181220757938
Encrypted:	false
SSDEEP:	24:Z4mZHEKQU5rJeoOIqGSAARYqdVpPaKQ673pD56aLFs6cG4YUXC/ArOdt2qFjQ02y:h5DO/GsnxHsnG7U0ArytNjQMf8W
MD5:	9F6258B7C0FAFDE9B1D0ED44FFEA7070
SHA1:	FDBF716E6FD03BB3D2671F854A997EA46EFAE26F
SHA-256:	D020D9CF2563F8B6021593FA604E9CFBE54BCB8B7361CCDBC220E543A6995045
SHA-512:	DD00A5F40CAA128CCAED782E6ABA697DBD24CA194F051EF1FA542B3ACAAA618E08C822ECEC45EAC4A37FB29C889DC4DF5BB99CA6F328F010C4F4931D88A3EE7B
Malicious:	false
Preview:	....#ifdef _WINDOWS..#include <Windows.h>..#else..#include "macport.h"....#define ReadFile ReadFilePipeWrapper..#define WriteFile WriteFilePipeWrapper..#endif....#include "Pipe.h"....//superclass to make pipe handling easier to work with....Pipe::Pipe(void)..{...pipehandle=0;...InitializeCriticalSection(&cs);..}....Pipe::~Pipe(void)..{...//check if someone forgot to clean it up...if ((pipehandle!=0) && (pipehandle!=INVALID_HANDLE_VALUE))...{..#ifdef _WINDOWS....CloseHandle(pipehandle);..#else.. ClosePipe(pipehandle);..#endif....pipehandle=0;...}..... ..}....void Pipe::Lock(void)..{...EnterCriticalSection(&cs);..}....void Pipe::Unlock(void)..{...LeaveCriticalSection(&cs);..}....void Pipe::Read(PVOID buf, unsigned int count)..{...DWORD br;...if (count==0) return;...if (ReadFile(pipehandle, buf, count, &br, NULL)==FALSE)....throw("Read Error");..}....void Pipe::Write(PVOID buf, unsigned int count)..{...DWORD bw;...if (count==0) return;...if (WriteFile(pipehandle, buf, count, &bw

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI.sln (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1241
Entropy (8bit):	5.56652814239152
Encrypted:	false
SSDEEP:	24:pPE7K71jtSk8H5IkT6GkTxkBZkm2kp6ckt8Ik/Tkk88W:pPAe1jtTeYQtYZ
MD5:	D602509D20C721D185D08DDFAB72EFD8
SHA1:	A7006EDA0FC346223377188F4941B39BE925E355
SHA-256:	F51DCDB8A36F5784994125E8F3451EA91A710FC844751319E839B448802E7A13
SHA-512:	02D79C2A4C1A175C38E35E08465B4C915FF2F185A10208F36C31B707AAE4E38BDB8E0F04F6DEE231622973ACBE12AD3A0B76EDFFBB69979337833C7E94A36108
Malicious:	false
Preview:	...Microsoft Visual Studio Solution File, Format Version 10.00..# Visual Studio 2008..Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "CEJVMTI", "CEJVMTI\CEJVMTI.vcproj", "{3C30A633-6797-4D59-936F-9A2A8CE79B25}"..EndProject..Global...GlobalSection(SolutionConfigurationPlatforms) = preSolution....Debug\|Win32 = Debug\|Win32....Debug\|x64 = Debug\|x64....Release\|Win32 = Release\|Win32....Release\|x64 = Release\|x64...EndGlobalSection...GlobalSection(ProjectConfigurationPlatforms) = postSolution....{3C30A633-6797-4D59-936F-9A2A8CE79B25}.Debug\|Win32.ActiveCfg = Debug\|Win32....{3C30A633-6797-4D59-936F-9A2A8CE79B25}.Debug\|Win32.Build.0 = Debug\|Win32....{3C30A633-6797-4D59-936F-9A2A8CE79B25}.Debug\|x64.ActiveCfg = Debug\|x64....{3C30A633-6797-4D59-936F-9A2A8CE79B25}.Debug\|x64.Build.0 = Debug\|x64....{3C30A633-6797-4D59-936F-9A2A8CE79B25}.Release\|Win32.ActiveCfg = Release\|Win32....{3C30A633-6797-4D59-936F-9A2A8CE79B25}.Release\|Win32.Build.0 = Release\|Win32....{3C30A633-6797-4D59-936F-9A2A8CE79B25}

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\CEJVMTI.cpp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4789
Entropy (8bit):	5.316244410627971
Encrypted:	false
SSDEEP:	48:7VupFugSq0HelONyzkBB9SFMJt9Knqk1Nd4Gl5CRTjwn67xahZ9X7s1uvQ8zVYWO:UFupqXdkEFWsnqUNd4GX/6GFo2Y
MD5:	021AA48BED78C67E3A7969BE8BC0BB5B
SHA1:	CCA95A2D7D82ED610245D3AE88DD19C339C402AC
SHA-256:	C9EF523D9ABCAC32BC86CC5E316C03749B64EC4BCE0343289C05E9366639696D
SHA-512:	D3E10547D368D50863CC781E1831C5FA6264FAA9CC64AF6114E7F4E21D361849BBEE0784F0D653BC824079E43BDD8AE8D02B5574520497B07E0022CBAAEF3C32
Malicious:	false
Preview:	// CEJVMTI.cpp : Defines the exported functions for the DLL application...//....#include "stdafx.h"..#include "CEJVMTI.h"..#include "JavaServer.h"..#include "JavaEventServer.h"....void JNICALL AgentThread(jvmtiEnv* jvmti_env, JNIEnv* jni_env, void* arg)..{...CJavaServer s=new CJavaServer(jvmti_env, jni_env);.....s->Start();.....delete s;...OutputDebugStringA("Still alive");....}........jvmtiIterationControl JNICALL initialHeapIterate(jlong class_tag, jlong size, jlong tag_ptr, void* user_data)..{...//OutputDebugStringA("Tagging object\n");...tag_ptr=1;...return JVMTI_ITERATION_CONTINUE;..}....int LaunchServer(jvmtiEnv env, JNIEnv *jni)..{...jclass threadclass=jni->FindClass("java/lang/Thread");...if (threadclass==0)...{....OutputDebugStringA("jni->FindClass(\"java/lang/Thread\") failure");....return 0;...}.....jmethodID threadinit=jni->GetMethodID(threadclass, "<init>", "()V");...if (threadinit==0)...{....OutputDebugStringA("jni->GetMethodID failure");....return 0;...}..........//e

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\CEJVMTI.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	836
Entropy (8bit):	5.079968529942336
Encrypted:	false
SSDEEP:	24:CwCaxHbe4JGywvVwOPGkTAIbDNzHOqMfsqM98DU+V6E:vxHbe4kywBGkTAIfNzHOqMUqM98wc6E
MD5:	20AF26E2AB559DDC6CA1929834DA003E
SHA1:	7AE93554FBCEC9851F68F16A2EAED9C3F299CE5F
SHA-256:	18C5FB7CB71EB7B2D1835CE44B24E09213AA885C1407E4E2401FBD2D74970D8E
SHA-512:	B9FF67E715E0489D761424266EDA7049F40FE38E0EE4F595B1D4B43E6E9F829074827DC4EBBF9FF368BE02A90A9343117930C88ED5FBB8E3D8EEBDA43A857D90
Malicious:	false
Preview:	// The following ifdef block is the standard way of creating macros which make exporting ..// from a DLL simpler. All files within this DLL are compiled with the CEJVMTI_EXPORTS..// symbol defined on the command line. this symbol should not be defined on any project..// that uses this DLL. This way any other project whose source files include this file see ..// CEJVMTI_API functions as being imported from a DLL, whereas this DLL sees symbols..// defined with this macro as being exported...#ifdef CEJVMTI_EXPORTS..#define CEJVMTI_API __declspec(dllexport)..#else..#define CEJVMTI_API __declspec(dllimport)..#endif....// This class is exported from the CEJVMTI.dll..class CEJVMTI_API CCEJVMTI {..public:...CCEJVMTI(void);...// TODO: add your methods here...};....extern CEJVMTI_API int nCEJVMTI;....CEJVMTI_API int fnCEJVMTI(void);..

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\CEJVMTI.vcproj (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10039
Entropy (8bit):	5.118940053099404
Encrypted:	false
SSDEEP:	192:VnzWGB2Afbh77fByk+f8bi4n4w4RciFnFwFRyIF:RWGdfbhfB+f8bi4n4w4RciFnFwFRFF
MD5:	9EE34D72F0C9E158FCEBB31CD8878D6C
SHA1:	3F06D5E6E886961AF80FA823E2D52CE5CD0B84D8
SHA-256:	CAFE34E86117A15C4E0B40F12BCBB79CB6EF8F0AB8ED10DEF567357AB11637CD
SHA-512:	FB41AF029142289DE950BA7BC1512A586E9C9E2414F46BB755936637978D40ECA5D8E671369BE61ACD38E841BCD11C264E2DE55FBC087E91B4A7529FFE91A55B
Malicious:	false
Preview:	<?xml version="1.0" encoding="Windows-1252"?>..<VisualStudioProject...ProjectType="Visual C++"...Version="9.00"...Name="CEJVMTI"...ProjectGUID="{3C30A633-6797-4D59-936F-9A2A8CE79B25}"...RootNamespace="CEJVMTI"...Keyword="Win32Proj"...TargetFrameworkVersion="196613"...>...<Platforms>....<Platform.....Name="Win32"..../>....<Platform.....Name="x64"..../>...</Platforms>...<ToolFiles>...</ToolFiles>...<Configurations>....<Configuration.....Name="Debug\|Win32".....OutputDirectory="..\..\..\bin\autorun\dlls".....IntermediateDirectory="$(ConfigurationName)".....ConfigurationType="2".....CharacterSet="1".....>.....<Tool......Name="VCPreBuildEventTool"...../>.....<Tool......Name="VCCustomBuildTool"...../>.....<Tool......Name="VCXMLDataGeneratorTool"...../>.....<Tool......Name="VCWebServiceProxyGeneratorTool"...../>.....<Tool......Name="VCMIDLTool"...../>.....<Tool......Name="VCCLCompilerTool"......Optimization="0"......AdditionalIncludeDirectories="E:\source\openjdk\jdk\src\share\javavm\export;E:

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\JavaEventServer.cpp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9131
Entropy (8bit):	5.432032141224608
Encrypted:	false
SSDEEP:	192:reWH42e/J83LkXasXVHMFyWH9MWUnsUeTxtbPYN9:C42RA4VL/RV
MD5:	59529578CDE1AE578ABCAAA331AA4FBA
SHA1:	33AB98509ED784580A259D1B310827C50B842F50
SHA-256:	E3795C3B94C84491A368C78FCBC4076BFADCA038AFE74DA2FA7FAB7415945658
SHA-512:	ACBD3884642E466D29FBE6D6A7337CCBAEC55147EA735098F9E463C6875B52B255480745847C3EFABCBAC72F9B72DD45CF259880A8D4700AFB68C3C07AC747BE
Malicious:	false
Preview:	#include "StdAfx.h"..#include "JavaEventServer.h"......CJavaEventServer old_eventserver=NULL;..CJavaEventServer eventserver=NULL;....jvmtiEventCallbacks callbacks;......void JNICALL MethodLoad(jvmtiEnv jvmti_env, jmethodID method, jint code_size, const void code_addr, jint map_length, ..........const jvmtiAddrLocationMap* map, const void* compile_info)..{...if (eventserver)....eventserver->MethodLoad(jvmti_env, method, code_size, code_addr);....}....void JNICALL MethodUnload(jvmtiEnv jvmti_env, jmethodID method, const void code_addr)..{...if (eventserver)....eventserver->MethodUnload(jvmti_env, method, code_addr);..}....void JNICALL DynamicCodeGenerated(jvmtiEnv jvmti_env, const char name, const void* address, jint length)..{...if (eventserver)....eventserver->DynamicCodeGenerated(jvmti_env, name, address,length);..}....void JNICALL FieldModification(jvmtiEnv jvmti_env, JNIEnv jni_env, jthread thread, jmethodID method, jlocation location, jclass field_klass, jobject object, j

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\JavaEventServer.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1440
Entropy (8bit):	5.2417448709416385
Encrypted:	false
SSDEEP:	24:l+LADzcCjadu1txScPArZXOuAR5qLtmWltXUC/sf4ADSt9:Ra2Sco9XOuAaplUC/sfy
MD5:	94DE75F30ECA367499F6C3CA7905048C
SHA1:	26B550FAC776E0647ECEB2B246086D07DBB1F12B
SHA-256:	289AF20BDC7D004491E224531CE0C267D251AEF5EBAD5F3FED1AF750679F26C9
SHA-512:	4A822471535DCEA02B5DD73CDE60C3965910F5187E0D7E1F1691E0483921DEE6C2B13E9BC3D1EC952186BCCAD6D05E79266C77BBF8060329C71715D3DA9B4496
Malicious:	false
Preview:	#pragma once..#include "pipe.h"....//pipe for transmitting java events like method load/free....#define EVENTCMD_METHODLOAD 0..#define EVENTCMD_METHODUNLOAD 1..#define EVENTCMD_DYNAMICCODEGENERATED 2..#define EVENTCMD_FIELDMODIFICATION 3..#define EVENTCMD_TERMINATED 255....using namespace std;....typedef struct..{...jfieldID fieldid;...jclass klass;...jobject object;..} FindWhatWritesEntry, PFindWhatWritesEntry;....class CJavaEventServer :...public Pipe..{..private:...wchar_t pipename[256];...jvmtiEnv jvmti_env;...vector<PFindWhatWritesEntry> FindWhatWritesList;....public:...CJavaEventServer(jvmtiEnv jvmti_env);...~CJavaEventServer(void);.....void MethodLoad(jvmtiEnv jvmti_env, jmethodID method, jint code_size, const void* code_addr);...void MethodUnload(jvmtiEnv jvmti_env, jmethodID method, const void code_addr);...void DynamicCodeGenerated(jvmtiEnv jvmti_env, const char name, const void* address, jint length);...void FieldModification(jvmtiEnv jvmti_env, JNIEnv jni_env, jth

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\JavaServer.cpp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42621
Entropy (8bit):	5.318768758669348
Encrypted:	false
SSDEEP:	384:Qw5oITw/RTdMaf2lBpn/Z2jc/AKJlXCR5A6Qw/iNufJiTTvMm5ETln6H:V1TwU7BJRCZQw/iNuBiTTvMvl6H
MD5:	AFABA48AD9AFA999503CCAAC45DF0710
SHA1:	45FEF1F5289CB3FD353F43EFD13ECE034803C9CD
SHA-256:	E02208CA6EBED1999D9761CC865CE98EABA28966DC32F40B5789733E52783BF9
SHA-512:	66B995A75C6F90177BCE4DCC93783B1409D20B8FF1C318B79B8DD7C8FE6A1DEE2F0AB906F30C5390D1C7B043D4E99717BF6FBC267318932D066721294C663552
Malicious:	false
Preview:	#include "StdAfx.h"..#include "JavaServer.h"....using namespace std;....int serverid=0;..int tagcount=0;....CJavaServer::CJavaServer(jvmtiEnv* jvmti_env, JNIEnv* jni_env)..{...//create a named pipe...jvmtiCapabilities cap;.......this->jni=jni_env;...this->jvmti=jvmti_env;.......jvmti->GetCapabilities(&cap);.....if (serverid==0)....swprintf(pipename, 256,L"\\\\.\\pipe\\cejavadc_pid%d", GetCurrentProcessId());...else....swprintf(pipename, 256,L"\\\\.\\pipe\\cejavadc_pid%d_%d", GetCurrentProcessId(),serverid);.......serverid++;..}....void CJavaServer::CreatePipeandWaitForconnect(void)..{....if ((pipehandle) && (pipehandle!=INVALID_HANDLE_VALUE))...{....CloseHandle(pipehandle);....pipehandle=0;...}.....pipehandle=CreateNamedPipe(pipename, PIPE_ACCESS_DUPLEX, PIPE_TYPE_BYTE \| PIPE_READMODE_BYTE \| PIPE_WAIT, 1,256*1024, 16, INFINITE, NULL);...ConnectNamedPipe(pipehandle, NULL);..}....CJavaServer::~CJavaServer(void)..{....}....void CJavaServer::StartCodeCallbacks(void)..{...if (old_eventserve

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\JavaServer.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2957
Entropy (8bit):	5.440878996694979
Encrypted:	false
SSDEEP:	48:ayZG0XyeJljj2/1lXdYTpCvLYsdiLYQFtbfmtTZzlLj:FG0XyeJp41ld8CTYFYQFF0
MD5:	8A6C5C03E9FEF26236D765C96CA20085
SHA1:	01C3F3D91B2EB573E0C92BB7B2F656A42A31FB1D
SHA-256:	962F6BA49567FD76AD41C87A10763249C320294A5C971B089E935B864E824AD3
SHA-512:	031FA1505CC5345144247B25A6791A265EFCD05ECEDAB5421215DFD6F30F64E6677EA5B23DF2BCE0118DC865C5C3AA67B704338BE9693663B8C1E26CF27A19C0
Malicious:	false
Preview:	#pragma once....#include "JavaEventServer.h"....#define JAVACMD_STARTCODECALLBACKS 0..#define JAVACMD_STOPCODECALLBACKS 1..#define JAVACMD_GETLOADEDCLASSES 2..#define JAVACMD_DEREFERENCELOCALOBJECT 3..#define JAVACMD_GETCLASSMETHODS 4..#define JAVACMD_GETCLASSFIELDS 5..#define JAVACMD_GETIMPLEMENTEDINTERFACES 6..#define JAVAVMD_FINDREFERENCESTOOBJECT 7..#define JAVACMD_FINDJOBJECT 8..#define JAVACMD_GETCLASSSIGNATURE 9..#define JAVACMD_GETSUPERCLASS 10..#define JAVACMD_GETOBJECTCLASS 11..#define JAVACMD_GETCLASSDATA 12..#define JAVACMD_REDEFINECLASS 13..#define JAVACMD_FINDCLASS 14..#define JAVACMD_GETCAPABILITIES 15..#define JAVACMD_GETMETHODNAME 16..#define JAVACMD_INVOKEMETHOD 17..#define JAVACMD_FINDCLASSOBJECTS 18..#define JAVACMD_ADDTOBOOTSTRAPCLASSLOADERPATH 19..#define JAVACMD_ADDTOSYSTEMCLASSLOADERPATH 20..#define JAVACMD_PUSHLOCALFRAME 21..#define JAVACMD_POPLOCALFRAME 22..#define JAVACMD_GETFIELDDECLARINGCLASS 23..#define JAVACMD_GETFIELDSIGNATURE 24..#define JAVACMD_GETFIEL

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\dllmain.cpp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	410
Entropy (8bit):	5.041995140928715
Encrypted:	false
SSDEEP:	12:j/ltWmmylAoQw/UkKTQRWDKSRROaAOaWZKSR7Mjoa:rWy7VU9aWGM3wWQMcoa
MD5:	66EFA1B79D7AEF68DFA369074ABC9CAA
SHA1:	67C347B1F2F8712B0CABB60E7E111CA1B3171F38
SHA-256:	542E67D6247001859B6BB38C2AA085F5446371EB2F2385546E12D0BF275DE503
SHA-512:	09DFBE5F7D95BBA3D4B9107C872F8690F6A714888B3146CA3E1468E41588D872EEE68AE8C4CC96B85B73B6F96F450C1D20496D9401BC94932D6F357EE42A225E
Malicious:	false
Preview:	// dllmain.cpp : Defines the entry point for the DLL application...#include "stdafx.h"....BOOL APIENTRY DllMain( HMODULE hModule,.. DWORD ul_reason_for_call,.. LPVOID lpReserved....... )..{...switch (ul_reason_for_call)...{...case DLL_PROCESS_ATTACH:...case DLL_THREAD_ATTACH:...case DLL_THREAD_DETACH:...case DLL_PROCESS_DETACH:....break;...}...return TRUE;..}....

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-0AS3A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	542
Entropy (8bit):	4.851662037036262
Encrypted:	false
SSDEEP:	12:jG0/fS4gZS4pSypyZbRAo9DGmreL5GAxA0jAiVvAihASAGjAz6cMqpcP6v:Fnapa9NBm5Gk/jfv3LBj9cMqpcs
MD5:	3718862895EA61A1A87FEB925092F535
SHA1:	7733DE8657B606A4BF18B844DEA6C500642EF964
SHA-256:	2FD0179BA87126CC35FB41D63FBEBBFBA185414960720B0A3DA652EC3B1AF641
SHA-512:	9357D5C4125F7CE8D2D31A72CFF04BA357565F69E0ED099076572C4E48B2A9E34C077D7462EBABC371952E6F9F48AAC17A1EFEE682573B49F7A7CF9752A41584
Malicious:	false
Preview:	// stdafx.h : include file for standard system include files,..// or project specific include files that are used frequently, but..// are changed infrequently..//....#pragma once....#include "targetver.h"....#define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers..// Windows Header Files:..#include <windows.h>..#include <jvmti.h>..#include <classfile_constants.h>..#include <pipe.h>..#include <map>..#include <list>..#include <vector>......// TODO: reference additional headers your program requires here..

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-0OQDO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4789
Entropy (8bit):	5.316244410627971
Encrypted:	false
SSDEEP:	48:7VupFugSq0HelONyzkBB9SFMJt9Knqk1Nd4Gl5CRTjwn67xahZ9X7s1uvQ8zVYWO:UFupqXdkEFWsnqUNd4GX/6GFo2Y
MD5:	021AA48BED78C67E3A7969BE8BC0BB5B
SHA1:	CCA95A2D7D82ED610245D3AE88DD19C339C402AC
SHA-256:	C9EF523D9ABCAC32BC86CC5E316C03749B64EC4BCE0343289C05E9366639696D
SHA-512:	D3E10547D368D50863CC781E1831C5FA6264FAA9CC64AF6114E7F4E21D361849BBEE0784F0D653BC824079E43BDD8AE8D02B5574520497B07E0022CBAAEF3C32
Malicious:	false
Preview:	// CEJVMTI.cpp : Defines the exported functions for the DLL application...//....#include "stdafx.h"..#include "CEJVMTI.h"..#include "JavaServer.h"..#include "JavaEventServer.h"....void JNICALL AgentThread(jvmtiEnv* jvmti_env, JNIEnv* jni_env, void* arg)..{...CJavaServer s=new CJavaServer(jvmti_env, jni_env);.....s->Start();.....delete s;...OutputDebugStringA("Still alive");....}........jvmtiIterationControl JNICALL initialHeapIterate(jlong class_tag, jlong size, jlong tag_ptr, void* user_data)..{...//OutputDebugStringA("Tagging object\n");...tag_ptr=1;...return JVMTI_ITERATION_CONTINUE;..}....int LaunchServer(jvmtiEnv env, JNIEnv *jni)..{...jclass threadclass=jni->FindClass("java/lang/Thread");...if (threadclass==0)...{....OutputDebugStringA("jni->FindClass(\"java/lang/Thread\") failure");....return 0;...}.....jmethodID threadinit=jni->GetMethodID(threadclass, "<init>", "()V");...if (threadinit==0)...{....OutputDebugStringA("jni->GetMethodID failure");....return 0;...}..........//e

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-5SV36.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	294
Entropy (8bit):	4.740307510696171
Encrypted:	false
SSDEEP:	6:jGmyXH+5AMRNT15eAbyRFm+yll+5FdllZ+sMKcaGIA0RQbyyeGgLxLELpcxLglON:jGXXHJYx5fCE+yi5JlZ+4cWAoQB6mpcV
MD5:	2B573B5A4D6EC77A3138EC43A1B260C9
SHA1:	2A210A2645A2B8155CA8740211D6B366BA0D293D
SHA-256:	4CFBA14A6F738DD17BE066C3A8F595B84C0C33C1774C83736987B9EE8C0DF16B
SHA-512:	A04185BF7DA42D22F0AE01C55EFB7AA5FE0C5924820DF3AF2439B06E472131FB5659577B970834C08FBCA610A10EF41909B412B94B65BB5C8465047697647FDE
Malicious:	false
Preview:	// stdafx.cpp : source file that includes just the standard includes..// CEJVMTI.pch will be the pre-compiled header..// stdafx.obj will contain the pre-compiled type information....#include "stdafx.h"....// TODO: reference any additional headers you need in STDAFX.H..// and not in this file..

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-6LEET.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9131
Entropy (8bit):	5.432032141224608
Encrypted:	false
SSDEEP:	192:reWH42e/J83LkXasXVHMFyWH9MWUnsUeTxtbPYN9:C42RA4VL/RV
MD5:	59529578CDE1AE578ABCAAA331AA4FBA
SHA1:	33AB98509ED784580A259D1B310827C50B842F50
SHA-256:	E3795C3B94C84491A368C78FCBC4076BFADCA038AFE74DA2FA7FAB7415945658
SHA-512:	ACBD3884642E466D29FBE6D6A7337CCBAEC55147EA735098F9E463C6875B52B255480745847C3EFABCBAC72F9B72DD45CF259880A8D4700AFB68C3C07AC747BE
Malicious:	false
Preview:	#include "StdAfx.h"..#include "JavaEventServer.h"......CJavaEventServer old_eventserver=NULL;..CJavaEventServer eventserver=NULL;....jvmtiEventCallbacks callbacks;......void JNICALL MethodLoad(jvmtiEnv jvmti_env, jmethodID method, jint code_size, const void code_addr, jint map_length, ..........const jvmtiAddrLocationMap* map, const void* compile_info)..{...if (eventserver)....eventserver->MethodLoad(jvmti_env, method, code_size, code_addr);....}....void JNICALL MethodUnload(jvmtiEnv jvmti_env, jmethodID method, const void code_addr)..{...if (eventserver)....eventserver->MethodUnload(jvmti_env, method, code_addr);..}....void JNICALL DynamicCodeGenerated(jvmtiEnv jvmti_env, const char name, const void* address, jint length)..{...if (eventserver)....eventserver->DynamicCodeGenerated(jvmti_env, name, address,length);..}....void JNICALL FieldModification(jvmtiEnv jvmti_env, JNIEnv jni_env, jthread thread, jmethodID method, jlocation location, jclass field_klass, jobject object, j

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-IVICO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	410
Entropy (8bit):	5.041995140928715
Encrypted:	false
SSDEEP:	12:j/ltWmmylAoQw/UkKTQRWDKSRROaAOaWZKSR7Mjoa:rWy7VU9aWGM3wWQMcoa
MD5:	66EFA1B79D7AEF68DFA369074ABC9CAA
SHA1:	67C347B1F2F8712B0CABB60E7E111CA1B3171F38
SHA-256:	542E67D6247001859B6BB38C2AA085F5446371EB2F2385546E12D0BF275DE503
SHA-512:	09DFBE5F7D95BBA3D4B9107C872F8690F6A714888B3146CA3E1468E41588D872EEE68AE8C4CC96B85B73B6F96F450C1D20496D9401BC94932D6F357EE42A225E
Malicious:	false
Preview:	// dllmain.cpp : Defines the entry point for the DLL application...#include "stdafx.h"....BOOL APIENTRY DllMain( HMODULE hModule,.. DWORD ul_reason_for_call,.. LPVOID lpReserved....... )..{...switch (ul_reason_for_call)...{...case DLL_PROCESS_ATTACH:...case DLL_THREAD_ATTACH:...case DLL_THREAD_DETACH:...case DLL_PROCESS_DETACH:....break;...}...return TRUE;..}....

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-J1K98.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42621
Entropy (8bit):	5.318768758669348
Encrypted:	false
SSDEEP:	384:Qw5oITw/RTdMaf2lBpn/Z2jc/AKJlXCR5A6Qw/iNufJiTTvMm5ETln6H:V1TwU7BJRCZQw/iNuBiTTvMvl6H
MD5:	AFABA48AD9AFA999503CCAAC45DF0710
SHA1:	45FEF1F5289CB3FD353F43EFD13ECE034803C9CD
SHA-256:	E02208CA6EBED1999D9761CC865CE98EABA28966DC32F40B5789733E52783BF9
SHA-512:	66B995A75C6F90177BCE4DCC93783B1409D20B8FF1C318B79B8DD7C8FE6A1DEE2F0AB906F30C5390D1C7B043D4E99717BF6FBC267318932D066721294C663552
Malicious:	false
Preview:	#include "StdAfx.h"..#include "JavaServer.h"....using namespace std;....int serverid=0;..int tagcount=0;....CJavaServer::CJavaServer(jvmtiEnv* jvmti_env, JNIEnv* jni_env)..{...//create a named pipe...jvmtiCapabilities cap;.......this->jni=jni_env;...this->jvmti=jvmti_env;.......jvmti->GetCapabilities(&cap);.....if (serverid==0)....swprintf(pipename, 256,L"\\\\.\\pipe\\cejavadc_pid%d", GetCurrentProcessId());...else....swprintf(pipename, 256,L"\\\\.\\pipe\\cejavadc_pid%d_%d", GetCurrentProcessId(),serverid);.......serverid++;..}....void CJavaServer::CreatePipeandWaitForconnect(void)..{....if ((pipehandle) && (pipehandle!=INVALID_HANDLE_VALUE))...{....CloseHandle(pipehandle);....pipehandle=0;...}.....pipehandle=CreateNamedPipe(pipename, PIPE_ACCESS_DUPLEX, PIPE_TYPE_BYTE \| PIPE_READMODE_BYTE \| PIPE_WAIT, 1,256*1024, 16, INFINITE, NULL);...ConnectNamedPipe(pipehandle, NULL);..}....CJavaServer::~CJavaServer(void)..{....}....void CJavaServer::StartCodeCallbacks(void)..{...if (old_eventserve

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-OHV06.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2957
Entropy (8bit):	5.440878996694979
Encrypted:	false
SSDEEP:	48:ayZG0XyeJljj2/1lXdYTpCvLYsdiLYQFtbfmtTZzlLj:FG0XyeJp41ld8CTYFYQFF0
MD5:	8A6C5C03E9FEF26236D765C96CA20085
SHA1:	01C3F3D91B2EB573E0C92BB7B2F656A42A31FB1D
SHA-256:	962F6BA49567FD76AD41C87A10763249C320294A5C971B089E935B864E824AD3
SHA-512:	031FA1505CC5345144247B25A6791A265EFCD05ECEDAB5421215DFD6F30F64E6677EA5B23DF2BCE0118DC865C5C3AA67B704338BE9693663B8C1E26CF27A19C0
Malicious:	false
Preview:	#pragma once....#include "JavaEventServer.h"....#define JAVACMD_STARTCODECALLBACKS 0..#define JAVACMD_STOPCODECALLBACKS 1..#define JAVACMD_GETLOADEDCLASSES 2..#define JAVACMD_DEREFERENCELOCALOBJECT 3..#define JAVACMD_GETCLASSMETHODS 4..#define JAVACMD_GETCLASSFIELDS 5..#define JAVACMD_GETIMPLEMENTEDINTERFACES 6..#define JAVAVMD_FINDREFERENCESTOOBJECT 7..#define JAVACMD_FINDJOBJECT 8..#define JAVACMD_GETCLASSSIGNATURE 9..#define JAVACMD_GETSUPERCLASS 10..#define JAVACMD_GETOBJECTCLASS 11..#define JAVACMD_GETCLASSDATA 12..#define JAVACMD_REDEFINECLASS 13..#define JAVACMD_FINDCLASS 14..#define JAVACMD_GETCAPABILITIES 15..#define JAVACMD_GETMETHODNAME 16..#define JAVACMD_INVOKEMETHOD 17..#define JAVACMD_FINDCLASSOBJECTS 18..#define JAVACMD_ADDTOBOOTSTRAPCLASSLOADERPATH 19..#define JAVACMD_ADDTOSYSTEMCLASSLOADERPATH 20..#define JAVACMD_PUSHLOCALFRAME 21..#define JAVACMD_POPLOCALFRAME 22..#define JAVACMD_GETFIELDDECLARINGCLASS 23..#define JAVACMD_GETFIELDSIGNATURE 24..#define JAVACMD_GETFIEL

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-R3SMO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10039
Entropy (8bit):	5.118940053099404
Encrypted:	false
SSDEEP:	192:VnzWGB2Afbh77fByk+f8bi4n4w4RciFnFwFRyIF:RWGdfbhfB+f8bi4n4w4RciFnFwFRFF
MD5:	9EE34D72F0C9E158FCEBB31CD8878D6C
SHA1:	3F06D5E6E886961AF80FA823E2D52CE5CD0B84D8
SHA-256:	CAFE34E86117A15C4E0B40F12BCBB79CB6EF8F0AB8ED10DEF567357AB11637CD
SHA-512:	FB41AF029142289DE950BA7BC1512A586E9C9E2414F46BB755936637978D40ECA5D8E671369BE61ACD38E841BCD11C264E2DE55FBC087E91B4A7529FFE91A55B
Malicious:	false
Preview:	<?xml version="1.0" encoding="Windows-1252"?>..<VisualStudioProject...ProjectType="Visual C++"...Version="9.00"...Name="CEJVMTI"...ProjectGUID="{3C30A633-6797-4D59-936F-9A2A8CE79B25}"...RootNamespace="CEJVMTI"...Keyword="Win32Proj"...TargetFrameworkVersion="196613"...>...<Platforms>....<Platform.....Name="Win32"..../>....<Platform.....Name="x64"..../>...</Platforms>...<ToolFiles>...</ToolFiles>...<Configurations>....<Configuration.....Name="Debug\|Win32".....OutputDirectory="..\..\..\bin\autorun\dlls".....IntermediateDirectory="$(ConfigurationName)".....ConfigurationType="2".....CharacterSet="1".....>.....<Tool......Name="VCPreBuildEventTool"...../>.....<Tool......Name="VCCustomBuildTool"...../>.....<Tool......Name="VCXMLDataGeneratorTool"...../>.....<Tool......Name="VCWebServiceProxyGeneratorTool"...../>.....<Tool......Name="VCMIDLTool"...../>.....<Tool......Name="VCCLCompilerTool"......Optimization="0"......AdditionalIncludeDirectories="E:\source\openjdk\jdk\src\share\javavm\export;E:

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-SS3Q8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1428
Entropy (8bit):	4.639223269334076
Encrypted:	false
SSDEEP:	24:l6u3qiYCydaR3mGlNMPfKge6KgeLTK1u2Pui:n39YdMmG/MPfKge6KgeLTK1/Gi
MD5:	33F3A8E602AC6644AF839ACB3CA10709
SHA1:	0F76681306EBBE5063DA4C93919104D3E0134046
SHA-256:	0CE7BD4B75FCF8800FAFFD3B0A315CBFE7B89271B8705E9216404AF4D737D0BB
SHA-512:	81898FCF08C2EA7817479852771E11A67D766FBA25B4FC7A77D23C993C4274D1C7C66953951051D2952D1B52630A1BA5C5268D7E67C1B9C696CA5EF427E5EC0D
Malicious:	false
Preview:	#pragma once....// The following macros define the minimum required platform. The minimum required platform..// is the earliest version of Windows, Internet Explorer etc. that has the necessary features to run ..// your application. The macros work by enabling all features available on platform versions up to and ..// including the version specified.....// Modify the following defines if you have to target a platform prior to the ones specified below...// Refer to MSDN for the latest info on corresponding values for different platforms...#ifndef WINVER // Specifies that the minimum required platform is Windows Vista...#define WINVER 0x0600 // Change this to the appropriate value to target other versions of Windows...#endif....#ifndef _WIN32_WINNT // Specifies that the minimum required platform is Windows Vista...#define _WIN32_WINNT 0x0600 // Change this to the appropriate value to target other versions of Windows...#endif....#ifndef

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-TS9A7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	836
Entropy (8bit):	5.079968529942336
Encrypted:	false
SSDEEP:	24:CwCaxHbe4JGywvVwOPGkTAIbDNzHOqMfsqM98DU+V6E:vxHbe4kywBGkTAIfNzHOqMUqM98wc6E
MD5:	20AF26E2AB559DDC6CA1929834DA003E
SHA1:	7AE93554FBCEC9851F68F16A2EAED9C3F299CE5F
SHA-256:	18C5FB7CB71EB7B2D1835CE44B24E09213AA885C1407E4E2401FBD2D74970D8E
SHA-512:	B9FF67E715E0489D761424266EDA7049F40FE38E0EE4F595B1D4B43E6E9F829074827DC4EBBF9FF368BE02A90A9343117930C88ED5FBB8E3D8EEBDA43A857D90
Malicious:	false
Preview:	// The following ifdef block is the standard way of creating macros which make exporting ..// from a DLL simpler. All files within this DLL are compiled with the CEJVMTI_EXPORTS..// symbol defined on the command line. this symbol should not be defined on any project..// that uses this DLL. This way any other project whose source files include this file see ..// CEJVMTI_API functions as being imported from a DLL, whereas this DLL sees symbols..// defined with this macro as being exported...#ifdef CEJVMTI_EXPORTS..#define CEJVMTI_API __declspec(dllexport)..#else..#define CEJVMTI_API __declspec(dllimport)..#endif....// This class is exported from the CEJVMTI.dll..class CEJVMTI_API CCEJVMTI {..public:...CCEJVMTI(void);...// TODO: add your methods here...};....extern CEJVMTI_API int nCEJVMTI;....CEJVMTI_API int fnCEJVMTI(void);..

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\is-UOGUT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1440
Entropy (8bit):	5.2417448709416385
Encrypted:	false
SSDEEP:	24:l+LADzcCjadu1txScPArZXOuAR5qLtmWltXUC/sf4ADSt9:Ra2Sco9XOuAaplUC/sfy
MD5:	94DE75F30ECA367499F6C3CA7905048C
SHA1:	26B550FAC776E0647ECEB2B246086D07DBB1F12B
SHA-256:	289AF20BDC7D004491E224531CE0C267D251AEF5EBAD5F3FED1AF750679F26C9
SHA-512:	4A822471535DCEA02B5DD73CDE60C3965910F5187E0D7E1F1691E0483921DEE6C2B13E9BC3D1EC952186BCCAD6D05E79266C77BBF8060329C71715D3DA9B4496
Malicious:	false
Preview:	#pragma once..#include "pipe.h"....//pipe for transmitting java events like method load/free....#define EVENTCMD_METHODLOAD 0..#define EVENTCMD_METHODUNLOAD 1..#define EVENTCMD_DYNAMICCODEGENERATED 2..#define EVENTCMD_FIELDMODIFICATION 3..#define EVENTCMD_TERMINATED 255....using namespace std;....typedef struct..{...jfieldID fieldid;...jclass klass;...jobject object;..} FindWhatWritesEntry, PFindWhatWritesEntry;....class CJavaEventServer :...public Pipe..{..private:...wchar_t pipename[256];...jvmtiEnv jvmti_env;...vector<PFindWhatWritesEntry> FindWhatWritesList;....public:...CJavaEventServer(jvmtiEnv jvmti_env);...~CJavaEventServer(void);.....void MethodLoad(jvmtiEnv jvmti_env, jmethodID method, jint code_size, const void* code_addr);...void MethodUnload(jvmtiEnv jvmti_env, jmethodID method, const void code_addr);...void DynamicCodeGenerated(jvmtiEnv jvmti_env, const char name, const void* address, jint length);...void FieldModification(jvmtiEnv jvmti_env, JNIEnv jni_env, jth

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\stdafx.cpp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	294
Entropy (8bit):	4.740307510696171
Encrypted:	false
SSDEEP:	6:jGmyXH+5AMRNT15eAbyRFm+yll+5FdllZ+sMKcaGIA0RQbyyeGgLxLELpcxLglON:jGXXHJYx5fCE+yi5JlZ+4cWAoQB6mpcV
MD5:	2B573B5A4D6EC77A3138EC43A1B260C9
SHA1:	2A210A2645A2B8155CA8740211D6B366BA0D293D
SHA-256:	4CFBA14A6F738DD17BE066C3A8F595B84C0C33C1774C83736987B9EE8C0DF16B
SHA-512:	A04185BF7DA42D22F0AE01C55EFB7AA5FE0C5924820DF3AF2439B06E472131FB5659577B970834C08FBCA610A10EF41909B412B94B65BB5C8465047697647FDE
Malicious:	false
Preview:	// stdafx.cpp : source file that includes just the standard includes..// CEJVMTI.pch will be the pre-compiled header..// stdafx.obj will contain the pre-compiled type information....#include "stdafx.h"....// TODO: reference any additional headers you need in STDAFX.H..// and not in this file..

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\stdafx.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	542
Entropy (8bit):	4.851662037036262
Encrypted:	false
SSDEEP:	12:jG0/fS4gZS4pSypyZbRAo9DGmreL5GAxA0jAiVvAihASAGjAz6cMqpcP6v:Fnapa9NBm5Gk/jfv3LBj9cMqpcs
MD5:	3718862895EA61A1A87FEB925092F535
SHA1:	7733DE8657B606A4BF18B844DEA6C500642EF964
SHA-256:	2FD0179BA87126CC35FB41D63FBEBBFBA185414960720B0A3DA652EC3B1AF641
SHA-512:	9357D5C4125F7CE8D2D31A72CFF04BA357565F69E0ED099076572C4E48B2A9E34C077D7462EBABC371952E6F9F48AAC17A1EFEE682573B49F7A7CF9752A41584
Malicious:	false
Preview:	// stdafx.h : include file for standard system include files,..// or project specific include files that are used frequently, but..// are changed infrequently..//....#pragma once....#include "targetver.h"....#define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers..// Windows Header Files:..#include <windows.h>..#include <jvmti.h>..#include <classfile_constants.h>..#include <pipe.h>..#include <map>..#include <list>..#include <vector>......// TODO: reference additional headers your program requires here..

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\targetver.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1428
Entropy (8bit):	4.639223269334076
Encrypted:	false
SSDEEP:	24:l6u3qiYCydaR3mGlNMPfKge6KgeLTK1u2Pui:n39YdMmG/MPfKge6KgeLTK1/Gi
MD5:	33F3A8E602AC6644AF839ACB3CA10709
SHA1:	0F76681306EBBE5063DA4C93919104D3E0134046
SHA-256:	0CE7BD4B75FCF8800FAFFD3B0A315CBFE7B89271B8705E9216404AF4D737D0BB
SHA-512:	81898FCF08C2EA7817479852771E11A67D766FBA25B4FC7A77D23C993C4274D1C7C66953951051D2952D1B52630A1BA5C5268D7E67C1B9C696CA5EF427E5EC0D
Malicious:	false
Preview:	#pragma once....// The following macros define the minimum required platform. The minimum required platform..// is the earliest version of Windows, Internet Explorer etc. that has the necessary features to run ..// your application. The macros work by enabling all features available on platform versions up to and ..// including the version specified.....// Modify the following defines if you have to target a platform prior to the ones specified below...// Refer to MSDN for the latest info on corresponding values for different platforms...#ifndef WINVER // Specifies that the minimum required platform is Windows Vista...#define WINVER 0x0600 // Change this to the appropriate value to target other versions of Windows...#endif....#ifndef _WIN32_WINNT // Specifies that the minimum required platform is Windows Vista...#define _WIN32_WINNT 0x0600 // Change this to the appropriate value to target other versions of Windows...#endif....#ifndef

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Java\CEJVMTI\is-1H9D4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1241
Entropy (8bit):	5.56652814239152
Encrypted:	false
SSDEEP:	24:pPE7K71jtSk8H5IkT6GkTxkBZkm2kp6ckt8Ik/Tkk88W:pPAe1jtTeYQtYZ
MD5:	D602509D20C721D185D08DDFAB72EFD8
SHA1:	A7006EDA0FC346223377188F4941B39BE925E355
SHA-256:	F51DCDB8A36F5784994125E8F3451EA91A710FC844751319E839B448802E7A13
SHA-512:	02D79C2A4C1A175C38E35E08465B4C915FF2F185A10208F36C31B707AAE4E38BDB8E0F04F6DEE231622973ACBE12AD3A0B76EDFFBB69979337833C7E94A36108
Malicious:	false
Preview:	...Microsoft Visual Studio Solution File, Format Version 10.00..# Visual Studio 2008..Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "CEJVMTI", "CEJVMTI\CEJVMTI.vcproj", "{3C30A633-6797-4D59-936F-9A2A8CE79B25}"..EndProject..Global...GlobalSection(SolutionConfigurationPlatforms) = preSolution....Debug\|Win32 = Debug\|Win32....Debug\|x64 = Debug\|x64....Release\|Win32 = Release\|Win32....Release\|x64 = Release\|x64...EndGlobalSection...GlobalSection(ProjectConfigurationPlatforms) = postSolution....{3C30A633-6797-4D59-936F-9A2A8CE79B25}.Debug\|Win32.ActiveCfg = Debug\|Win32....{3C30A633-6797-4D59-936F-9A2A8CE79B25}.Debug\|Win32.Build.0 = Debug\|Win32....{3C30A633-6797-4D59-936F-9A2A8CE79B25}.Debug\|x64.ActiveCfg = Debug\|x64....{3C30A633-6797-4D59-936F-9A2A8CE79B25}.Debug\|x64.Build.0 = Debug\|x64....{3C30A633-6797-4D59-936F-9A2A8CE79B25}.Release\|Win32.ActiveCfg = Release\|Win32....{3C30A633-6797-4D59-936F-9A2A8CE79B25}.Release\|Win32.Build.0 = Release\|Win32....{3C30A633-6797-4D59-936F-9A2A8CE79B25}

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector.sln (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1351
Entropy (8bit):	5.483553389434968
Encrypted:	false
SSDEEP:	24:pPEkpnjkaUdex0H5p6DK/C868u8o2/b88W:pPTnjY6eqp8bo2/IZ
MD5:	9A2A2CADE7D370C563896D2C6F07D1C2
SHA1:	E01491AE49454E194C3B4DE2AE668AFEF27B3F3E
SHA-256:	287EE21B22308A8B979EB259417503D5B1542BBBF0859EE9344C085DE7866495
SHA-512:	CB9337B576030AF522180F16D8B52B36A9CC8099DB19A17D18CE92559C191CA4B61F27BBDA051E895A7E9455033BAB3C52FD057FA52F138F735DCC485F46B546
Malicious:	false
Preview:	...Microsoft Visual Studio Solution File, Format Version 12.00..# Visual Studio 2013..VisualStudioVersion = 12.0.30723.0..MinimumVisualStudioVersion = 10.0.40219.1..Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MonoDataCollector", "MonoDataCollector\MonoDataCollector.vcxproj", "{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}"..EndProject..Global...GlobalSection(SolutionConfigurationPlatforms) = preSolution....Debug\|Win32 = Debug\|Win32....Debug\|x64 = Debug\|x64....Release\|Win32 = Release\|Win32....Release\|x64 = Release\|x64...EndGlobalSection...GlobalSection(ProjectConfigurationPlatforms) = postSolution....{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}.Debug\|Win32.ActiveCfg = Debug\|Win32....{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}.Debug\|Win32.Build.0 = Debug\|Win32....{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}.Debug\|x64.ActiveCfg = Debug\|x64....{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}.Debug\|x64.Build.0 = Debug\|x64....{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}.Release\|Win32.ActiveCfg = Release\|Win32....{941726A

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\Metadata.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4749
Entropy (8bit):	5.050824950813426
Encrypted:	false
SSDEEP:	48:iDz9qCj948ryMvEsMXoQ/O04a0smj9Mn/jMi/Y3SfsdIrmjFFZpmb/RmAdnEm1pd:g5p1O33Bk+QF9jeh9pBdPpFN
MD5:	1E571535D8459B8A3FCBA0C9E4871FA4
SHA1:	1C0F2CED9985BA808A648C9D95D7DB5076082985
SHA-256:	E66368085DB41EF91395CC1212A970117376B5B535E97F291FD71B2277BA9619
SHA-512:	3369613A4BDE6B49C73AD70E8DF2EBE7BD1C05FD0D7CBC5E87C5F1F3408FA36F8D7A40C19B097E541A649D7C0F30EE9FDB46B677E926A7A862FA2B794FDC9A80
Malicious:	false
Preview:	//original source: blob.h in the mono sourcecode....../.. Encoding for type signatures used in the Metadata.. /..typedef enum {...MONO_TYPE_END = 0x00, / End of List /...MONO_TYPE_VOID = 0x01,...MONO_TYPE_BOOLEAN = 0x02,...MONO_TYPE_CHAR = 0x03,...MONO_TYPE_I1 = 0x04,...MONO_TYPE_U1 = 0x05,...MONO_TYPE_I2 = 0x06,...MONO_TYPE_U2 = 0x07,...MONO_TYPE_I4 = 0x08,...MONO_TYPE_U4 = 0x09,...MONO_TYPE_I8 = 0x0a,...MONO_TYPE_U8 = 0x0b,...MONO_TYPE_R4 = 0x0c,...MONO_TYPE_R8 = 0x0d,...MONO_TYPE_STRING = 0x0e,...MONO_TYPE_PTR = 0x0f, / arg: <type> token /...MONO_TYPE_BYREF = 0x10, / arg: <type> token /...MONO_TYPE_VALUETYPE = 0x11, / arg: <type> token /...MONO_TYPE_CLASS = 0x12, / arg: <type> token /...MONO_TYPE_VAR. = 0x13,. / number /...MONO_TYPE_ARRAY = 0x14, / type, rank, boundsCount, bound1, loCount, lo1 */..

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\MonoDataCollector.cpp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3498
Entropy (8bit):	5.386752810495523
Encrypted:	false
SSDEEP:	96:ycfIokZotRYYftF1//JlB/R+reZhIxL3HmVZirMiKH8gEIsrdGXCYIr/J+Nn35t1:tAokZotRYYftF1//JlB/R+qZhIxL3Hm1
MD5:	35C7C5B4162098879D86CA2D5D7403E7
SHA1:	BDB921B2A10398DE218F33EDD4028E2B247F8592
SHA-256:	6F971E6E28F95B72775FA0D85922F58FC6BB5B68B34DB72C9D2F69E9374CA09C
SHA-512:	70C259E5C01D1EAD0694ADEBAC7639998A2EA3ECB52961B22F74C113669CCD50F80E884EF30D8DEB02028736A06B71F82F3A80EE20121613F8F3049C4D8D2655
Malicious:	false
Preview:	#ifdef _WINDOWS..#include "stdafx.h"..#elif __linux__..#include "linuxport.h"..#else..#include "macport.h"..#endif....#include "PipeServer.h"........HANDLE DataCollectorThread;..HANDLE SuicideThread;..HINSTANCE g_hInstance;....typedef enum _THREADINFOCLASS {.. ThreadBasicInformation,.. ThreadTimes,.. ThreadPriority,.. ThreadBasePriority,.. ThreadAffinityMask,.. ThreadImpersonationToken,.. ThreadDescriptorTableEntry,.. ThreadEnableAlignmentFaultFixup,.. ThreadEventPair_Reusable,.. ThreadQuerySetWin32StartAddress,.. ThreadZeroTlsCell,.. ThreadPerformanceCount,.. ThreadAmILastThread,.. ThreadIdealProcessor,.. ThreadPriorityBoost,.. ThreadSetTlsArrayAddress, // Obsolete.. ThreadIsIoPending,.. ThreadHideFromDebugger,.. ThreadBreakOnTermination,.. ThreadSwitchLegacyState,.. ThreadIsTerminated,.. ThreadLastSystemCall,.. ThreadIoPriority,.. ThreadCycleTime,.. ThreadPagePriority,.. ThreadActualBasePriority,.. Thr

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\MonoDataCollector.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	361
Entropy (8bit):	5.139139694869984
Encrypted:	false
SSDEEP:	6:2+bxmgVJAl3JmgRF80JRiCIqj/uFSJAQaP5a0Tj/5vpL5a0iTVDzz4jLxwLDPVMy:lbxVJAl5XRF1JTfJAQQQIxvpLQ/PSNw/
MD5:	A9DA212C35E442501960243A47A7C4DA
SHA1:	DA608C4AA6EEF1755F29366EA40BF826F07FFEB3
SHA-256:	23042548A0B202F76F0B66332844D796FC20C4FB4937D92299156E503ABC3F1D
SHA-512:	8A6C5A941C051C52C9DF9B151B354F3C82ED4E8041D000CD6DC2869A99C16064F753A9B6391F15A0A51CDB3CC9972FA0D3F3F191BA813BA00FD6A185D042BD76
Malicious:	false
Preview:	#pragma once....extern HANDLE DataCollectorThread;..extern HANDLE SuicideThread;..extern HINSTANCE g_hInstance;..DWORD WINAPI DataCollectorEntry(LPVOID lpThreadParameter);..DWORD WINAPI SuicideCheck(LPVOID lpThreadParameter);....#ifdef __APPLE__..void MacPortEntryPoint(void param);..#endif....#ifdef __linux__..void LinuxPortEntryPoint(void param);..#endif..

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\MonoDataCollector.vcproj (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5600
Entropy (8bit):	5.094870445203132
Encrypted:	false
SSDEEP:	96:drlz+71S6oa5zNq5+NtoottAipiwpHipfwp56q3bI4:Zp+skNca8i4whiFwyqb
MD5:	005A2F50AB3176D92010BE6DDF941655
SHA1:	9978E4C49D43172F8855A4748168345F2CA5BFF5
SHA-256:	A73AE1CBF54A722CE9433DA14D0600AFD504B09F5F681ED4BE9C9F5EF0E16A38
SHA-512:	8EC75F7B33F5C97853B63675621430A4C3975E8D6737A546D5983917E2C5FF17D4B6517FBA9D74F0F7C61CF4111F101B1231A97556A09908EC3B5EDF843859F2
Malicious:	false
Preview:	<?xml version="1.0" encoding="Windows-1252"?>..<VisualStudioProject...ProjectType="Visual C++"...Version="9.00"...Name="MonoDataCollector"...ProjectGUID="{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}"...RootNamespace="MonoDataCollector"...Keyword="Win32Proj"...TargetFrameworkVersion="196613"...>...<Platforms>....<Platform.....Name="Win32"..../>...</Platforms>...<ToolFiles>...</ToolFiles>...<Configurations>....<Configuration.....Name="Debug\|Win32".....OutputDirectory="..\..\bin\autorun\dlls".....IntermediateDirectory="$(ConfigurationName)".....ConfigurationType="2".....CharacterSet="1".....>.....<Tool......Name="VCPreBuildEventTool"...../>.....<Tool......Name="VCCustomBuildTool"...../>.....<Tool......Name="VCXMLDataGeneratorTool"...../>.....<Tool......Name="VCWebServiceProxyGeneratorTool"...../>.....<Tool......Name="VCMIDLTool"...../>.....<Tool......Name="VCCLCompilerTool"......Optimization="0"......AdditionalIncludeDirectories="..\..\Common"......PreprocessorDefinitions="WIN32;_DEBUG;_WINDOWS

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\PipeServer.cpp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	71747
Entropy (8bit):	5.443198228857467
Encrypted:	false
SSDEEP:	1536:23vsKL5IB9DGdvGgFmk2N8VBFFlIsc8bOJObk:20Kq8VBFNc85k
MD5:	6E26B821A5660C3FB1414DBBA46636BF
SHA1:	E5AFF92AABB4C902CA2CE617DD2546956648C462
SHA-256:	F125B75EE7CAC4F30B9C399B6A371B62A3960E4DB11A64F8937E469B9C2BDD40
SHA-512:	647514B0E0537F3018DB7F500FDA81801AB68E02F663892E4D3A3A9A71CBD303A356371C227BBAC3154E883AEFEDDEC699CF40C99B2096E6F993B8B857C2A316
Malicious:	false
Preview:	#ifdef _WINDOWS..#include "StdAfx.h"..#endif....#ifdef __APPLE__..#include "macport.h"..#endif....#include <setjmp.h>..#ifdef __linux__..#include <signal.h>..#include <sys/types.h>..#include <string.h>..#include <unistd.h>..#include <sys/syscall.h>....#if __GLIBC__ == 2 && __GLIBC_MINOR__ < 30..#define gettid() syscall(SYS_gettid)..#endif....#endif //linux........#include <signal.h>..#include <sys/types.h>....#include "PipeServer.h"........BOOL ExpectingAccessViolations = FALSE;....#ifdef _WINDOWS..#pragma warning( disable : 4101)..HANDLE MDC_ServerPipe = 0;..DWORD ExpectingAccessViolationsThread = 0;..#else..uint64_t ExpectingAccessViolationsThread = 0;..#endif....typedef uint64_t QWORD;......jmp_buf onError;....void ErrorThrow(void)..{...longjmp(onError, 1);..}......#ifdef _WINDOWS......int looper = 0;..LONG NTAPI ErrorFilter(struct _EXCEPTION_POINTERS *ExceptionInfo)..{...if ((ExpectingAccessViolations) && (GetCurrentThreadId() == ExpectingAccessViolationsThread) && (ExceptionInfo->

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\PipeServer.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17047
Entropy (8bit):	5.4217354569721214
Encrypted:	false
SSDEEP:	384:cBl0g5ShHzjEs2eI4Nw6YolkVXWNcN5qHyVGwuY0aUO+HXL:cBl1Y0j67lkVXWNcNiywbb
MD5:	359419B5EAD252EE248BE37873672D8E
SHA1:	0E18258FFC1E29A9E53824A8F86383E1BC2FC603
SHA-256:	FA4715152CC91D2F6C5C170FADDA74961A2CB12809F560AA37A34F7C185C76F0
SHA-512:	0F757B21B356676FE376D99F64189D86795FD6E9DB411B661A517E1B20172D7183129CC8762DB7E19DD83C826AFD57B6C35AFDCBAEC05C2AF83C6496F7C4D2D6
Malicious:	false
Preview:	#pragma once....#include <Pipe.h>..#ifndef _WINDOWS..#include "Metadata.h"..#endif...... //yyyymmdd..#define MONO_DATACOLLECTORVERSION 20221207 ....#define MONOCMD_INITMONO 0..#define MONOCMD_OBJECT_GETCLASS 1..#define MONOCMD_ENUMDOMAINS 2..#define MONOCMD_SETCURRENTDOMAIN 3..#define MONOCMD_ENUMASSEMBLIES 4..#define MONOCMD_GETIMAGEFROMASSEMBLY 5..#define MONOCMD_GETIMAGENAME 6..#define MONOCMD_ENUMCLASSESINIMAGE 7..#define MONOCMD_ENUMFIELDSINCLASS 8..#define MONOCMD_ENUMMETHODSINCLASS 9..#define MONOCMD_COMPILEMETHOD 10....#define MONOCMD_GETMETHODHEADER 11..#define MONOCMD_GETMETHODHEADER_CODE 12..#define MONOCMD_LOOKUPRVA 13..#define MONOCMD_GETJITINFO 14..#define MONOCMD_FINDCLASS 15..#define MONOCMD_FINDMETHOD 16..#define MONOCMD_GETMETHODNAME 17..#define MONOCMD_GETMETHODCLASS 18..#define MONOCMD_GETCLASSNAME 19..#define MONOCMD_GETCLASSNAMESPACE 20..#define MONOCMD_FREEMETHOD 21..#define MONOCMD_TERMINATE 22..#define MONOCMD_DISASSEMBLE 23..#def

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\dllmain.cpp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	682
Entropy (8bit):	5.267391865519074
Encrypted:	false
SSDEEP:	12:j/ltWmmylAoQ3/UkKTzuKTRWDKSRWMqIJCJAlosePSJAQnxPs5rF43oLOaAOaWZW:rWy7sU9zu6WGMKIAXsCStxPs5rF43olG
MD5:	4A220BB5A39A19E5E63123E8BA31FAF9
SHA1:	3E6667ED6E85E021FD9091C8EB2FDCA3C2DDEF41
SHA-256:	01F9B1931FDC3D8CB1B82D759A182AE617AF8986846A2B6F23092F78A39C8AD7
SHA-512:	734FD1ACEEE62A86A56DFC94E6E6FF264AE924AADFDC47EAC405E252FE3965633992D192CFAC6068AD7F2CAA170B594A0839D09ECE60976A27A363F69C1E1A5D
Malicious:	false
Preview:	// dllmain.cpp : Defines the entry point for the DLL application...#include "stdafx.h"......BOOL APIENTRY DllMain( HMODULE hModule,.. DWORD ul_reason_for_call,.. LPVOID lpReserved....... )..{...OutputDebugStringA("MDC: DllMain");...switch (ul_reason_for_call)...{...case DLL_PROCESS_ATTACH:....//OutputDebugStringA("DllMain entry");....g_hInstance=hModule;....DataCollectorThread=CreateThread(NULL, 0, DataCollectorEntry, NULL, 0, NULL);....SuicideThread=0;//CreateThread(NULL, 0, SuicideCheck, NULL, 0, NULL);....break;.....case DLL_THREAD_ATTACH:...case DLL_THREAD_DETACH:...case DLL_PROCESS_DETACH:....break;...}...return TRUE;..}....

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-1EM51.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	304
Entropy (8bit):	4.661406565301994
Encrypted:	false
SSDEEP:	6:jGmyXH+5AMRNT15eAaiErJAhQFm+yll+5FdllZ+sMKcaGIA0RQbyyeGgLxLELpcV:jGXXHJYx5fanrJAKE+yi5JlZ+4cWAoQI
MD5:	520DEFE1897C77FCE677BE903979DCA0
SHA1:	0EB32160624E8E3B72DF97E440EFCB211A09595C
SHA-256:	71E91D8847E8A4E4A757E441B7D785EDDDA95D55FF674E5054D0FDF781773361
SHA-512:	337D2893FB92760955D04E788E753B95C835A085929ED4144654899F9A54B96E84A7682A3C7885AA24F98E53FD5B2A2AC03D3F261CD3725F7D15E4422A2942A0
Malicious:	false
Preview:	// stdafx.cpp : source file that includes just the standard includes..// MonoDataCollector.pch will be the pre-compiled header..// stdafx.obj will contain the pre-compiled type information....#include "stdafx.h"....// TODO: reference any additional headers you need in STDAFX.H..// and not in this file..

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-3Q8BH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3498
Entropy (8bit):	5.386752810495523
Encrypted:	false
SSDEEP:	96:ycfIokZotRYYftF1//JlB/R+reZhIxL3HmVZirMiKH8gEIsrdGXCYIr/J+Nn35t1:tAokZotRYYftF1//JlB/R+qZhIxL3Hm1
MD5:	35C7C5B4162098879D86CA2D5D7403E7
SHA1:	BDB921B2A10398DE218F33EDD4028E2B247F8592
SHA-256:	6F971E6E28F95B72775FA0D85922F58FC6BB5B68B34DB72C9D2F69E9374CA09C
SHA-512:	70C259E5C01D1EAD0694ADEBAC7639998A2EA3ECB52961B22F74C113669CCD50F80E884EF30D8DEB02028736A06B71F82F3A80EE20121613F8F3049C4D8D2655
Malicious:	false
Preview:	#ifdef _WINDOWS..#include "stdafx.h"..#elif __linux__..#include "linuxport.h"..#else..#include "macport.h"..#endif....#include "PipeServer.h"........HANDLE DataCollectorThread;..HANDLE SuicideThread;..HINSTANCE g_hInstance;....typedef enum _THREADINFOCLASS {.. ThreadBasicInformation,.. ThreadTimes,.. ThreadPriority,.. ThreadBasePriority,.. ThreadAffinityMask,.. ThreadImpersonationToken,.. ThreadDescriptorTableEntry,.. ThreadEnableAlignmentFaultFixup,.. ThreadEventPair_Reusable,.. ThreadQuerySetWin32StartAddress,.. ThreadZeroTlsCell,.. ThreadPerformanceCount,.. ThreadAmILastThread,.. ThreadIdealProcessor,.. ThreadPriorityBoost,.. ThreadSetTlsArrayAddress, // Obsolete.. ThreadIsIoPending,.. ThreadHideFromDebugger,.. ThreadBreakOnTermination,.. ThreadSwitchLegacyState,.. ThreadIsTerminated,.. ThreadLastSystemCall,.. ThreadIoPriority,.. ThreadCycleTime,.. ThreadPagePriority,.. ThreadActualBasePriority,.. Thr

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-89BIB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	682
Entropy (8bit):	5.267391865519074
Encrypted:	false
SSDEEP:	12:j/ltWmmylAoQ3/UkKTzuKTRWDKSRWMqIJCJAlosePSJAQnxPs5rF43oLOaAOaWZW:rWy7sU9zu6WGMKIAXsCStxPs5rF43olG
MD5:	4A220BB5A39A19E5E63123E8BA31FAF9
SHA1:	3E6667ED6E85E021FD9091C8EB2FDCA3C2DDEF41
SHA-256:	01F9B1931FDC3D8CB1B82D759A182AE617AF8986846A2B6F23092F78A39C8AD7
SHA-512:	734FD1ACEEE62A86A56DFC94E6E6FF264AE924AADFDC47EAC405E252FE3965633992D192CFAC6068AD7F2CAA170B594A0839D09ECE60976A27A363F69C1E1A5D
Malicious:	false
Preview:	// dllmain.cpp : Defines the entry point for the DLL application...#include "stdafx.h"......BOOL APIENTRY DllMain( HMODULE hModule,.. DWORD ul_reason_for_call,.. LPVOID lpReserved....... )..{...OutputDebugStringA("MDC: DllMain");...switch (ul_reason_for_call)...{...case DLL_PROCESS_ATTACH:....//OutputDebugStringA("DllMain entry");....g_hInstance=hModule;....DataCollectorThread=CreateThread(NULL, 0, DataCollectorEntry, NULL, 0, NULL);....SuicideThread=0;//CreateThread(NULL, 0, SuicideCheck, NULL, 0, NULL);....break;.....case DLL_THREAD_ATTACH:...case DLL_THREAD_DETACH:...case DLL_PROCESS_DETACH:....break;...}...return TRUE;..}....

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-A8Q85.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5600
Entropy (8bit):	5.094870445203132
Encrypted:	false
SSDEEP:	96:drlz+71S6oa5zNq5+NtoottAipiwpHipfwp56q3bI4:Zp+skNca8i4whiFwyqb
MD5:	005A2F50AB3176D92010BE6DDF941655
SHA1:	9978E4C49D43172F8855A4748168345F2CA5BFF5
SHA-256:	A73AE1CBF54A722CE9433DA14D0600AFD504B09F5F681ED4BE9C9F5EF0E16A38
SHA-512:	8EC75F7B33F5C97853B63675621430A4C3975E8D6737A546D5983917E2C5FF17D4B6517FBA9D74F0F7C61CF4111F101B1231A97556A09908EC3B5EDF843859F2
Malicious:	false
Preview:	<?xml version="1.0" encoding="Windows-1252"?>..<VisualStudioProject...ProjectType="Visual C++"...Version="9.00"...Name="MonoDataCollector"...ProjectGUID="{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}"...RootNamespace="MonoDataCollector"...Keyword="Win32Proj"...TargetFrameworkVersion="196613"...>...<Platforms>....<Platform.....Name="Win32"..../>...</Platforms>...<ToolFiles>...</ToolFiles>...<Configurations>....<Configuration.....Name="Debug\|Win32".....OutputDirectory="..\..\bin\autorun\dlls".....IntermediateDirectory="$(ConfigurationName)".....ConfigurationType="2".....CharacterSet="1".....>.....<Tool......Name="VCPreBuildEventTool"...../>.....<Tool......Name="VCCustomBuildTool"...../>.....<Tool......Name="VCXMLDataGeneratorTool"...../>.....<Tool......Name="VCWebServiceProxyGeneratorTool"...../>.....<Tool......Name="VCMIDLTool"...../>.....<Tool......Name="VCCLCompilerTool"......Optimization="0"......AdditionalIncludeDirectories="..\..\Common"......PreprocessorDefinitions="WIN32;_DEBUG;_WINDOWS

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-K4H2Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17047
Entropy (8bit):	5.4217354569721214
Encrypted:	false
SSDEEP:	384:cBl0g5ShHzjEs2eI4Nw6YolkVXWNcN5qHyVGwuY0aUO+HXL:cBl1Y0j67lkVXWNcNiywbb
MD5:	359419B5EAD252EE248BE37873672D8E
SHA1:	0E18258FFC1E29A9E53824A8F86383E1BC2FC603
SHA-256:	FA4715152CC91D2F6C5C170FADDA74961A2CB12809F560AA37A34F7C185C76F0
SHA-512:	0F757B21B356676FE376D99F64189D86795FD6E9DB411B661A517E1B20172D7183129CC8762DB7E19DD83C826AFD57B6C35AFDCBAEC05C2AF83C6496F7C4D2D6
Malicious:	false
Preview:	#pragma once....#include <Pipe.h>..#ifndef _WINDOWS..#include "Metadata.h"..#endif...... //yyyymmdd..#define MONO_DATACOLLECTORVERSION 20221207 ....#define MONOCMD_INITMONO 0..#define MONOCMD_OBJECT_GETCLASS 1..#define MONOCMD_ENUMDOMAINS 2..#define MONOCMD_SETCURRENTDOMAIN 3..#define MONOCMD_ENUMASSEMBLIES 4..#define MONOCMD_GETIMAGEFROMASSEMBLY 5..#define MONOCMD_GETIMAGENAME 6..#define MONOCMD_ENUMCLASSESINIMAGE 7..#define MONOCMD_ENUMFIELDSINCLASS 8..#define MONOCMD_ENUMMETHODSINCLASS 9..#define MONOCMD_COMPILEMETHOD 10....#define MONOCMD_GETMETHODHEADER 11..#define MONOCMD_GETMETHODHEADER_CODE 12..#define MONOCMD_LOOKUPRVA 13..#define MONOCMD_GETJITINFO 14..#define MONOCMD_FINDCLASS 15..#define MONOCMD_FINDMETHOD 16..#define MONOCMD_GETMETHODNAME 17..#define MONOCMD_GETMETHODCLASS 18..#define MONOCMD_GETCLASSNAME 19..#define MONOCMD_GETCLASSNAMESPACE 20..#define MONOCMD_FREEMETHOD 21..#define MONOCMD_TERMINATE 22..#define MONOCMD_DISASSEMBLE 23..#def

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-MKUU5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4749
Entropy (8bit):	5.050824950813426
Encrypted:	false
SSDEEP:	48:iDz9qCj948ryMvEsMXoQ/O04a0smj9Mn/jMi/Y3SfsdIrmjFFZpmb/RmAdnEm1pd:g5p1O33Bk+QF9jeh9pBdPpFN
MD5:	1E571535D8459B8A3FCBA0C9E4871FA4
SHA1:	1C0F2CED9985BA808A648C9D95D7DB5076082985
SHA-256:	E66368085DB41EF91395CC1212A970117376B5B535E97F291FD71B2277BA9619
SHA-512:	3369613A4BDE6B49C73AD70E8DF2EBE7BD1C05FD0D7CBC5E87C5F1F3408FA36F8D7A40C19B097E541A649D7C0F30EE9FDB46B677E926A7A862FA2B794FDC9A80
Malicious:	false
Preview:	//original source: blob.h in the mono sourcecode....../.. Encoding for type signatures used in the Metadata.. /..typedef enum {...MONO_TYPE_END = 0x00, / End of List /...MONO_TYPE_VOID = 0x01,...MONO_TYPE_BOOLEAN = 0x02,...MONO_TYPE_CHAR = 0x03,...MONO_TYPE_I1 = 0x04,...MONO_TYPE_U1 = 0x05,...MONO_TYPE_I2 = 0x06,...MONO_TYPE_U2 = 0x07,...MONO_TYPE_I4 = 0x08,...MONO_TYPE_U4 = 0x09,...MONO_TYPE_I8 = 0x0a,...MONO_TYPE_U8 = 0x0b,...MONO_TYPE_R4 = 0x0c,...MONO_TYPE_R8 = 0x0d,...MONO_TYPE_STRING = 0x0e,...MONO_TYPE_PTR = 0x0f, / arg: <type> token /...MONO_TYPE_BYREF = 0x10, / arg: <type> token /...MONO_TYPE_VALUETYPE = 0x11, / arg: <type> token /...MONO_TYPE_CLASS = 0x12, / arg: <type> token /...MONO_TYPE_VAR. = 0x13,. / number /...MONO_TYPE_ARRAY = 0x14, / type, rank, boundsCount, bound1, loCount, lo1 */..

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-U1HA7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	71747
Entropy (8bit):	5.443198228857467
Encrypted:	false
SSDEEP:	1536:23vsKL5IB9DGdvGgFmk2N8VBFFlIsc8bOJObk:20Kq8VBFNc85k
MD5:	6E26B821A5660C3FB1414DBBA46636BF
SHA1:	E5AFF92AABB4C902CA2CE617DD2546956648C462
SHA-256:	F125B75EE7CAC4F30B9C399B6A371B62A3960E4DB11A64F8937E469B9C2BDD40
SHA-512:	647514B0E0537F3018DB7F500FDA81801AB68E02F663892E4D3A3A9A71CBD303A356371C227BBAC3154E883AEFEDDEC699CF40C99B2096E6F993B8B857C2A316
Malicious:	false
Preview:	#ifdef _WINDOWS..#include "StdAfx.h"..#endif....#ifdef __APPLE__..#include "macport.h"..#endif....#include <setjmp.h>..#ifdef __linux__..#include <signal.h>..#include <sys/types.h>..#include <string.h>..#include <unistd.h>..#include <sys/syscall.h>....#if __GLIBC__ == 2 && __GLIBC_MINOR__ < 30..#define gettid() syscall(SYS_gettid)..#endif....#endif //linux........#include <signal.h>..#include <sys/types.h>....#include "PipeServer.h"........BOOL ExpectingAccessViolations = FALSE;....#ifdef _WINDOWS..#pragma warning( disable : 4101)..HANDLE MDC_ServerPipe = 0;..DWORD ExpectingAccessViolationsThread = 0;..#else..uint64_t ExpectingAccessViolationsThread = 0;..#endif....typedef uint64_t QWORD;......jmp_buf onError;....void ErrorThrow(void)..{...longjmp(onError, 1);..}......#ifdef _WINDOWS......int looper = 0;..LONG NTAPI ErrorFilter(struct _EXCEPTION_POINTERS *ExceptionInfo)..{...if ((ExpectingAccessViolations) && (GetCurrentThreadId() == ExpectingAccessViolationsThread) && (ExceptionInfo->

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-V7A9J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	361
Entropy (8bit):	5.139139694869984
Encrypted:	false
SSDEEP:	6:2+bxmgVJAl3JmgRF80JRiCIqj/uFSJAQaP5a0Tj/5vpL5a0iTVDzz4jLxwLDPVMy:lbxVJAl5XRF1JTfJAQQQIxvpLQ/PSNw/
MD5:	A9DA212C35E442501960243A47A7C4DA
SHA1:	DA608C4AA6EEF1755F29366EA40BF826F07FFEB3
SHA-256:	23042548A0B202F76F0B66332844D796FC20C4FB4937D92299156E503ABC3F1D
SHA-512:	8A6C5A941C051C52C9DF9B151B354F3C82ED4E8041D000CD6DC2869A99C16064F753A9B6391F15A0A51CDB3CC9972FA0D3F3F191BA813BA00FD6A185D042BD76
Malicious:	false
Preview:	#pragma once....extern HANDLE DataCollectorThread;..extern HANDLE SuicideThread;..extern HINSTANCE g_hInstance;..DWORD WINAPI DataCollectorEntry(LPVOID lpThreadParameter);..DWORD WINAPI SuicideCheck(LPVOID lpThreadParameter);....#ifdef __APPLE__..void MacPortEntryPoint(void param);..#endif....#ifdef __linux__..void LinuxPortEntryPoint(void param);..#endif..

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\is-VOMKC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1428
Entropy (8bit):	4.639223269334076
Encrypted:	false
SSDEEP:	24:l6u3qiYCydaR3mGlNMPfKge6KgeLTK1u2Pui:n39YdMmG/MPfKge6KgeLTK1/Gi
MD5:	33F3A8E602AC6644AF839ACB3CA10709
SHA1:	0F76681306EBBE5063DA4C93919104D3E0134046
SHA-256:	0CE7BD4B75FCF8800FAFFD3B0A315CBFE7B89271B8705E9216404AF4D737D0BB
SHA-512:	81898FCF08C2EA7817479852771E11A67D766FBA25B4FC7A77D23C993C4274D1C7C66953951051D2952D1B52630A1BA5C5268D7E67C1B9C696CA5EF427E5EC0D
Malicious:	false
Preview:	#pragma once....// The following macros define the minimum required platform. The minimum required platform..// is the earliest version of Windows, Internet Explorer etc. that has the necessary features to run ..// your application. The macros work by enabling all features available on platform versions up to and ..// including the version specified.....// Modify the following defines if you have to target a platform prior to the ones specified below...// Refer to MSDN for the latest info on corresponding values for different platforms...#ifndef WINVER // Specifies that the minimum required platform is Windows Vista...#define WINVER 0x0600 // Change this to the appropriate value to target other versions of Windows...#endif....#ifndef _WIN32_WINNT // Specifies that the minimum required platform is Windows Vista...#define _WIN32_WINNT 0x0600 // Change this to the appropriate value to target other versions of Windows...#endif....#ifndef

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\stdafx.cpp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	304
Entropy (8bit):	4.661406565301994
Encrypted:	false
SSDEEP:	6:jGmyXH+5AMRNT15eAaiErJAhQFm+yll+5FdllZ+sMKcaGIA0RQbyyeGgLxLELpcV:jGXXHJYx5fanrJAKE+yi5JlZ+4cWAoQI
MD5:	520DEFE1897C77FCE677BE903979DCA0
SHA1:	0EB32160624E8E3B72DF97E440EFCB211A09595C
SHA-256:	71E91D8847E8A4E4A757E441B7D785EDDDA95D55FF674E5054D0FDF781773361
SHA-512:	337D2893FB92760955D04E788E753B95C835A085929ED4144654899F9A54B96E84A7682A3C7885AA24F98E53FD5B2A2AC03D3F261CD3725F7D15E4422A2942A0
Malicious:	false
Preview:	// stdafx.cpp : source file that includes just the standard includes..// MonoDataCollector.pch will be the pre-compiled header..// stdafx.obj will contain the pre-compiled type information....#include "stdafx.h"....// TODO: reference any additional headers you need in STDAFX.H..// and not in this file..

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\MonoDataCollector\targetver.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1428
Entropy (8bit):	4.639223269334076
Encrypted:	false
SSDEEP:	24:l6u3qiYCydaR3mGlNMPfKge6KgeLTK1u2Pui:n39YdMmG/MPfKge6KgeLTK1/Gi
MD5:	33F3A8E602AC6644AF839ACB3CA10709
SHA1:	0F76681306EBBE5063DA4C93919104D3E0134046
SHA-256:	0CE7BD4B75FCF8800FAFFD3B0A315CBFE7B89271B8705E9216404AF4D737D0BB
SHA-512:	81898FCF08C2EA7817479852771E11A67D766FBA25B4FC7A77D23C993C4274D1C7C66953951051D2952D1B52630A1BA5C5268D7E67C1B9C696CA5EF427E5EC0D
Malicious:	false
Preview:	#pragma once....// The following macros define the minimum required platform. The minimum required platform..// is the earliest version of Windows, Internet Explorer etc. that has the necessary features to run ..// your application. The macros work by enabling all features available on platform versions up to and ..// including the version specified.....// Modify the following defines if you have to target a platform prior to the ones specified below...// Refer to MSDN for the latest info on corresponding values for different platforms...#ifndef WINVER // Specifies that the minimum required platform is Windows Vista...#define WINVER 0x0600 // Change this to the appropriate value to target other versions of Windows...#endif....#ifndef _WIN32_WINNT // Specifies that the minimum required platform is Windows Vista...#define _WIN32_WINNT 0x0600 // Change this to the appropriate value to target other versions of Windows...#endif....#ifndef

C:\Program Files\Cheat Engine 7.5\autorun\dlls\src\Mono\is-MB3S7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1351
Entropy (8bit):	5.483553389434968
Encrypted:	false
SSDEEP:	24:pPEkpnjkaUdex0H5p6DK/C868u8o2/b88W:pPTnjY6eqp8bo2/IZ
MD5:	9A2A2CADE7D370C563896D2C6F07D1C2
SHA1:	E01491AE49454E194C3B4DE2AE668AFEF27B3F3E
SHA-256:	287EE21B22308A8B979EB259417503D5B1542BBBF0859EE9344C085DE7866495
SHA-512:	CB9337B576030AF522180F16D8B52B36A9CC8099DB19A17D18CE92559C191CA4B61F27BBDA051E895A7E9455033BAB3C52FD057FA52F138F735DCC485F46B546
Malicious:	false
Preview:	...Microsoft Visual Studio Solution File, Format Version 12.00..# Visual Studio 2013..VisualStudioVersion = 12.0.30723.0..MinimumVisualStudioVersion = 10.0.40219.1..Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MonoDataCollector", "MonoDataCollector\MonoDataCollector.vcxproj", "{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}"..EndProject..Global...GlobalSection(SolutionConfigurationPlatforms) = preSolution....Debug\|Win32 = Debug\|Win32....Debug\|x64 = Debug\|x64....Release\|Win32 = Release\|Win32....Release\|x64 = Release\|x64...EndGlobalSection...GlobalSection(ProjectConfigurationPlatforms) = postSolution....{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}.Debug\|Win32.ActiveCfg = Debug\|Win32....{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}.Debug\|Win32.Build.0 = Debug\|Win32....{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}.Debug\|x64.ActiveCfg = Debug\|x64....{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}.Debug\|x64.Build.0 = Debug\|x64....{941726A9-FAAD-49FD-9D69-A5D27B3DB4BA}.Release\|Win32.ActiveCfg = Release\|Win32....{941726A

C:\Program Files\Cheat Engine 7.5\autorun\dotnetinfo.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with very long lines (338), with CRLF line terminators
Category:	dropped
Size (bytes):	84022
Entropy (8bit):	4.86677649912196
Encrypted:	false
SSDEEP:	1536:yui2L/B3vpXErHBRpUPrEUvh8VRzXzycAcnNSoaam0WEj:yurB6rhRpUPr9vszjycAcYoaam0WEj
MD5:	F30091A31003345EAE2A915D1EE13E9D
SHA1:	B42C1B7DA7E620A89A68274C7551D7BB3806441C
SHA-256:	CC505DA9EA622E39783D6AC0A98370E1B58EBA6702B9A1796FDC869AEEBBA261
SHA-512:	A9A801F42BF9A1ED54CBC2DC7AC397E6695EB685D4F03313059B08DB23ED9055727168B9AFFEE94416A584F703B9B97D515B6BC02FEF99F8EF6FB4B372AEE65E
Malicious:	false
Preview:	--dotnetinfo is a passive .net query tool, but it can go to a active state if needed....if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'dotnetinfo.po')..end....if getOperatingSystem()==0 then.. pathsep=[[\]]..else.. pathsep='/'..end....debugInstanceLookup=false....local DPIMultiplier=(getScreenDPI()/96)..local CONTROL_MONO=0..local CONTROL_DOTNET=1....DataSource={} --All collected data about the current process. From domains, to images, to classes, to fields and methods. Saves on queries and multiple windows can use it..local CurrentProcess....local ELEMENT_TYPE_END = 0x00 -- End of List..local ELEMENT_TYPE_VOID = 0x01..local ELEMENT_TYPE_BOOLEAN = 0x02..local ELEMENT_TYPE_CHAR = 0x03..local ELEMENT_TYPE_I1 = 0x04..local ELEMENT_TYPE_U1 = 0x05..local ELEMENT_TYPE_I2 = 0x06..local ELEMENT_TYPE_U2 = 0x07..local ELEMENT_TYPE_I4 = 0x08..local ELEMENT_TYPE_U4 = 0x09..local ELEMENT_TYPE_I8

C:\Program Files\Cheat Engine 7.5\autorun\dotnetpatch.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7984
Entropy (8bit):	4.628436564346363
Encrypted:	false
SSDEEP:	192:hG6G275/GPinZJGJBo2HXwymhmBEO/66dogk:fG4/vnZJGJv3qABPm
MD5:	6BFAA8047A8912C979D8B7ADC21BEFC4
SHA1:	9DEB3F151A70B1DE2AF921E2C4A05A9AFBFE88DA
SHA-256:	7EFC51C61CEC0EF4330C63E8848AD17BF707CC7067F8F5E195AE69D373BF4D24
SHA-512:	BEC70863FE63321EC815164A84FC82F7F03139E668AC165E218B033C2E79150B405AE553CBD8543F3AEDC839DB35FC74C14348E080598FB7BC25FB7908386A0E
Malicious:	false
Preview:	--patches a dotnet method. Prerequisite: Must not be inlined or generic, or anything complex....function ParseScriptTokens(script,values).. --parses the script for <> entries and looks up the value in the values table.. if script==nil then .. print(debug.traceback()).. error('ParseScriptTokens: script is nil') .. end.. if values==nil then .. print(debug.traceback()).. error('ParseScriptTokens: values is nil') .. end.. .. return string.gsub(script,"<(.-)>",function(v) .. local r=values[v].. if r then return r else return x end.. end)..end....function dotnetpatch_getAllReferences().. --gets a list of all assemblies.. --todo: if they are in-memory only, export them to a file first (create the mz/pe manually, just the metadata).. local r={}.. local sysfile.... if monopipe then.. mono_enumImages(function(img).. local n=mono_image_get_filename(img).. local ln=extractFileName(n:lower()).. if ln~='mscorlib.dll' and ln~='netstandard.dll' then..

C:\Program Files\Cheat Engine 7.5\autorun\dotnetsearch.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15160
Entropy (8bit):	4.132367012227535
Encrypted:	false
SSDEEP:	384:fTJbJcJtJZJtJeJAmDF3zY0PLTuHrRthutT9AT0HqkVWAcK3wMexR9WnraIeBXjJ:LJbJcJtJZJtJeJAmDF3zY0jTuHr7huFG
MD5:	C5D67D9CB5017F96F34CB9BA0F08FDF0
SHA1:	53DCA47CF042380F8DBC3399832A559A2C7368BD
SHA-256:	42896BBE75C79C381CC90FBAE685DA24013CAAD0786F1B1A4B569620C45F3F72
SHA-512:	C2F41A7C1A25B66B9DC0A496AD87818C9C7E3F70CEB82344AD7F664764293D2F9A43E607A4A299597E44B6763B3BFC63AD8F4EB01C6BD68EAE4BB04ACF775F42
Malicious:	false
Preview:	--dotnetsearch..if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'dotnetsearch.po')..end....function spawnDotNetSearchDialog(DataSource, frmDotNetInfo, searchtype).... local currentScan --rule: only writable in mainthread.. local searchresults={}.. .. .. --spawns a searchdialog. searchtype has 3 options: 0-ClassName, 1-FieldName, 2-MethodName.. local frmSearch=createFormFromFile(getAutorunPath()..'forms'..pathsep..'DotNetSearch.frm') .. .. _G.frmSearch=frmSearch.. .. if searchtype==0 then.. frmSearch.Caption=translate('Find Class') .. frmSearch.cbLimitToCurrentBase.Caption=translate('Limit to current image').. .. frmSearch.cbLimitToCurrentBase.Enabled=frmDotNetInfo.lbImages.ItemIndex>=0 .. frmSearch.lvResults.Columns.delete(2).. elseif searchtype==1 then.. frmSearch.Caption=translate('Find Field') .. frmSearch.cbLimitToCurrentBase.Caption=translate('Limit to current class').. frmSearch.cbLimitToCurrentBase.Enabled=f

C:\Program Files\Cheat Engine 7.5\autorun\eatme.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.052893474705733
Encrypted:	false
SSDEEP:	6:jFwErIVt0OdI+eGvJYazVId2EA3ivun0gVVjec0Lg0zVCAMBNXnGCWMdO:5myTjOId2p3ivIVje5tVDMBRnGV5
MD5:	9BA24A4B8CB68B40D229109565572F78
SHA1:	F2DABC40C3761FD9196291AB42943D580062CD11
SHA-256:	8B5608DAEDB4370990B65579EE8D1D5623644FD9C0BBE007211D5837DC690C72
SHA-512:	BEFA54FD6A87BAF24030B6E292E0D8E674FBD69B3424184582EB38D8AF2C8459E7728BC6F03032735A6A1B6C5FE459ECDB1C862BDBD390DC695F4085ABC3918A
Malicious:	false
Preview:	--Alice says hi!....local t=createTimer()..t.Interval=110000..t.OnTimer=function().. local f=getForm(0).. f.Width=f.Width+2.. f.Height=f.Height+2.... if t.Interval>10000 then.. t.Interval=t.Interval-10000.. end.... createMemoryStream().Size=math.random(655364,6553632);..end

C:\Program Files\Cheat Engine 7.5\autorun\forms\DotNetInfo.frm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1926), with CRLF line terminators
Category:	dropped
Size (bytes):	1993
Entropy (8bit):	6.43677382842252
Encrypted:	false
SSDEEP:	48:cmQhOHjryH7ijmpX5ewpjITkwEd0b+huow2zaj5pq:CIrgPX5vdq3/idAq
MD5:	14F06EC8B7A351563865937D340EC91C
SHA1:	AE85AF607F8958536689E4D2D1266D69F7FAFA68
SHA-256:	CD9C88B16FFB21F47D97708AB737E0BFDA712B2DB509A32BEA7AA7AE8DE7098B
SHA-512:	BCD1B9BCA9C20C8B4F9144502302A611E7D4C1ED26B9C4A19E3A0A75F1F649B1CD0DE1F5FD4D90512563385AD439720DCE22C4202D80A244AE572EFDEF6C1EED
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <frmDotNetInfo Class="TCEForm" Encoding="Ascii85">y.#q08${e{AGUXGCxM1kqPG/i5}]^,l!AIdg4m5yS9W5;CPhdb#:B#C:/LpFckDKmxb=t,_APZZ!}t:skdTmi/HDT[S0p(1ikY2RduP3A=Nn[p?xGn,:6mmb?6DUt,0nE=ueE0lng:Zs]J1E2zfI@7r0rltN+y=(:BGyG4n+S#HQz0n0{]4Yy=hUObYecXHuqhMX0S.D8WC)(?vIB!gm_(l1R,Hvs8n}44h9alw$a2022_R5X4b^=,_,Ftqj4{mKJ4_^/]b;dg}8OS[/k3lpw=-2PGJ.tlh%#hz1?#=[p}{geHf8x+dPz;?v!ZKF@mQ1U$hkTe/lZQXcF@JT6rI^eXI):eC2k7L;]R#A#hPJ-sK_0cuN)Ya6@W%qe;fuQsNuN,_]Nzp!fT;gSJ_JpjXFZpYBI8grn7V#?L3EPg_.%:H!cKcw)(fQ8+62lPS+@je!jUVLYYLA4_Fp04p]eN=_HjVvd!(?B;n.67#8sEqI;yNJ]5v(_wBOBl/Ry/fl[/P}NwO1M8YUs/(l?Rl=JMa,Qf+wuYw-BZ/QUMz86+Hg:Fq5wVt}kD;3=c0Sd]R!0fL1p85Jc_8aXBix4^?J?i2KBTc3=236GOX^u5PjNZxT!+tLow_@bR9%ro8OaGYqZDC}gq!Ei;yj?mYz;ysTQd7vzxKYh=}.ISwgUUu%@z4#}}WFVk(Vro7qKHx5kdTkl!g!SX^Do])2v6m7sP6o_$/9?5W?XS;F,8PfT0V#4?2x3o0f9{$@TH={m;C).e3oFF9qzbuuc@x0ib00SaFlUq=Q}Wc:ihFzIY}t#YR.LI+ut{A[vZCKRuZ.behF=[tW2kV5O3+o^G{t^Lt*$Sw2XXk78c2@eb0,v97^OAX[/HBQ-G(Z$-Jg)S@92.e%43)1

C:\Program Files\Cheat Engine 7.5\autorun\forms\DotNetSearch.frm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (929), with CRLF line terminators
Category:	dropped
Size (bytes):	996
Entropy (8bit):	6.420065473502429
Encrypted:	false
SSDEEP:	24:2dxxNUQ7V0EdLp1H9DTFhJMSqL3bi3LMo7CTNzErduIkjbnw:c/+QdLbHpTB5w3bUApe47bw
MD5:	C884C42A2BA59904C39D9825F0A5FFAF
SHA1:	D18E6CEEEC9D9CB6562E006EF6112C528E814D24
SHA-256:	A74C6BB9A778F806577A2528BCACD3E9CB0BD5CAAEF5D92C2B1ADF101BB9E57D
SHA-512:	23C2368BBCF228B536DBE64FFC5FEF8E0D87D3D65B7BB9CD25369D9A727C8F2B04754B4A3404F31CD14B4D0C6A2AC6492D0CBCB66CB5A0E2B056C42D39BF9F51
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <frmDotNetSearch Class="TCEForm" Encoding="Ascii85">rIgQd):ZUm6{gG,wv$rY.mC+=4s8!D?B{2Lp]8hBhy$DzdzygNFG@E8:it!.T3om=i=6}E0XOvIFkc@E_DY4yT9,-#4UHqe1VPI__NwQqA@ma.eiSD-[nDw:Nf.YK=ToYn:f$y7V9u]]m1@9=mWuvkx;pV$p)qL}z{$Hf:q@y,+;0#4KPtjB:IXKz4HWxN{320}YHc8dSYFy26;%+Jusi3{qJAOiCm6xuOpeU_F=4DNhBA3}aOo#tQ_FS%$V:lZ)j]i]3((L,b3C?(HncBP6zg$a$An4ET$%tVY0zU0_Vr0s@,$,QgFNAN32(C3}]KoJs.)Z)aW)):f:jYoD10{3{vzRw6DZwNHL7JT9RLwOehhe-S0h;ou/D0Y0SIMfRct}XDIkVvHwvXwfInQlW_+630snXdbRkE_V-th;;q-0VNBTTy(?P}RNpVekqEd4?35RB4QS@VkP5F[O^#2:4U-6S@mbHfBoYxJYk8r^{j6,(7!X./;th[[XxW8hx7K3]Knas_tJ^]dn0mEp%[C%)-/Eyz)nqa;l@pYTHM9oi?ST7,y-WgB?CAPN#;cu7}:gZ$v=bkQ0D6b-Q%Whuduq[]/A-e6#]?=A5XEUZpGRTxYTJq]VLi;gy7:#ES6ol;ltfDs6-h}c6VCExC)]unsxcacZv!fF-{1FACRzfX/i34cO@q7i;dtI.VGjH^GqrMC/N1^oP?5b0WPNN?7@W=MK^yh%#g7bp^ewvj/mGg*9cka}haFRFb/D:E2$l]^4RCRmJQnrr+m)O}$e)?qEKw-zJ3E%x3xR;Y#c[[o8uNiWq^hBX7RBn+3inzis1@DzKYpgxGJIi;r,=lepMf!EG71Uj</frmDotNetSearch>..</FormData>..

C:\Program Files\Cheat Engine 7.5\autorun\forms\MonoDataCollector.frm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1475), with CRLF line terminators
Category:	dropped
Size (bytes):	1542
Entropy (8bit):	6.413889728128656
Encrypted:	false
SSDEEP:	24:2dl+Q7dIn/BzGXaMSRuVQn3b/Go2DG0E2Gy6UylxJvaKoj+RSGrsuwdKiVrcfBkd:cwQq/BzGXkL/b2TOXNPSich4C/8/Tm
MD5:	03D4DD46084BCBE16A39D72BA22E5446
SHA1:	BA414E6BA6CD5503BABA82A7A96272D850CB9CD1
SHA-256:	4F254BBC897AD0E165986D18577E0A04FD31C93CCA542A0999FA0093EDC5BC61
SHA-512:	B37CF277443F3D4D9C8207E17EF146FABE003402750F812C27369210C79E43BAF45FB49AC2B370D2B1B1077912C9B9A9EA4AA4F7D5166B9FA1A152384902E19D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <monoForm_1_1 Class="TCEForm" Encoding="Ascii85">eO6mj/2DpF2@.4Ig;G5sOfPPy=X+mXmX_)uN{bTn76[BLz#F5rPl$;vd1M9HnSJaJYyVkwEL%3%=2}nF-#Pwtbfh-{#_h4le_7[Zd?N/j0G3CxIVl-Tt9)?YX7s:c?6YtsoKA,wF8l}_8rhk)nu{amo3+PiK2pcHcxe(7tu6?PzgEo83nHLxUbg,MlQnEPl2!8-YKCRSBKqmky6BQHxn?rB;=xeJ4p9{rt}d=-quK+2^k8oFyR3}jWf[C2io/H!hI^a$ck,[9h)ztZIz_IIAZjMyIsOeE!!hlkQGxC1,j?}ecU?2$tuZ.;YjFcLpSya]vv+n}D25F#U[YuC8J#Bakg.IOV:zj3g:LH_^nvcpY4ns:/[x9{;bNG.ihRQZvmMOb6TQP8[Y2C:1%sn%6V{lTthFXvLoZNsbNCnTQ{AXl,sA5Z6VKn[8GJ#r@LqrF4d2E{l=sf;4,Vp;Q1t!2,738?OIV4ADrEd(hD5fn{n=i96,.O@o7EU.lhp=B.-T==L_#pwm.iGSn9bOwJ?WxJ+QMhluXM#Eco$0FozncAtuZ@m?O?5C+ff=A5m!t9J6AY3W/$ymMEm/!.}D!_qF8vY:re{I}t[=k?%KF{({a@hvm0]keqz$Rzy@JYRJ2?HAl.^%=zh(/%=n@WwaMf7ge@tS,LDcfRis;:s)Sap?DS4J!e]pqrrJfTM,;tj7G9V,j5!^msB80nS.@Z3S/Si}Q^B8ms:1P?P[1Oi,28S.#qwqXfLKCGaTlMC;qvdKhN!DxMy5F1htiZSE.lav8jEIqNtv6yOy!Bb+iy7=A@!qneIoK)z[4-mUXIZ^I_}{w7z-fO6nnQ6_gAH:2eleV^^EAB1xH1OA.z:vZoaV+O]M=csyI)Q;:P+J2CYo5CvKP6#

C:\Program Files\Cheat Engine 7.5\autorun\forms\is-158C0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1475), with CRLF line terminators
Category:	dropped
Size (bytes):	1542
Entropy (8bit):	6.413889728128656
Encrypted:	false
SSDEEP:	24:2dl+Q7dIn/BzGXaMSRuVQn3b/Go2DG0E2Gy6UylxJvaKoj+RSGrsuwdKiVrcfBkd:cwQq/BzGXkL/b2TOXNPSich4C/8/Tm
MD5:	03D4DD46084BCBE16A39D72BA22E5446
SHA1:	BA414E6BA6CD5503BABA82A7A96272D850CB9CD1
SHA-256:	4F254BBC897AD0E165986D18577E0A04FD31C93CCA542A0999FA0093EDC5BC61
SHA-512:	B37CF277443F3D4D9C8207E17EF146FABE003402750F812C27369210C79E43BAF45FB49AC2B370D2B1B1077912C9B9A9EA4AA4F7D5166B9FA1A152384902E19D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <monoForm_1_1 Class="TCEForm" Encoding="Ascii85">eO6mj/2DpF2@.4Ig;G5sOfPPy=X+mXmX_)uN{bTn76[BLz#F5rPl$;vd1M9HnSJaJYyVkwEL%3%=2}nF-#Pwtbfh-{#_h4le_7[Zd?N/j0G3CxIVl-Tt9)?YX7s:c?6YtsoKA,wF8l}_8rhk)nu{amo3+PiK2pcHcxe(7tu6?PzgEo83nHLxUbg,MlQnEPl2!8-YKCRSBKqmky6BQHxn?rB;=xeJ4p9{rt}d=-quK+2^k8oFyR3}jWf[C2io/H!hI^a$ck,[9h)ztZIz_IIAZjMyIsOeE!!hlkQGxC1,j?}ecU?2$tuZ.;YjFcLpSya]vv+n}D25F#U[YuC8J#Bakg.IOV:zj3g:LH_^nvcpY4ns:/[x9{;bNG.ihRQZvmMOb6TQP8[Y2C:1%sn%6V{lTthFXvLoZNsbNCnTQ{AXl,sA5Z6VKn[8GJ#r@LqrF4d2E{l=sf;4,Vp;Q1t!2,738?OIV4ADrEd(hD5fn{n=i96,.O@o7EU.lhp=B.-T==L_#pwm.iGSn9bOwJ?WxJ+QMhluXM#Eco$0FozncAtuZ@m?O?5C+ff=A5m!t9J6AY3W/$ymMEm/!.}D!_qF8vY:re{I}t[=k?%KF{({a@hvm0]keqz$Rzy@JYRJ2?HAl.^%=zh(/%=n@WwaMf7ge@tS,LDcfRis;:s)Sap?DS4J!e]pqrrJfTM,;tj7G9V,j5!^msB80nS.@Z3S/Si}Q^B8ms:1P?P[1Oi,28S.#qwqXfLKCGaTlMC;qvdKhN!DxMy5F1htiZSE.lav8jEIqNtv6yOy!Bb+iy7=A@!qneIoK)z[4-mUXIZ^I_}{w7z-fO6nnQ6_gAH:2eleV^^EAB1xH1OA.z:vZoaV+O]M=csyI)Q;:P+J2CYo5CvKP6#

C:\Program Files\Cheat Engine 7.5\autorun\forms\is-IH2QN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (929), with CRLF line terminators
Category:	dropped
Size (bytes):	996
Entropy (8bit):	6.420065473502429
Encrypted:	false
SSDEEP:	24:2dxxNUQ7V0EdLp1H9DTFhJMSqL3bi3LMo7CTNzErduIkjbnw:c/+QdLbHpTB5w3bUApe47bw
MD5:	C884C42A2BA59904C39D9825F0A5FFAF
SHA1:	D18E6CEEEC9D9CB6562E006EF6112C528E814D24
SHA-256:	A74C6BB9A778F806577A2528BCACD3E9CB0BD5CAAEF5D92C2B1ADF101BB9E57D
SHA-512:	23C2368BBCF228B536DBE64FFC5FEF8E0D87D3D65B7BB9CD25369D9A727C8F2B04754B4A3404F31CD14B4D0C6A2AC6492D0CBCB66CB5A0E2B056C42D39BF9F51
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <frmDotNetSearch Class="TCEForm" Encoding="Ascii85">rIgQd):ZUm6{gG,wv$rY.mC+=4s8!D?B{2Lp]8hBhy$DzdzygNFG@E8:it!.T3om=i=6}E0XOvIFkc@E_DY4yT9,-#4UHqe1VPI__NwQqA@ma.eiSD-[nDw:Nf.YK=ToYn:f$y7V9u]]m1@9=mWuvkx;pV$p)qL}z{$Hf:q@y,+;0#4KPtjB:IXKz4HWxN{320}YHc8dSYFy26;%+Jusi3{qJAOiCm6xuOpeU_F=4DNhBA3}aOo#tQ_FS%$V:lZ)j]i]3((L,b3C?(HncBP6zg$a$An4ET$%tVY0zU0_Vr0s@,$,QgFNAN32(C3}]KoJs.)Z)aW)):f:jYoD10{3{vzRw6DZwNHL7JT9RLwOehhe-S0h;ou/D0Y0SIMfRct}XDIkVvHwvXwfInQlW_+630snXdbRkE_V-th;;q-0VNBTTy(?P}RNpVekqEd4?35RB4QS@VkP5F[O^#2:4U-6S@mbHfBoYxJYk8r^{j6,(7!X./;th[[XxW8hx7K3]Knas_tJ^]dn0mEp%[C%)-/Eyz)nqa;l@pYTHM9oi?ST7,y-WgB?CAPN#;cu7}:gZ$v=bkQ0D6b-Q%Whuduq[]/A-e6#]?=A5XEUZpGRTxYTJq]VLi;gy7:#ES6ol;ltfDs6-h}c6VCExC)]unsxcacZv!fF-{1FACRzfX/i34cO@q7i;dtI.VGjH^GqrMC/N1^oP?5b0WPNN?7@W=MK^yh%#g7bp^ewvj/mGg*9cka}haFRFb/D:E2$l]^4RCRmJQnrr+m)O}$e)?qEKw-zJ3E%x3xR;Y#c[[o8uNiWq^hBX7RBn+3inzis1@DzKYpgxGJIi;r,=lepMf!EG71Uj</frmDotNetSearch>..</FormData>..

C:\Program Files\Cheat Engine 7.5\autorun\forms\is-Q50JT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, ASCII text, with very long lines (1926), with CRLF line terminators
Category:	dropped
Size (bytes):	1993
Entropy (8bit):	6.43677382842252
Encrypted:	false
SSDEEP:	48:cmQhOHjryH7ijmpX5ewpjITkwEd0b+huow2zaj5pq:CIrgPX5vdq3/idAq
MD5:	14F06EC8B7A351563865937D340EC91C
SHA1:	AE85AF607F8958536689E4D2D1266D69F7FAFA68
SHA-256:	CD9C88B16FFB21F47D97708AB737E0BFDA712B2DB509A32BEA7AA7AE8DE7098B
SHA-512:	BCD1B9BCA9C20C8B4F9144502302A611E7D4C1ED26B9C4A19E3A0A75F1F649B1CD0DE1F5FD4D90512563385AD439720DCE22C4202D80A244AE572EFDEF6C1EED
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<FormData>.. <frmDotNetInfo Class="TCEForm" Encoding="Ascii85">y.#q08${e{AGUXGCxM1kqPG/i5}]^,l!AIdg4m5yS9W5;CPhdb#:B#C:/LpFckDKmxb=t,_APZZ!}t:skdTmi/HDT[S0p(1ikY2RduP3A=Nn[p?xGn,:6mmb?6DUt,0nE=ueE0lng:Zs]J1E2zfI@7r0rltN+y=(:BGyG4n+S#HQz0n0{]4Yy=hUObYecXHuqhMX0S.D8WC)(?vIB!gm_(l1R,Hvs8n}44h9alw$a2022_R5X4b^=,_,Ftqj4{mKJ4_^/]b;dg}8OS[/k3lpw=-2PGJ.tlh%#hz1?#=[p}{geHf8x+dPz;?v!ZKF@mQ1U$hkTe/lZQXcF@JT6rI^eXI):eC2k7L;]R#A#hPJ-sK_0cuN)Ya6@W%qe;fuQsNuN,_]Nzp!fT;gSJ_JpjXFZpYBI8grn7V#?L3EPg_.%:H!cKcw)(fQ8+62lPS+@je!jUVLYYLA4_Fp04p]eN=_HjVvd!(?B;n.67#8sEqI;yNJ]5v(_wBOBl/Ry/fl[/P}NwO1M8YUs/(l?Rl=JMa,Qf+wuYw-BZ/QUMz86+Hg:Fq5wVt}kD;3=c0Sd]R!0fL1p85Jc_8aXBix4^?J?i2KBTc3=236GOX^u5PjNZxT!+tLow_@bR9%ro8OaGYqZDC}gq!Ei;yj?mYz;ysTQd7vzxKYh=}.ISwgUUu%@z4#}}WFVk(Vro7qKHx5kdTkl!g!SX^Do])2v6m7sP6o_$/9?5W?XS;F,8PfT0V#4?2x3o0f9{$@TH={m;C).e3oFF9qzbuuc@x0ib00SaFlUq=Q}Wc:ihFzIY}t#YR.LI+ut{A[vZCKRuZ.behF=[tW2kV5O3+o^G{t^Lt*$Sw2XXk78c2@eb0,v97^OAX[/HBQ-G(Z$-Jg)S@92.e%43)1

C:\Program Files\Cheat Engine 7.5\autorun\images\export128x128.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1498
Entropy (8bit):	7.563086239733145
Encrypted:	false
SSDEEP:	24:2sH8UyMTD18ODCZk7X4zJz2pAlNrpAmvnFtljgCie8pYiOZqfE9St7Bq:2sH83sok7X+gAlBVZjzi7pYi8VKc
MD5:	A9BCD80603FBCF041BC462918CA48A64
SHA1:	A7908250F042B3454D8DDCB5CB20E569839BE135
SHA-256:	3E671AC6A8E77F11B4C6547CF810BC06327E84961C7657340F5CA0F622A966D9
SHA-512:	CE82C8CAABA0329656C26EFD5F7C86A0B35A161856B975C9918FD1CD503B32B133D6F0B01DAFB92AAE132DD4C19F23C7349BF146123554700E05AA94320FC0AF
Malicious:	false
Preview:	.PNG........IHDR..............>a.....pHYs...........~.....IDATx..Qh[U......%.cX.<.7..B..}.9[..A..N..'..Z\|\.E...M\|..d.U...V.x...Yl..K..GN..5...9....BK..9..q.w.9GH)..%.....0..Y....o...R..cj...9.....7F.........LDi).mZ.[.077..:.A.T.l6K.r..2mZ;Z.....S(.hdd.....2.Y5..O..`xx........!...=..d2.ZXXp.RcBFJ.hB.!...\| .J....%(.^w..>.H$......Q..C..P.......g...u.7...Q......:....gT>.N.iee.)X%.)]....>....x.)X...41........X.:'..r..C@....\|>...... @..\|@=.,--9...........]'......!..v...I"m.....t^4...At\4.......vR.\|.C@.i.h.......0.-.a...M...K);.:>z.........3......PS....0..0..0..0..0..0..0..0..0..h.."#.H.];../....AK..tFn.z..}....@c.?q....'.CG..J...9...S.?.z....)....7A.W>........][.`...=..?..........D..@...[..` ~J...EI.....V.X...m..0..iz.....\.....i..0.%..k_X...7c.K^[..B.#Ac..W...`bbB-..{MNN..sU}%...^..~%hzd.I.\.J.?=az3\|..`....j..o..C@....@...E...R....................}."....!..g..B.....7b...I.............0....O..o(..(v..%%.....A....9..c..g.6....QZ,8..s.(..LX_]._.{

C:\Program Files\Cheat Engine 7.5\autorun\images\import128x128.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1169
Entropy (8bit):	7.406441361590178
Encrypted:	false
SSDEEP:	24:RjlRKcz+Q1mlGwDxsQMod1x2W3QL9IR/RBTz:1lRK8sNDwobx2WgBIljTz
MD5:	660D8ACF876EAD3B985F9DF515160838
SHA1:	78A858326C16FA917C4A5284A606B824F025AF00
SHA-256:	4923FBF164D8DC0111E28DC1864BAC8CA2503FEE2B7A688845B4616465529EE6
SHA-512:	81BFF98BCE7CC6EE066FE8E1AB1FA957E56C62084A33D879A87CA22AFDF6D88012F1ECDF5DCF2493D816B96DD08073782F31F36DA9BCA37C53FC81CCFAB1E17A
Malicious:	false
Preview:	.PNG........IHDR..............>a.....pHYs...........~....CIDATx..MHTQ......i.".)W.A.`.B...jc.i.. .h..2.ha.J7E..jm...........M.Q.g<.SC...s.y....:s.7.}...s........cC........7O..HI.M..R....F9.....c;n..t....k.).F.HP{.....U........P.p(.8...........C.....P.p(.8...........C.....P.p(.8...........C.....P.p(.8...........C.....P.p(.8...........C.....P.p(.8...........C.....P.p(.8...........C.....P.p(.8......3?.o...w.Q...Uq..... "q...m9 .-..........B^.:....W}8""N.`.....A.../......7...N.J.......tum....+u9u............./....&...W..H.z...e............./>t.eK.0.......K..KO`F././.......Fk..}._\|.......{=1r.I..&.Mk.%\|q.#h;.c.WE..<.m.;Q....q_r}m....T... ..tVE.. AV....].x9......._......... ......%A(.K.7..[...P....../.^.lE....h..~Q.==zSf_?.\|.M..`wwo.=^..Ab8....../!. ..........v*.......J.....zW..eS.C..^Nk.....u.B._B..d0.4.4.N5.>..wO..?.4{.Z.P.:+I...48.0.=.J..01$_......A..-\|A...?.\|...3`.......sf.....s.Z.sc.F.5..S.....C.>.mg.e........y1...[N.+..\![..w:cZ...w..~6...,...

C:\Program Files\Cheat Engine 7.5\autorun\images\is-0BI9T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1169
Entropy (8bit):	7.406441361590178
Encrypted:	false
SSDEEP:	24:RjlRKcz+Q1mlGwDxsQMod1x2W3QL9IR/RBTz:1lRK8sNDwobx2WgBIljTz
MD5:	660D8ACF876EAD3B985F9DF515160838
SHA1:	78A858326C16FA917C4A5284A606B824F025AF00
SHA-256:	4923FBF164D8DC0111E28DC1864BAC8CA2503FEE2B7A688845B4616465529EE6
SHA-512:	81BFF98BCE7CC6EE066FE8E1AB1FA957E56C62084A33D879A87CA22AFDF6D88012F1ECDF5DCF2493D816B96DD08073782F31F36DA9BCA37C53FC81CCFAB1E17A
Malicious:	false
Preview:	.PNG........IHDR..............>a.....pHYs...........~....CIDATx..MHTQ......i.".)W.A.`.B...jc.i.. .h..2.ha.J7E..jm...........M.Q.g<.SC...s.y....:s.7.}...s........cC........7O..HI.M..R....F9.....c;n..t....k.).F.HP{.....U........P.p(.8...........C.....P.p(.8...........C.....P.p(.8...........C.....P.p(.8...........C.....P.p(.8...........C.....P.p(.8...........C.....P.p(.8...........C.....P.p(.8......3?.o...w.Q...Uq..... "q...m9 .-..........B^.:....W}8""N.`.....A.../......7...N.J.......tum....+u9u............./....&...W..H.z...e............./>t.eK.0.......K..KO`F././.......Fk..}._\|.......{=1r.I..&.Mk.%\|q.#h;.c.WE..<.m.;Q....q_r}m....T... ..tVE.. AV....].x9......._......... ......%A(.K.7..[...P....../.^.lE....h..~Q.==zSf_?.\|.M..`wwo.=^..Ab8....../!. ..........v*.......J.....zW..eS.C..^Nk.....u.B._B..d0.4.4.N5.>..wO..?.4{.Z.P.:+I...48.0.=.J..01$_......A..-\|A...?.\|...3`.......sf.....s.Z.sc.F.5..S.....C.>.mg.e........y1...[N.+..\![..w:cZ...w..~6...,...

C:\Program Files\Cheat Engine 7.5\autorun\images\is-U6823.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1498
Entropy (8bit):	7.563086239733145
Encrypted:	false
SSDEEP:	24:2sH8UyMTD18ODCZk7X4zJz2pAlNrpAmvnFtljgCie8pYiOZqfE9St7Bq:2sH83sok7X+gAlBVZjzi7pYi8VKc
MD5:	A9BCD80603FBCF041BC462918CA48A64
SHA1:	A7908250F042B3454D8DDCB5CB20E569839BE135
SHA-256:	3E671AC6A8E77F11B4C6547CF810BC06327E84961C7657340F5CA0F622A966D9
SHA-512:	CE82C8CAABA0329656C26EFD5F7C86A0B35A161856B975C9918FD1CD503B32B133D6F0B01DAFB92AAE132DD4C19F23C7349BF146123554700E05AA94320FC0AF
Malicious:	false
Preview:	.PNG........IHDR..............>a.....pHYs...........~.....IDATx..Qh[U......%.cX.<.7..B..}.9[..A..N..'..Z\|\.E...M\|..d.U...V.x...Yl..K..GN..5...9....BK..9..q.w.9GH)..%.....0..Y....o...R..cj...9.....7F.........LDi).mZ.[.077..:.A.T.l6K.r..2mZ;Z.....S(.hdd.....2.Y5..O..`xx........!...=..d2.ZXXp.RcBFJ.hB.!...\| .J....%(.^w..>.H$......Q..C..P.......g...u.7...Q......:....gT>.N.iee.)X%.)]....>....x.)X...41........X.:'..r..C@....\|>...... @..\|@=.,--9...........]'......!..v...I"m.....t^4...At\4.......vR.\|.C@.i.h.......0.-.a...M...K);.:>z.........3......PS....0..0..0..0..0..0..0..0..0..h.."#.H.];../....AK..tFn.z..}....@c.?q....'.CG..J...9...S.?.z....)....7A.W>........][.`...=..?..........D..@...[..` ~J...EI.....V.X...m..0..iz.....\.....i..0.%..k_X...7c.K^[..B.#Ac..W...`bbB-..{MNN..sU}%...^..~%hzd.I.\.J.?=az3\|..`....j..o..C@....@...E...R....................}."....!..g..B.....7b...I.............0....O..o(..(v..%%.....A....9..c..g.6....QZ,8..s.(..LX_]._.{

C:\Program Files\Cheat Engine 7.5\autorun\is-033OV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with very long lines (301), with CRLF line terminators
Category:	dropped
Size (bytes):	57578
Entropy (8bit):	4.965043624755705
Encrypted:	false
SSDEEP:	1536:SDN7O8gQVISPW3R89Mvybxj/kTdg4YXj2P:SDN7OiPW3W9MvybxjM/dP
MD5:	49C105DC0F4E732802284180722747C2
SHA1:	CDC575490B51A252202BB5E37F0536870DD3CCA0
SHA-256:	43DAE8CFAA2C16B3D94C748DE250BBA2E16E9789C8B2F3395CB6ED4F79E624C6
SHA-512:	B3A582E1FB4BAF003F40262C888ADF84041874E729A97D8CFAED581C84B7B3F5823DAFA4249607D4E79B62AA30BC207632ECA9522A0866EDF1C57CFC8296EFE7
Malicious:	false
Preview:	if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'pseudocodediagram.po')..end......--[[pseudocodediagram.lua]]--....local DPIAdjust=getScreenDPI()/96....--Global..diagramstyle = {}..diagramstyle.instruction_registerstyle = '[31;1m' --red + bold..diagramstyle.instruction_hexstyle = '[34;1m' --blue + bold..diagramstyle.instruction_symbolstyle = '[32;1m' --green + bold..diagramstyle.instruction_opcodestyle = '[1m' --bold..diagramstyle.link_defaultcolor = 0x00FF00FF --fuchsia..diagramstyle.link_nottakencolor = 0x000000FF --red..diagramstyle.link_takencolor = 0x00FF0000 --blue..diagramstyle.link_linethickness = 3DPIAdjust..diagramstyle.link_arrowsize = math.ceil(5DPIAdjust)..diagramstyle.link_pointdepth = 20*DPIAdjust --distance between links..diagramstyle.block_headershowsymbol = true..diagramstyle.block_bodyshowaddresses = fal

C:\Program Files\Cheat Engine 7.5\autorun\is-2V4D2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7632
Entropy (8bit):	4.883983761190223
Encrypted:	false
SSDEEP:	192:peDFQNTce2Qt5q/sn2Wdk7RlxJKTiZjYsfUv:p3ue2F7RlxJfYP
MD5:	459B793E0DC43A993F03D8B612F67CEC
SHA1:	F14AE9AFBE97AF534A11BF98AC1CC096269F1474
SHA-256:	E2CBB4C2F46305BB07D84222231012FD4C800FE8E1B43E0AA1AF9B6C5D111F7F
SHA-512:	1740068E3419D153ECBD9D1A6AADA20AABE71915E7422DCE1A83E616E8D2A1084922A81741591A682531E1F8146E437D8688521C7707A4909E5721768A3F956E
Malicious:	false
Preview:	--Copyright Cheat Engine......local function getOriginalCodeAndFiller(address).. local original,filler.... if type(address)~='number' then.. address=getAddressSafe(address).. end.... if address==nil then.. return nil, 'invalid address'.. end.... local sl=createStringList().. local d=createDisassembler().. local size=0.. while size<5 do.. d.disassemble(address).. local ldd=d.LastDisassembleData.. local inst=ldd.opcode..' '..ldd.parameters.. sl.add(inst).. size=size+#ldd.bytes.. address=address+#ldd.bytes.. end.... original=sl.Text.. if size-5>0 then.. filler=string.format("nop %x", size-5).. else.. filler=''.. end.... sl.destroy().. d.destroy().. return original,filler..end......local function hookSpeedFunctions().. if speedhack and speedhack.processid==getOpenedProcessID() then .. return true.. end.... local result, data=autoAssemble([[.. alloc(speedhack_wantedspeed,4).. registersymbol(speedhack_wantedspeed).. speedhack_w

C:\Program Files\Cheat Engine 7.5\autorun\is-3GI42.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18412
Entropy (8bit):	5.0642202603121165
Encrypted:	false
SSDEEP:	384:zGYmhPbvqKlu2uzKCM/muwu5gfMs5eQVQgQ2GO:zGkKl4zm/mhR
MD5:	E4FA493CBF4F5E932DCE648A78800616
SHA1:	B82C12B23AE06AC07AE61B0B599F055DC879C949
SHA-256:	ACFB9FDA20C347D8B7B2E513D38D2692BD054AE90B88E846460E66B986DD8D1C
SHA-512:	E0C4B9B757D4F38DBDB2C5CE11FA27EE742EDA97A20F098D38300C8DCF27015D5CFC8BFD658B6A7F48CFDECE9645DA633C32B18050598A368432F7B026826823
Malicious:	false
Preview:	if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'Java.po')..end....require([[autorun\javaClassEditor]])....--parser for .class files and java bytecode..--http://docs.oracle.com/javase/specs/jvms/se7/html/jvms-4.html....--constant type values..java_CONSTANT_Class=7..java_CONSTANT_Fieldref=9..java_CONSTANT_Methodref=10..java_CONSTANT_InterfaceMethodref=11..java_CONSTANT_String=8..java_CONSTANT_Integer=3..java_CONSTANT_Float=4..java_CONSTANT_Long=5..java_CONSTANT_Double=6..java_CONSTANT_NameAndType=12..java_CONSTANT_Utf8=1..java_CONSTANT_MethodHandle=15..java_CONSTANT_MethodType=16..java_CONSTANT_InvokeDynamic=18......function java_read_u4(stream).. local b={string.byte(stream.data, stream.index,stream.index+4-1)}.. stream.index=stream.index+4.... return byteTableToDword({b[4],b[3],b[2],b[1]})..end......function java_read_u2(stream).. local b={string.byte(stream.data, stream.index,stream.index+2-1)}.. stream.index=stream.index+2.... return byteTableToWord({b

C:\Program Files\Cheat Engine 7.5\autorun\is-4TPRM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8088
Entropy (8bit):	5.172167677485522
Encrypted:	false
SSDEEP:	192:zuiTTPEYya1gq5jfFEYQhRIA03xB97cq1fvhEN:ztTzyapKRiG
MD5:	B5AE011C70C1D26CC31A5D818D60E53C
SHA1:	7BE6AD86FCC9208D6F21B9F1D464B6334E64922B
SHA-256:	31ED4209776DBFAD74EC811326439D26C02B6AB653056D5E171D952C12D3F25B
SHA-512:	440B1AFC72D671D8AA663B6672371AC365029525EE055CF380A9C9C84625FD5FA2B328110633A183F87CECF8D1D2CACB62E49A7EB382B30AAA75DA5B3D2F3054
Malicious:	false
Preview:	--[[..You have a d:\bla.dll with namespace ClassLibraryX, with a class named "MyClass"..That class contains a function defined as:..public static int MyInitFunctionName(string parameters)....then you do: injectDotNetDLL('d:\\bla.dll','ClassLibraryX.MyClass','MyInitFunctionName','Something')....--]]....local DotNetCoreInjectScript=[[..[enable]..alloc(injectdotnetdll, 2048)..alloc(IID_ICLRRuntimeHost4,16)..alloc(RuntimeHost,8)....alloc(paramstr,256)..alloc(methodname,256)..alloc(classname,256)..alloc(dllpath,512)....alloc(returnvalue,4)..alloc(errorvalue,4)..label(error)....dllpath:..dw '%s',0....classname:..dw '%s',0....methodname:..dw '%s',0....paramstr:..dw '%s',0......IID_ICLRRuntimeHost4:..db 66 d3 f6 64 c2 d7 1f 4f b4 b2 e8 16 0c ac 43 af....injectdotnetdll:..[64-bit]..sub rsp,6*8+8..mov rcx,IID_ICLRRuntimeHost4..mov rdx,RuntimeHost..[/64-bit]....[32-bit]..push RuntimeHost..push IID_ICLRRuntimeHost4..[/32-bit]....call GetCLRRuntimeHost..cmp eax,0..jne error....[64-bit]..mov rcx,[Ru

C:\Program Files\Cheat Engine 7.5\autorun\is-60OMG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2018
Entropy (8bit):	4.845505891620365
Encrypted:	false
SSDEEP:	24:8LRZCSs+dJPHoSLI0zAXFqfzhPR3sAuH7vMTCRTnoH7ADR09ZWgsAU1HTfHU1EP:IRZ7umKgl5s2+cZPs81u
MD5:	3E20F1013FB48A67FE59BEDE7B8E341B
SHA1:	8C8A4CB49C3B29DB2C47F84AAFD0416101722BFE
SHA-256:	96E4429192F9AB26F8BF9F9429F36B388AA69C3624781C61EA6DF7E1BCA9B49B
SHA-512:	99CF3F88C8B06DA0DBE8085DEE796BEC7A9533990A55FBCE7524A4F941B5ECF0E8EC975A4B032EB2AAABD116C0804995A75036C98A5E4058F25D78D08A11F3F2
Malicious:	false
Preview:	local pm=AddressList.PopupMenu..local pmAddToNewGroup=createMenuItem(pm)..pmAddToNewGroup.Caption=translate('Add to new group')..pmAddToNewGroup.ImageIndex=MainForm.CreateGroup.ImageIndex..pm.Items.insert(MainForm.CreateGroup.MenuIndex, pmAddToNewGroup)....local oldOnPopup=AddressList.PopupMenu.OnPopup..AddressList.PopupMenu.OnPopup=function(s).. if oldOnPopup then.. oldOnPopup(s).. end.. pmAddToNewGroup.Visible=AddressList.SelCount>=1..end....pmAddToNewGroup.OnClick=function(s).. local i.. local count=0.. local selcount=0.. local withAddress=false.. local hasAddressSupport=false.... if AddressList.SelCount==0 then.. messageDialog('Please select at least one entry first', mtError, mbOK).. return.. end.... hasAddressSupport=AddressList[0].IsAddressGroupHeader~=nil.... for i=0,AddressList.Count-1 do.. if AddressList[i].IsGroupHeader then.. count=count+1.. end.. end...... local groupname=translate(string.format('Group %d',count+1)).. if (isKeyPressed(VK_

C:\Program Files\Cheat Engine 7.5\autorun\is-747JC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	136078
Entropy (8bit):	5.006188616081032
Encrypted:	false
SSDEEP:	768:/t5zmxQLPqWuiXL9eqiK8uthP/xoiEFLWiP8bTg1b3lDWIkGkxv0C2r0EcD+JZSh:O5n6MJCAi7hXZS8YHo6FG7236nDZ
MD5:	76168CA68F3ED8ADE110B140244EFBAF
SHA1:	2AF08403D17A64B10429C8FCE68AA085A6B287B7
SHA-256:	5832B5AB00E84690AC1E780E8B1C4ABD9649465234C9FFA2CECB410BE66A6B8A
SHA-512:	80AD21D631934D2B8E368A5B2D3CB5F1889D4A65099C2D8CD8BA37EB721C1EBDC2C6549FC530514BF9F96976FFCBFD372150F1F16A6591DA013FE4F1D1BB070B
Malicious:	false
Preview:	if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'monoscript.po')..end....local thread_checkifmonoanyhow=nil..local StructureElementCallbackID=nil..local pathsep..local libfolder....if getOperatingSystem()==0 then.. pathsep=[[\]].. libfolder='dlls'..else.. pathsep='/'.. libfolder='dylibs'..end....local dpiscale=getScreenDPI()/96....--[[local]] monocache={}....mono_timeout=3000 --change to 0 to never timeout (meaning: 0 will freeze your face off if it breaks on a breakpoint, just saying ...)....MONO_DATACOLLECTORVERSION=20221207....MONOCMD_INITMONO=0..MONOCMD_OBJECT_GETCLASS=1..MONOCMD_ENUMDOMAINS=2..MONOCMD_SETCURRENTDOMAIN=3..MONOCMD_ENUMASSEMBLIES=4..MONOCMD_GETIMAGEFROMASSEMBLY=5..MONOCMD_GETIMAGENAME=6..MONOCMD_ENUMCLASSESINIMAGE=7..MONOCMD_ENUMFIELDSINCLASS=8..MONOCMD_ENUMMETHODSINCLASS=9..MONOCMD_COMPILEMETHOD=10..MONOCMD_GETMETHODHEADER=11..MONOCMD_GETMETHODHEADER_CODE=12..MONOCMD_LOOKUPRVA=13..MONOCMD_GETJITINFO=14..MONOCMD_FINDCLASS=15..MONOCMD_FIND

C:\Program Files\Cheat Engine 7.5\autorun\is-8AE8P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20837
Entropy (8bit):	4.996731854830045
Encrypted:	false
SSDEEP:	192:Rmi4uQRgQgAgm2+CXgSKgKghmg60gGg4tgKplg/Dhrf+1e5l7jTRgzKgIgmoJMQZ:y3KQBHvSo9a452TZ0YgkP
MD5:	04CDE30D6AA9999A846B5FC3CFC1F56C
SHA1:	2187AB73161EE8A516D25F8295BB4C7E3DA2F7E3
SHA-256:	EAE2A91808BB58B386F3BDDE75176C7208C22BF5515C5D6E467C583DF2E72E15
SHA-512:	FB2F27F3981E587DDD379D54999067092DC2FBE2F243E4A49B2F9D4DA172907D169BC708AA0840631C951FB01CCB9E69A403EB2E19A5F1AFF1BE3FF0EEC27C62
Malicious:	false
Preview:	..--same as monodatacollector but for .net and .netcore..--can theoretically be used on mono as well....if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'dotnetforceddatacollector.po')..end......local pathsep..local libfolder....if getOperatingSystem()==0 then.. pathsep=[[\]].. libfolder='dlls'..else.. pathsep='/'.. libfolder='dylibs'..end....dotnet_timeout=3000....DOTNETCMD_TEST=0..DOTNETCMD_INITMODULELIST=1..DOTNETCMD_GETMETHODENTRYPOINT=2..DOTNETCMD_GETFIELDTYPENAME=3..DOTNETCMD_GETFIELDVALUE=4..DOTNETCMD_SETFIELDVALUE=5..DOTNETCMD_LOADMODULE=6..DOTNETCMD_GETMETHODPARAMETERS=7..DOTNETCMD_WRAPOBJECT=8..DOTNETCMD_UNWRAPOBJECT=9..DOTNETCMD_INVOKEMETHOD=10....DOTNETCMD_FIND_MODULEID_WITH_CLASSLIST=11......DOTNETCMD_EXIT=255......dotnetmodulelist={}....function dotnet_findDotNetMethodAddress(namespace, classname, methodname, modulename).. --print(string.format("dotnet_findDotNetMethodAddress('%s','%s','%s','%s')",namespace,classname, methodname, modulenam

C:\Program Files\Cheat Engine 7.5\autorun\is-E8L5M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with very long lines (332), with CRLF line terminators
Category:	dropped
Size (bytes):	53565
Entropy (8bit):	4.994608075433237
Encrypted:	false
SSDEEP:	768:kR7JxiEJ1FwKp/UnSkXZh/GZPbZ1/GZU29s4dwHvuhWaPg5jys9:Oiqp/UnSkXZh/GZPbZ1/GZUWm9
MD5:	96A64006F752ECD75FAED81F86212F93
SHA1:	1889EBB9C206866A7096F6ECD5B7CEC628DCDCBE
SHA-256:	4F0E7249A20147FB1E364B5B182D990E6D00BF6A2624EDAA368B65142DD08408
SHA-512:	01F01661B7C8DDDC2940FB8A6E3384C5BEBD1560703E510E7EC029A294AA0A49486B6948851D99C01594CBDDF75295D2F38AB4C1E7760AFA3E40B15151B0FB2B
Malicious:	false
Preview:	if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'Java.po')..end....--Java class editor......--[[..This will show an userinterface for editing java classes and will return a list of "patch" commands..that can be used with the runtime java class edit commands....e.g:..DefineLabel(spot)..InsertBytecode(spot, command)..ModifyBytecode(spot, command)..DeleteBytecode(spot) (could be ModifyBytecode(spot,"nop") )......The user should not have to know about exceptions and how their positions change with each insert/delete....gui:..listview:..index\|byteindex\|label \|exception\|instruction\|..-----\|---------\|------\|---------\|-----------\|..0 \|0 \| \| \|nop \| Insert..0 \|1 \|l1: \|ex1: \|branch l1 \| Delete.. Modify....--]]....--http://docs.oracle.com/javase/specs/jvms/se7/html/jvms-6.html......java_bytecodes={}....--[[..paramtypes:.. s1=signed 1 byte.. s2=signed 2 byte.. s4=signed 4 b

C:\Program Files\Cheat Engine 7.5\autorun\is-EAD3D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7984
Entropy (8bit):	4.628436564346363
Encrypted:	false
SSDEEP:	192:hG6G275/GPinZJGJBo2HXwymhmBEO/66dogk:fG4/vnZJGJv3qABPm
MD5:	6BFAA8047A8912C979D8B7ADC21BEFC4
SHA1:	9DEB3F151A70B1DE2AF921E2C4A05A9AFBFE88DA
SHA-256:	7EFC51C61CEC0EF4330C63E8848AD17BF707CC7067F8F5E195AE69D373BF4D24
SHA-512:	BEC70863FE63321EC815164A84FC82F7F03139E668AC165E218B033C2E79150B405AE553CBD8543F3AEDC839DB35FC74C14348E080598FB7BC25FB7908386A0E
Malicious:	false
Preview:	--patches a dotnet method. Prerequisite: Must not be inlined or generic, or anything complex....function ParseScriptTokens(script,values).. --parses the script for <> entries and looks up the value in the values table.. if script==nil then .. print(debug.traceback()).. error('ParseScriptTokens: script is nil') .. end.. if values==nil then .. print(debug.traceback()).. error('ParseScriptTokens: values is nil') .. end.. .. return string.gsub(script,"<(.-)>",function(v) .. local r=values[v].. if r then return r else return x end.. end)..end....function dotnetpatch_getAllReferences().. --gets a list of all assemblies.. --todo: if they are in-memory only, export them to a file first (create the mz/pe manually, just the metadata).. local r={}.. local sysfile.... if monopipe then.. mono_enumImages(function(img).. local n=mono_image_get_filename(img).. local ln=extractFileName(n:lower()).. if ln~='mscorlib.dll' and ln~='netstandard.dll' then..

C:\Program Files\Cheat Engine 7.5\autorun\is-G334Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7917
Entropy (8bit):	5.014591940837417
Encrypted:	false
SSDEEP:	192:sQJpltyKlR4ZtoOQ9pttWKlR4vtGTQPpMlyFuVCQc6c0RhBmg:stKY59KYQ5JhUg
MD5:	E76FCD2ECD5B956D4579A676AA3EEA01
SHA1:	49ECBA5CCC531A40AD7805A126D38B44B4A36576
SHA-256:	0339BA0043AF5C058CF3A19DE9F90312D18F6BB2728F454EF403B531BD57AE42
SHA-512:	8443C213D4A626A358631F76A0CC4C106543CE58C94D34A96B88574B3E32AE742F28878B259A17823CA07EC521B06E32E572E7BC77E10951BC0984B07C0571C6
Malicious:	false
Preview:	local scripts={}....local function registerBigEndianInt16()..scripts['2 Byte Big Endian'].type=registerCustomTypeAutoAssembler([[..alloc(TypeName,256)..alloc(ByteSize,4)..alloc(ConvertRoutine,1024)..alloc(ConvertBackRoutine,1024)....TypeName:..db '2 Byte Big Endian',0....ByteSize:..dd 2....//The convert routine should hold a routine that converts the data to an integer (in eax)..//function declared as: stdcall int ConvertRoutine(unsigned char *input);..//Note: Keep in mind that this routine can be called by multiple threads at the same time...ConvertRoutine:..//jmp dllname.functionname..[64-bit]..//or manual:..//parameters: (64-bit)..//rcx=address of input..xor eax,eax..mov ax,[rcx] //eax now contains the bytes 'input' pointed to..xchg ah,al //convert to big endian....ret..[/64-bit]....[32-bit]..//jmp dllname.functionname..//or manual:..//parameters: (32-bit)..push ebp..mov ebp,esp..//[ebp+8]=input..//example:..mov eax,[ebp+8] //place the address that contains the bytes into eax..mov a

C:\Program Files\Cheat Engine 7.5\autorun\is-HJUU2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9243
Entropy (8bit):	4.766574177681985
Encrypted:	false
SSDEEP:	192:C64/8dXYKgLNhpwHmFUazyI+Q4Om1q/Qt:t4nHUKUa0Out
MD5:	40D6BFE593194CF938E19622A3C13A5E
SHA1:	761257E8EF492431CF0E04DBCA396FABB25FE1AE
SHA-256:	C4CEF60489B067C8E7ABCDD5594643A27D0720B21523753DD462D53024287116
SHA-512:	1D1AAA9DE74B0BB08CC4CECED5DBFA4C589347EAC098D7AE013D5A1BEAAE0EEACA4D314E2591560C6DF14A93DD4E9316CA317D21EFADCCA57D11EEE72F4C6E16
Malicious:	false
Preview:	if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'autosave.po')..end....require("lfs")....autosave={} --todo make local....local AutoSaveSettings=getSettings('Auto Save')..local AutoSaveVersion=1....autosave.getPath=function().. local path=AutoSaveSettings['SavePath'].. if (path==nil) or (path=='') then.. .. path=os.getenv("LOCALAPPDATA").. if (path==nil) or (path=='') then.. path=getCheatEngineDir() --last attempt .. end.. end.. .. if string.sub(path,#path)~='\\' then.. path=path..'\\'.. end.. .. return path..end....function autosave.saveState().... .. local pid=AutoSaveSettings['ProcessID'].. if pid and pid~='' then.. pid=tonumber(pid).. if pid~=getCheatEngineProcessID() then.. --another CE has done an autosave.. if getProcessList()[pid]==nil then.. --it doesn't exist anymore... messageDialog(translate('Another instance of Cheat Engine has crashed and it created an autosave. Autosave disabled until y

C:\Program Files\Cheat Engine 7.5\autorun\is-IPTJ2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.052893474705733
Encrypted:	false
SSDEEP:	6:jFwErIVt0OdI+eGvJYazVId2EA3ivun0gVVjec0Lg0zVCAMBNXnGCWMdO:5myTjOId2p3ivIVje5tVDMBRnGV5
MD5:	9BA24A4B8CB68B40D229109565572F78
SHA1:	F2DABC40C3761FD9196291AB42943D580062CD11
SHA-256:	8B5608DAEDB4370990B65579EE8D1D5623644FD9C0BBE007211D5837DC690C72
SHA-512:	BEFA54FD6A87BAF24030B6E292E0D8E674FBD69B3424184582EB38D8AF2C8459E7728BC6F03032735A6A1B6C5FE459ECDB1C862BDBD390DC695F4085ABC3918A
Malicious:	false
Preview:	--Alice says hi!....local t=createTimer()..t.Interval=110000..t.OnTimer=function().. local f=getForm(0).. f.Width=f.Width+2.. f.Height=f.Height+2.... if t.Interval>10000 then.. t.Interval=t.Interval-10000.. end.... createMemoryStream().Size=math.random(655364,6553632);..end

C:\Program Files\Cheat Engine 7.5\autorun\is-J71N7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7354
Entropy (8bit):	4.798336095796441
Encrypted:	false
SSDEEP:	192:K9yd/VQilJ6HLwxxKF9Znu8KX+qNdYSnatJoqVSQPFLqJ4:K0VPlJMgNdYSnatmqVSQPFLc4
MD5:	2BE703BF1FF1EA4DD6D1EFF673367E48
SHA1:	13C122CFD7EB38D298FA91F3D6021F025578B508
SHA-256:	6704BEF60F60F85E76AA19B96A43ACA74C4AA8905B4033A20C24B75171B33D0A
SHA-512:	E1FC1C55574F5FECEF535734A23DB9738D4C5762E085DEA721F9CD7F5F9F364DD1428F669F26149F1E49414F38A4C00BC7FD4F5E1A5C03A0E53B24C859B25C5E
Malicious:	false
Preview:	local function genericJumpHandler(state, alwaystaken).. local origin=state.address.. local addressString=string.gsub(state.ldd.parameters,"qword ptr ","").. local addressString=string.gsub(addressString,"dword ptr ","").. local destination=getAddressSafe(addressString) --find out the destination.. local destination2.... if destination==nil then.. --in case of registers.. return.. end.... if not alwaystaken then.. destination2=origin+state.parsed[origin].bytesize.. end;...... state.branchOrigins[origin]={}.. state.branchOrigins[origin].destinationtaken=destination.. state.branchOrigins[origin].destinationnottaken=destination2.... if state.branchDestinations[destination]==nil then --list of destinations and their origin(s).. state.branchDestinations[destination]={}.. end.... table.insert(state.branchDestinations[destination], origin).... if not alwaystaken then.. if state.branchDestinations[destination2]==nil then --list of destinations and their origin(s).

C:\Program Files\Cheat Engine 7.5\autorun\is-JRPTO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	14247
Entropy (8bit):	4.757455540825877
Encrypted:	false
SSDEEP:	192:p1mEfPL5ThWRM8vLdyWR1hHS+6stplX7ZbaFYBY6tnGb:VfPjylLNkKW6tE
MD5:	26C0E56ABEBFB550A9D208D6191816E0
SHA1:	8F2392846633AC48A0168AFE9F20AFC124699F4C
SHA-256:	A825F660DF2E6C13DBECE0A0F8DC306129BD784F8DC4EFC37E67E9CDD00CE65F
SHA-512:	4FC8A18E2F24374953694CB9230D9DDBA7A1B69B3BA5574AE143CB79B8D0F7CD94E9DD7337EC58EA40769A4B552A583C466781AC7EFF50C9199EAB39AD2076A9
Malicious:	false
Preview:	if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'CeShare.po')..end....ceshare={}....function ceshare.getInternet().. if ceshare.internet==nil then.. ceshare.internet=getInternet('ceshare').. end.. return ceshare.internet..end....local pathsep..if getOperatingSystem()==0 then.. pathsep=[[\]]..else.. pathsep=[[/]]..end....ceshare.version=-1..ceshare.path=getAutoRunPath()..'ceshare'..pathsep..ceshare.formpath=ceshare.path..pathsep..'forms'..pathsep..ceshare.imagepath=ceshare.path..pathsep..'images'..pathsep....if package.loaded.xmlSimple==nil then.. package.path=package.path..';'..getAutoRunPath()..'xml'..pathsep..'?.lua'..else.. package.loaded.xmlSimple=nil..end..ceshare.xmlParser = require("xmlSimple").newParser()......package.path=package.path..';'..ceshare.path..[[?.lua]]....function loadCEShare().. ceshare.settings=getSettings('ceshare').. ceshare.secondaryIdentifierCode=getSettings('ceshare\\secondaryIdentifierCode').... require("ceshare_account

C:\Program Files\Cheat Engine 7.5\autorun\is-NCP20.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5446
Entropy (8bit):	5.106344058039722
Encrypted:	false
SSDEEP:	96:UFbOaNZRB+TqamMsKs5EcDE0F39dLC/B9gn0TUTXM2sit8vD/Jae8:gaTqamQcN9dLq9QDM2fG7o
MD5:	4FF5CD5283B83CF4614D14E4363ED8F2
SHA1:	A435BF58C9E58211CADA8EA1AF2891EA488E4DD2
SHA-256:	45AD5D854DEE4CA07F60B5BA89CF328DD7B216A0EF3232A2647D15BE38C6C4C0
SHA-512:	8208B64CD2FFA356DCAC8463188325B1AF88C0598F231EA0E36E74DEC64E0C50740FC3DB26790BF39FA30C0D457B910A7F9EEC8E2049C04F48C793B58452A7A3
Malicious:	false
Preview:	--mp3 sound extension....if oldcreateMemoryStream==nil then oldcreateMemoryStream = createMemoryStream end..function createMemoryStream().. local obj = oldcreateMemoryStream().. local oldwrite=obj.write.... obj.write = function (t,n) -- override default write.. local count=0.. for _,v in ipairs(t) do.. if count==n then break end.. oldwrite({v},1).. count=count+1.. end.. end.... obj.writeDword = function (v) obj.write(dwordToByteTable(v)) end.. obj.writeWord = function (v) obj.write(wordToByteTable(v)) end.... return obj..end......--convertMP3ToRIFFMP3(stream)..function convertMP3ToRIFFMP3(stream).. local riffmp3 = createMemoryStream().... local header = {.. 0x46464952,0x00000000,0x45564157,0x20746D66,0x0000001E,0x00020055,.. 0x0000AC44,0x00000000,0x00000001,0x0001000C,0x00000002,0x00010001,.. 0x61660571,0x00047463,0x2FF80000,0x61640014.. } -- default is 44100Hz , Stereo.... loca

C:\Program Files\Cheat Engine 7.5\autorun\is-RPLOS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17557
Entropy (8bit):	4.7553596901580395
Encrypted:	false
SSDEEP:	192:02/2WiurcwWJsFH1bukLWmHwt/5B9ndDiC4fVAslnlKQ8gLIeHkSD//TVxVkB8CZ:HtWIBugO8ieHkSDnTVTnC8i+lLQC/6
MD5:	F2896031568F43A7E4A7529A16F4EA12
SHA1:	A24B17AEC47FB290EE29BFC01C7386B85827D14E
SHA-256:	0714BD0F908345D7588A09C856746D76861CE4EB3571692BABC1BCE2D35A57AA
SHA-512:	B4F9EBB1E8375045269FF11FE2B6AEC3C31E64AB89CDDBFF1D26451DB3426AE841E28D184539959F84248CF101854F47E8F3497BA8414460ABCAC3C0D66248B3
Malicious:	false
Preview:	local DPIMultiplier=(getScreenDPI()/96)....if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'patchscan.po')..end....local IMAGE_SCN_CNT_CODE=0x20..local IMAGE_SCN_MEM_EXECUTE=0x20000000....function byteTableToHexString(bt).. local i.. local r=''.... if bt then.. for i=1,#bt do.. r=r..string.format("%.2x ",bt[i]).. end.. end.. return r..end......function scanModuleForPatches(modulepath, loadedModuleBase, thread).... local original=createMemoryStream().. local r,e=original.loadFromFileNoError(modulepath).. if not r then.. original.destroy().. return false,e.. end.. original.Position=0...... if (byteTableToString(original.read(2))~='MZ') then.. original.destroy().. return nil,translate('Not a valid executable').. end.... original.Position=60;.. local lfanew=original.readDword();.. original.Position=lfanew;.... if (byteTableToString(original.read(2))~='PE') then.. original.destroy().. return nil,translate('Not a valid win

C:\Program Files\Cheat Engine 7.5\autorun\is-RQ2S3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7574
Entropy (8bit):	4.744280698083541
Encrypted:	false
SSDEEP:	192:J+/R0h8p0wyUYCCTLysSUDfH0HwjOtHdqFB2i6uMPV:LWBUDU9Er4V
MD5:	D609EA53AD996E63300E703ED98EAB08
SHA1:	8E19906C32BEE40E9A24CB82AB57D109AE11E038
SHA-256:	E0C48C9033C52F77AD7B1DF44E2BB81C2FEF868CE08D46054723BC8441F0C742
SHA-512:	CC85857D449F507477A12CB7D5BE31288BAECB3B41BD760EBF1BAD289771CC7EAAF608B74E421EDA948D0B45E02A6FC188474C0E926EAE20510C77D2AF8890A6
Malicious:	false
Preview:	--version check update script for cheat engine..--Don't like it? Just delete this file. Easy as that....--For the translators:..if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'VersionCheck.po')..end....local vsettings=getSettings("VersionCheck")....local VersionCheckThread....function CheckVersion(automatic).. --create a thread that will get the latest version and buildnumber.. if versionCheckThread==nil then.. versionCheckThread=createThread(function(t).. local i=getInternet('CEVersionCheck').. local r=i.getURL('https://cheatengine.org/latestversion.txt').... if r then.. local sl=createStringlist().. local newerVersion=false.. local latestVersionCompleteBuildNumber.. local latestVersionNumber.. local latestVersionString --separate for crap like 6.5.1 (can't show 6.51 to the user).. sl.Text=r.... if sl.Count<3 then.. t.synchronize(function().. if au

C:\Program Files\Cheat Engine 7.5\autorun\is-RU1SE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2095
Entropy (8bit):	4.920154640424097
Encrypted:	false
SSDEEP:	48:gzax3OK42b8w6aBxVpKDRKLYChKr+deaUAyA16AhXaAe76:gzax+KIPazVpKDRaNhKr+dlUDy6GXapW
MD5:	CA347DEF8A682D2ADF951C4ECBABD948
SHA1:	C65BBC8A5106E9ACE9DDC450EC3A5F637704FA62
SHA-256:	1F11078B143B92612822F3DFC09D93778471198F203694C8FC911E249FBBC557
SHA-512:	9F7A08822D9357AF72A27707C17FC0D3EC03E72333D88E2BA8E2BE95EAB7BA9C1B33EA3E2E20D734C382F4732F77443D3AA9C189667A74195987F5DB486E2651
Malicious:	false
Preview:	local c=createComboBox(MainForm.gbScanOptions)....c.Style='csDropDownList'..c.Items.add('All')..c.ItemIndex=0..c.Name='ScanOptionsModuleList' ......c.Align=alTop..c.BorderSpacing.Left=6..c.BorderSpacing.Right=6..c.BorderSpacing.Bottom=2....local modulelist....function FillList().. local is64bit=targetIs64Bit().. local op.. if is64bit then.. op='32'.. else.. op='64'.. end.. synchronize(function() .. while c.Items.Count>1 do.. c.Items.delete(1).. end.. end).... modulelist=enumModules().. .. synchronize(function().. if modulelist then.. local i.. for i=1, #modulelist do.. modulelist[i].OriginalName=modulelist[i].Name.. if modulelist[i].Is64Bit ~= is64bit then.. modulelist[i].OriginalName='_'..modulelist[i].OriginalName.. modulelist[i].Name=modulelist[i].Name..' ('..op..'-bit)'.. end.... c.Items.Add(modulelist[i].Name).. end.. end.. end)..end....c.OnMouseEnter=function(d) .. if c.Items.Count<

C:\Program Files\Cheat Engine 7.5\autorun\is-T3S7T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with very long lines (338), with CRLF line terminators
Category:	dropped
Size (bytes):	84022
Entropy (8bit):	4.86677649912196
Encrypted:	false
SSDEEP:	1536:yui2L/B3vpXErHBRpUPrEUvh8VRzXzycAcnNSoaam0WEj:yurB6rhRpUPr9vszjycAcYoaam0WEj
MD5:	F30091A31003345EAE2A915D1EE13E9D
SHA1:	B42C1B7DA7E620A89A68274C7551D7BB3806441C
SHA-256:	CC505DA9EA622E39783D6AC0A98370E1B58EBA6702B9A1796FDC869AEEBBA261
SHA-512:	A9A801F42BF9A1ED54CBC2DC7AC397E6695EB685D4F03313059B08DB23ED9055727168B9AFFEE94416A584F703B9B97D515B6BC02FEF99F8EF6FB4B372AEE65E
Malicious:	false
Preview:	--dotnetinfo is a passive .net query tool, but it can go to a active state if needed....if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'dotnetinfo.po')..end....if getOperatingSystem()==0 then.. pathsep=[[\]]..else.. pathsep='/'..end....debugInstanceLookup=false....local DPIMultiplier=(getScreenDPI()/96)..local CONTROL_MONO=0..local CONTROL_DOTNET=1....DataSource={} --All collected data about the current process. From domains, to images, to classes, to fields and methods. Saves on queries and multiple windows can use it..local CurrentProcess....local ELEMENT_TYPE_END = 0x00 -- End of List..local ELEMENT_TYPE_VOID = 0x01..local ELEMENT_TYPE_BOOLEAN = 0x02..local ELEMENT_TYPE_CHAR = 0x03..local ELEMENT_TYPE_I1 = 0x04..local ELEMENT_TYPE_U1 = 0x05..local ELEMENT_TYPE_I2 = 0x06..local ELEMENT_TYPE_U2 = 0x07..local ELEMENT_TYPE_I4 = 0x08..local ELEMENT_TYPE_U4 = 0x09..local ELEMENT_TYPE_I8

C:\Program Files\Cheat Engine 7.5\autorun\is-UQL2S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	629
Entropy (8bit):	4.667259230622991
Encrypted:	false
SSDEEP:	12:03Iw9kSSIEPchubhxoyPJ4y/oJf3DftSg0n/iyHfHHEo44JsITT+wF:03IwRCfPJ1/wKrHfHh4AsATvF
MD5:	DF4D243AB0407A1F03CCF448232FCF62
SHA1:	62453CFA7ABF6FA83158BE1BA86C854D9A6B7D4B
SHA-256:	C5A35380AF8BEBE96B85377F5F41F8C068CB857C74B9CB85B7467B35C1DE10C4
SHA-512:	4B05B65909673E92F59AB64C1FF4E0B829F5C9085EAFA1FFF28CB0CCD7E6A7F6EF031633F443E0BA156A4B8F5009F526D0356F39EF77B22706F98F100B1909C2
Malicious:	false
Preview:	luasymbols=registerSymbolLookupCallback(function(str).. if str then.. local firstchar=str:sub(1,1).. .. if (firstchar=='\'') or (firstchar=='\"') then.. return nil.. end.. .. local c='return '..str.. local lc=loadstring(c).. if lc then.. local isvalid,result=pcall(lc).. if isvalid then.. return result.. else.. return nil.. end.. end.. end..end, slNotSymbol) ....registerEXETrainerFeature('Lua Symbols', function().. local r={}.. r[1]={}.. r[1].PathToFile=getCheatEngineDir()..[[autorun\luasymbols.lua]].. r[1].RelativePath=[[autorun\]].. .. return r..end)

C:\Program Files\Cheat Engine 7.5\autorun\is-V5CNU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15160
Entropy (8bit):	4.132367012227535
Encrypted:	false
SSDEEP:	384:fTJbJcJtJZJtJeJAmDF3zY0PLTuHrRthutT9AT0HqkVWAcK3wMexR9WnraIeBXjJ:LJbJcJtJZJtJeJAmDF3zY0jTuHr7huFG
MD5:	C5D67D9CB5017F96F34CB9BA0F08FDF0
SHA1:	53DCA47CF042380F8DBC3399832A559A2C7368BD
SHA-256:	42896BBE75C79C381CC90FBAE685DA24013CAAD0786F1B1A4B569620C45F3F72
SHA-512:	C2F41A7C1A25B66B9DC0A496AD87818C9C7E3F70CEB82344AD7F664764293D2F9A43E607A4A299597E44B6763B3BFC63AD8F4EB01C6BD68EAE4BB04ACF775F42
Malicious:	false
Preview:	--dotnetsearch..if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'dotnetsearch.po')..end....function spawnDotNetSearchDialog(DataSource, frmDotNetInfo, searchtype).... local currentScan --rule: only writable in mainthread.. local searchresults={}.. .. .. --spawns a searchdialog. searchtype has 3 options: 0-ClassName, 1-FieldName, 2-MethodName.. local frmSearch=createFormFromFile(getAutorunPath()..'forms'..pathsep..'DotNetSearch.frm') .. .. _G.frmSearch=frmSearch.. .. if searchtype==0 then.. frmSearch.Caption=translate('Find Class') .. frmSearch.cbLimitToCurrentBase.Caption=translate('Limit to current image').. .. frmSearch.cbLimitToCurrentBase.Enabled=frmDotNetInfo.lbImages.ItemIndex>=0 .. frmSearch.lvResults.Columns.delete(2).. elseif searchtype==1 then.. frmSearch.Caption=translate('Find Field') .. frmSearch.cbLimitToCurrentBase.Caption=translate('Limit to current class').. frmSearch.cbLimitToCurrentBase.Enabled=f

C:\Program Files\Cheat Engine 7.5\autorun\is-V5KV6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with very long lines (312), with CRLF line terminators
Category:	dropped
Size (bytes):	64056
Entropy (8bit):	5.143902164750308
Encrypted:	false
SSDEEP:	1536:/ilZhlpsM/bJ+CGLM0oJyevomQ385GxwuyC+N/0nNjoHhjCL:/ilZhlpsM6M0oJyUomQMUyC+N/0ZoCL
MD5:	54151E1842473981D08C4B1B69CEB46C
SHA1:	26CCFFD2AD4DE7FEA9CA7B11FBFBCF5CA3E9EA00
SHA-256:	B318D2AC5CF96BA8A0A36EDDBB62B250004D44F214BB10C0E82E4F2DDBDA95D9
SHA-512:	F9B76F51F089807610052D1DA2F147975EA3A2FF00C70FC373087A9CE55E24337F52174F062D5EC262FF9227F98CB32E09753B4E5A68FB443D8EB27890607B73
Malicious:	false
Preview:	if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'Java.po')..end....--todo: split up into multiple units and use the java table for the methods as well......JAVACMD_STARTCODECALLBACKS=0..JAVACMD_STOPCODECALLBACKS=1..JAVACMD_GETLOADEDCLASSES=2..JAVACMD_DEREFERENCELOCALOBJECT=3..JAVACMD_GETCLASSMETHODS=4..JAVACMD_GETCLASSFIELDS=5..JAVACMD_GETIMPLEMENTEDINTERFACES=6..JAVAVMD_FINDREFERENCESTOOBJECT=7..JAVACMD_FINDJOBJECT=8..JAVACMD_GETCLASSSIGNATURE=9 --=getClassName..JAVACMD_GETSUPERCLASS=10..JAVACMD_GETOBJECTCLASS=11..JAVACMD_GETCLASSDATA=12..JAVACMD_REDEFINECLASS=13..JAVACMD_FINDCLASS=14..JAVACMD_GETCAPABILITIES=15..JAVACMD_GETMETHODNAME=16 --gets the methodname and the signature..JAVACMD_INVOKEMETHOD=17..JAVACMD_FINDCLASSOBJECTS=18 --find objects that belong to the given class..JAVACMD_ADDTOBOOTSTRAPCLASSLOADERPATH=19..JAVACMD_ADDTOSYSTEMCLASSLOADERPATH=20..JAVACMD_PUSHLOCALFRAME=21..JAVACMD_POPLOCALFRAME=22..JAVACMD_GETFIELDDECLARINGCLASS=23..JAVACMD_GETFIELDS

C:\Program Files\Cheat Engine 7.5\autorun\is-VK6QC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	Algol 68 source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8862
Entropy (8bit):	4.974583347443069
Encrypted:	false
SSDEEP:	192:b4QnfODIk5ktS+Xp7SjCjL6jSCXNB3mtS+jwKtwTZX:bwDIAoL6jfMbtwX
MD5:	18D66678D7078C907FDDB5CC4E16E94E
SHA1:	681DC425C522D1A87588E224980F539DE791F2C2
SHA-256:	D99600BD2A0E754423499C963953FBF16B5FF9CECADC44F1332733F08F3D3F6E
SHA-512:	D22C18C47D93C12ED60BF704C590AF3FE7D7D0BCC49B77939F18424F2D15241C084F7288AC1695F22EA97DE1C6605351DAAF98FB86A6D4269ADAE2C78642BA10
Malicious:	false
Preview:	if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'SaveSessions.po')..end......if cheatEngineIs64Bit() then.. if string.find(package.cpath, 'clibs64')==nil then.. package.cpath=package.cpath..[[;.\clibs64\?.dll]].. end..else.. if string.find(package.cpath, 'clibs32')==nil then.. package.cpath=package.cpath..[[;.\clibs32\?.dll]].. end..end....require("lfs")....function loadMemoryScan_internal(filename).. --print("loadMemoryScan").. .. --the thread is used to bypasses a bug in 6.3.....local ms=getCurrentMemscan()...local mf=getMainForm()...........local input,err=createFileStream(filename,fmOpenRead or fmShareDenyNone).. if input==nil then.. MessageDialog(err, mtError,mbOK).. return.. end.....local scanvalue=input.readAnsiString().. local originalFromAddress=input.readAnsiString() .. local originalToAddress=input.readAnsiString() ...local scantype=input.readByte()...local vartype=input.readByte().. .....local savedscancount=input.readByte(

C:\Program Files\Cheat Engine 7.5\autorun\java.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with very long lines (312), with CRLF line terminators
Category:	dropped
Size (bytes):	64056
Entropy (8bit):	5.143902164750308
Encrypted:	false
SSDEEP:	1536:/ilZhlpsM/bJ+CGLM0oJyevomQ385GxwuyC+N/0nNjoHhjCL:/ilZhlpsM6M0oJyUomQMUyC+N/0ZoCL
MD5:	54151E1842473981D08C4B1B69CEB46C
SHA1:	26CCFFD2AD4DE7FEA9CA7B11FBFBCF5CA3E9EA00
SHA-256:	B318D2AC5CF96BA8A0A36EDDBB62B250004D44F214BB10C0E82E4F2DDBDA95D9
SHA-512:	F9B76F51F089807610052D1DA2F147975EA3A2FF00C70FC373087A9CE55E24337F52174F062D5EC262FF9227F98CB32E09753B4E5A68FB443D8EB27890607B73
Malicious:	false
Preview:	if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'Java.po')..end....--todo: split up into multiple units and use the java table for the methods as well......JAVACMD_STARTCODECALLBACKS=0..JAVACMD_STOPCODECALLBACKS=1..JAVACMD_GETLOADEDCLASSES=2..JAVACMD_DEREFERENCELOCALOBJECT=3..JAVACMD_GETCLASSMETHODS=4..JAVACMD_GETCLASSFIELDS=5..JAVACMD_GETIMPLEMENTEDINTERFACES=6..JAVAVMD_FINDREFERENCESTOOBJECT=7..JAVACMD_FINDJOBJECT=8..JAVACMD_GETCLASSSIGNATURE=9 --=getClassName..JAVACMD_GETSUPERCLASS=10..JAVACMD_GETOBJECTCLASS=11..JAVACMD_GETCLASSDATA=12..JAVACMD_REDEFINECLASS=13..JAVACMD_FINDCLASS=14..JAVACMD_GETCAPABILITIES=15..JAVACMD_GETMETHODNAME=16 --gets the methodname and the signature..JAVACMD_INVOKEMETHOD=17..JAVACMD_FINDCLASSOBJECTS=18 --find objects that belong to the given class..JAVACMD_ADDTOBOOTSTRAPCLASSLOADERPATH=19..JAVACMD_ADDTOSYSTEMCLASSLOADERPATH=20..JAVACMD_PUSHLOCALFRAME=21..JAVACMD_POPLOCALFRAME=22..JAVACMD_GETFIELDDECLARINGCLASS=23..JAVACMD_GETFIELDS

C:\Program Files\Cheat Engine 7.5\autorun\javaClassEditor.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with very long lines (332), with CRLF line terminators
Category:	dropped
Size (bytes):	53565
Entropy (8bit):	4.994608075433237
Encrypted:	false
SSDEEP:	768:kR7JxiEJ1FwKp/UnSkXZh/GZPbZ1/GZU29s4dwHvuhWaPg5jys9:Oiqp/UnSkXZh/GZPbZ1/GZUWm9
MD5:	96A64006F752ECD75FAED81F86212F93
SHA1:	1889EBB9C206866A7096F6ECD5B7CEC628DCDCBE
SHA-256:	4F0E7249A20147FB1E364B5B182D990E6D00BF6A2624EDAA368B65142DD08408
SHA-512:	01F01661B7C8DDDC2940FB8A6E3384C5BEBD1560703E510E7EC029A294AA0A49486B6948851D99C01594CBDDF75295D2F38AB4C1E7760AFA3E40B15151B0FB2B
Malicious:	false
Preview:	if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'Java.po')..end....--Java class editor......--[[..This will show an userinterface for editing java classes and will return a list of "patch" commands..that can be used with the runtime java class edit commands....e.g:..DefineLabel(spot)..InsertBytecode(spot, command)..ModifyBytecode(spot, command)..DeleteBytecode(spot) (could be ModifyBytecode(spot,"nop") )......The user should not have to know about exceptions and how their positions change with each insert/delete....gui:..listview:..index\|byteindex\|label \|exception\|instruction\|..-----\|---------\|------\|---------\|-----------\|..0 \|0 \| \| \|nop \| Insert..0 \|1 \|l1: \|ex1: \|branch l1 \| Delete.. Modify....--]]....--http://docs.oracle.com/javase/specs/jvms/se7/html/jvms-6.html......java_bytecodes={}....--[[..paramtypes:.. s1=signed 1 byte.. s2=signed 2 byte.. s4=signed 4 b

C:\Program Files\Cheat Engine 7.5\autorun\javaclass.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	18412
Entropy (8bit):	5.0642202603121165
Encrypted:	false
SSDEEP:	384:zGYmhPbvqKlu2uzKCM/muwu5gfMs5eQVQgQ2GO:zGkKl4zm/mhR
MD5:	E4FA493CBF4F5E932DCE648A78800616
SHA1:	B82C12B23AE06AC07AE61B0B599F055DC879C949
SHA-256:	ACFB9FDA20C347D8B7B2E513D38D2692BD054AE90B88E846460E66B986DD8D1C
SHA-512:	E0C4B9B757D4F38DBDB2C5CE11FA27EE742EDA97A20F098D38300C8DCF27015D5CFC8BFD658B6A7F48CFDECE9645DA633C32B18050598A368432F7B026826823
Malicious:	false
Preview:	if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'Java.po')..end....require([[autorun\javaClassEditor]])....--parser for .class files and java bytecode..--http://docs.oracle.com/javase/specs/jvms/se7/html/jvms-4.html....--constant type values..java_CONSTANT_Class=7..java_CONSTANT_Fieldref=9..java_CONSTANT_Methodref=10..java_CONSTANT_InterfaceMethodref=11..java_CONSTANT_String=8..java_CONSTANT_Integer=3..java_CONSTANT_Float=4..java_CONSTANT_Long=5..java_CONSTANT_Double=6..java_CONSTANT_NameAndType=12..java_CONSTANT_Utf8=1..java_CONSTANT_MethodHandle=15..java_CONSTANT_MethodType=16..java_CONSTANT_InvokeDynamic=18......function java_read_u4(stream).. local b={string.byte(stream.data, stream.index,stream.index+4-1)}.. stream.index=stream.index+4.... return byteTableToDword({b[4],b[3],b[2],b[1]})..end......function java_read_u2(stream).. local b={string.byte(stream.data, stream.index,stream.index+2-1)}.. stream.index=stream.index+2.... return byteTableToWord({b

C:\Program Files\Cheat Engine 7.5\autorun\luasymbols.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	629
Entropy (8bit):	4.667259230622991
Encrypted:	false
SSDEEP:	12:03Iw9kSSIEPchubhxoyPJ4y/oJf3DftSg0n/iyHfHHEo44JsITT+wF:03IwRCfPJ1/wKrHfHh4AsATvF
MD5:	DF4D243AB0407A1F03CCF448232FCF62
SHA1:	62453CFA7ABF6FA83158BE1BA86C854D9A6B7D4B
SHA-256:	C5A35380AF8BEBE96B85377F5F41F8C068CB857C74B9CB85B7467B35C1DE10C4
SHA-512:	4B05B65909673E92F59AB64C1FF4E0B829F5C9085EAFA1FFF28CB0CCD7E6A7F6EF031633F443E0BA156A4B8F5009F526D0356F39EF77B22706F98F100B1909C2
Malicious:	false
Preview:	luasymbols=registerSymbolLookupCallback(function(str).. if str then.. local firstchar=str:sub(1,1).. .. if (firstchar=='\'') or (firstchar=='\"') then.. return nil.. end.. .. local c='return '..str.. local lc=loadstring(c).. if lc then.. local isvalid,result=pcall(lc).. if isvalid then.. return result.. else.. return nil.. end.. end.. end..end, slNotSymbol) ....registerEXETrainerFeature('Lua Symbols', function().. local r={}.. r[1]={}.. r[1].PathToFile=getCheatEngineDir()..[[autorun\luasymbols.lua]].. r[1].RelativePath=[[autorun\]].. .. return r..end)

C:\Program Files\Cheat Engine 7.5\autorun\modulelistscan.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2095
Entropy (8bit):	4.920154640424097
Encrypted:	false
SSDEEP:	48:gzax3OK42b8w6aBxVpKDRKLYChKr+deaUAyA16AhXaAe76:gzax+KIPazVpKDRaNhKr+dlUDy6GXapW
MD5:	CA347DEF8A682D2ADF951C4ECBABD948
SHA1:	C65BBC8A5106E9ACE9DDC450EC3A5F637704FA62
SHA-256:	1F11078B143B92612822F3DFC09D93778471198F203694C8FC911E249FBBC557
SHA-512:	9F7A08822D9357AF72A27707C17FC0D3EC03E72333D88E2BA8E2BE95EAB7BA9C1B33EA3E2E20D734C382F4732F77443D3AA9C189667A74195987F5DB486E2651
Malicious:	false
Preview:	local c=createComboBox(MainForm.gbScanOptions)....c.Style='csDropDownList'..c.Items.add('All')..c.ItemIndex=0..c.Name='ScanOptionsModuleList' ......c.Align=alTop..c.BorderSpacing.Left=6..c.BorderSpacing.Right=6..c.BorderSpacing.Bottom=2....local modulelist....function FillList().. local is64bit=targetIs64Bit().. local op.. if is64bit then.. op='32'.. else.. op='64'.. end.. synchronize(function() .. while c.Items.Count>1 do.. c.Items.delete(1).. end.. end).... modulelist=enumModules().. .. synchronize(function().. if modulelist then.. local i.. for i=1, #modulelist do.. modulelist[i].OriginalName=modulelist[i].Name.. if modulelist[i].Is64Bit ~= is64bit then.. modulelist[i].OriginalName='_'..modulelist[i].OriginalName.. modulelist[i].Name=modulelist[i].Name..' ('..op..'-bit)'.. end.... c.Items.Add(modulelist[i].Name).. end.. end.. end)..end....c.OnMouseEnter=function(d) .. if c.Items.Count<

C:\Program Files\Cheat Engine 7.5\autorun\monoscript.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	136078
Entropy (8bit):	5.006188616081032
Encrypted:	false
SSDEEP:	768:/t5zmxQLPqWuiXL9eqiK8uthP/xoiEFLWiP8bTg1b3lDWIkGkxv0C2r0EcD+JZSh:O5n6MJCAi7hXZS8YHo6FG7236nDZ
MD5:	76168CA68F3ED8ADE110B140244EFBAF
SHA1:	2AF08403D17A64B10429C8FCE68AA085A6B287B7
SHA-256:	5832B5AB00E84690AC1E780E8B1C4ABD9649465234C9FFA2CECB410BE66A6B8A
SHA-512:	80AD21D631934D2B8E368A5B2D3CB5F1889D4A65099C2D8CD8BA37EB721C1EBDC2C6549FC530514BF9F96976FFCBFD372150F1F16A6591DA013FE4F1D1BB070B
Malicious:	false
Preview:	if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'monoscript.po')..end....local thread_checkifmonoanyhow=nil..local StructureElementCallbackID=nil..local pathsep..local libfolder....if getOperatingSystem()==0 then.. pathsep=[[\]].. libfolder='dlls'..else.. pathsep='/'.. libfolder='dylibs'..end....local dpiscale=getScreenDPI()/96....--[[local]] monocache={}....mono_timeout=3000 --change to 0 to never timeout (meaning: 0 will freeze your face off if it breaks on a breakpoint, just saying ...)....MONO_DATACOLLECTORVERSION=20221207....MONOCMD_INITMONO=0..MONOCMD_OBJECT_GETCLASS=1..MONOCMD_ENUMDOMAINS=2..MONOCMD_SETCURRENTDOMAIN=3..MONOCMD_ENUMASSEMBLIES=4..MONOCMD_GETIMAGEFROMASSEMBLY=5..MONOCMD_GETIMAGENAME=6..MONOCMD_ENUMCLASSESINIMAGE=7..MONOCMD_ENUMFIELDSINCLASS=8..MONOCMD_ENUMMETHODSINCLASS=9..MONOCMD_COMPILEMETHOD=10..MONOCMD_GETMETHODHEADER=11..MONOCMD_GETMETHODHEADER_CODE=12..MONOCMD_LOOKUPRVA=13..MONOCMD_GETJITINFO=14..MONOCMD_FINDCLASS=15..MONOCMD_FIND

C:\Program Files\Cheat Engine 7.5\autorun\patchscan.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	17557
Entropy (8bit):	4.7553596901580395
Encrypted:	false
SSDEEP:	192:02/2WiurcwWJsFH1bukLWmHwt/5B9ndDiC4fVAslnlKQ8gLIeHkSD//TVxVkB8CZ:HtWIBugO8ieHkSDnTVTnC8i+lLQC/6
MD5:	F2896031568F43A7E4A7529A16F4EA12
SHA1:	A24B17AEC47FB290EE29BFC01C7386B85827D14E
SHA-256:	0714BD0F908345D7588A09C856746D76861CE4EB3571692BABC1BCE2D35A57AA
SHA-512:	B4F9EBB1E8375045269FF11FE2B6AEC3C31E64AB89CDDBFF1D26451DB3426AE841E28D184539959F84248CF101854F47E8F3497BA8414460ABCAC3C0D66248B3
Malicious:	false
Preview:	local DPIMultiplier=(getScreenDPI()/96)....if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'patchscan.po')..end....local IMAGE_SCN_CNT_CODE=0x20..local IMAGE_SCN_MEM_EXECUTE=0x20000000....function byteTableToHexString(bt).. local i.. local r=''.... if bt then.. for i=1,#bt do.. r=r..string.format("%.2x ",bt[i]).. end.. end.. return r..end......function scanModuleForPatches(modulepath, loadedModuleBase, thread).... local original=createMemoryStream().. local r,e=original.loadFromFileNoError(modulepath).. if not r then.. original.destroy().. return false,e.. end.. original.Position=0...... if (byteTableToString(original.read(2))~='MZ') then.. original.destroy().. return nil,translate('Not a valid executable').. end.... original.Position=60;.. local lfanew=original.readDword();.. original.Position=lfanew;.... if (byteTableToString(original.read(2))~='PE') then.. original.destroy().. return nil,translate('Not a valid win

C:\Program Files\Cheat Engine 7.5\autorun\pseudocode.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7354
Entropy (8bit):	4.798336095796441
Encrypted:	false
SSDEEP:	192:K9yd/VQilJ6HLwxxKF9Znu8KX+qNdYSnatJoqVSQPFLqJ4:K0VPlJMgNdYSnatmqVSQPFLc4
MD5:	2BE703BF1FF1EA4DD6D1EFF673367E48
SHA1:	13C122CFD7EB38D298FA91F3D6021F025578B508
SHA-256:	6704BEF60F60F85E76AA19B96A43ACA74C4AA8905B4033A20C24B75171B33D0A
SHA-512:	E1FC1C55574F5FECEF535734A23DB9738D4C5762E085DEA721F9CD7F5F9F364DD1428F669F26149F1E49414F38A4C00BC7FD4F5E1A5C03A0E53B24C859B25C5E
Malicious:	false
Preview:	local function genericJumpHandler(state, alwaystaken).. local origin=state.address.. local addressString=string.gsub(state.ldd.parameters,"qword ptr ","").. local addressString=string.gsub(addressString,"dword ptr ","").. local destination=getAddressSafe(addressString) --find out the destination.. local destination2.... if destination==nil then.. --in case of registers.. return.. end.... if not alwaystaken then.. destination2=origin+state.parsed[origin].bytesize.. end;...... state.branchOrigins[origin]={}.. state.branchOrigins[origin].destinationtaken=destination.. state.branchOrigins[origin].destinationnottaken=destination2.... if state.branchDestinations[destination]==nil then --list of destinations and their origin(s).. state.branchDestinations[destination]={}.. end.... table.insert(state.branchDestinations[destination], origin).... if not alwaystaken then.. if state.branchDestinations[destination2]==nil then --list of destinations and their origin(s).

C:\Program Files\Cheat Engine 7.5\autorun\pseudocodediagram.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with very long lines (301), with CRLF line terminators
Category:	dropped
Size (bytes):	57578
Entropy (8bit):	4.965043624755705
Encrypted:	false
SSDEEP:	1536:SDN7O8gQVISPW3R89Mvybxj/kTdg4YXj2P:SDN7OiPW3W9MvybxjM/dP
MD5:	49C105DC0F4E732802284180722747C2
SHA1:	CDC575490B51A252202BB5E37F0536870DD3CCA0
SHA-256:	43DAE8CFAA2C16B3D94C748DE250BBA2E16E9789C8B2F3395CB6ED4F79E624C6
SHA-512:	B3A582E1FB4BAF003F40262C888ADF84041874E729A97D8CFAED581C84B7B3F5823DAFA4249607D4E79B62AA30BC207632ECA9522A0866EDF1C57CFC8296EFE7
Malicious:	false
Preview:	if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'pseudocodediagram.po')..end......--[[pseudocodediagram.lua]]--....local DPIAdjust=getScreenDPI()/96....--Global..diagramstyle = {}..diagramstyle.instruction_registerstyle = '[31;1m' --red + bold..diagramstyle.instruction_hexstyle = '[34;1m' --blue + bold..diagramstyle.instruction_symbolstyle = '[32;1m' --green + bold..diagramstyle.instruction_opcodestyle = '[1m' --bold..diagramstyle.link_defaultcolor = 0x00FF00FF --fuchsia..diagramstyle.link_nottakencolor = 0x000000FF --red..diagramstyle.link_takencolor = 0x00FF0000 --blue..diagramstyle.link_linethickness = 3DPIAdjust..diagramstyle.link_arrowsize = math.ceil(5DPIAdjust)..diagramstyle.link_pointdepth = 20*DPIAdjust --distance between links..diagramstyle.block_headershowsymbol = true..diagramstyle.block_bodyshowaddresses = fal

C:\Program Files\Cheat Engine 7.5\autorun\savesession.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	Algol 68 source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8862
Entropy (8bit):	4.974583347443069
Encrypted:	false
SSDEEP:	192:b4QnfODIk5ktS+Xp7SjCjL6jSCXNB3mtS+jwKtwTZX:bwDIAoL6jfMbtwX
MD5:	18D66678D7078C907FDDB5CC4E16E94E
SHA1:	681DC425C522D1A87588E224980F539DE791F2C2
SHA-256:	D99600BD2A0E754423499C963953FBF16B5FF9CECADC44F1332733F08F3D3F6E
SHA-512:	D22C18C47D93C12ED60BF704C590AF3FE7D7D0BCC49B77939F18424F2D15241C084F7288AC1695F22EA97DE1C6605351DAAF98FB86A6D4269ADAE2C78642BA10
Malicious:	false
Preview:	if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'SaveSessions.po')..end......if cheatEngineIs64Bit() then.. if string.find(package.cpath, 'clibs64')==nil then.. package.cpath=package.cpath..[[;.\clibs64\?.dll]].. end..else.. if string.find(package.cpath, 'clibs32')==nil then.. package.cpath=package.cpath..[[;.\clibs32\?.dll]].. end..end....require("lfs")....function loadMemoryScan_internal(filename).. --print("loadMemoryScan").. .. --the thread is used to bypasses a bug in 6.3.....local ms=getCurrentMemscan()...local mf=getMainForm()...........local input,err=createFileStream(filename,fmOpenRead or fmShareDenyNone).. if input==nil then.. MessageDialog(err, mtError,mbOK).. return.. end.....local scanvalue=input.readAnsiString().. local originalFromAddress=input.readAnsiString() .. local originalToAddress=input.readAnsiString() ...local scantype=input.readByte()...local vartype=input.readByte().. .....local savedscancount=input.readByte(

C:\Program Files\Cheat Engine 7.5\autorun\soundextension.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5446
Entropy (8bit):	5.106344058039722
Encrypted:	false
SSDEEP:	96:UFbOaNZRB+TqamMsKs5EcDE0F39dLC/B9gn0TUTXM2sit8vD/Jae8:gaTqamQcN9dLq9QDM2fG7o
MD5:	4FF5CD5283B83CF4614D14E4363ED8F2
SHA1:	A435BF58C9E58211CADA8EA1AF2891EA488E4DD2
SHA-256:	45AD5D854DEE4CA07F60B5BA89CF328DD7B216A0EF3232A2647D15BE38C6C4C0
SHA-512:	8208B64CD2FFA356DCAC8463188325B1AF88C0598F231EA0E36E74DEC64E0C50740FC3DB26790BF39FA30C0D457B910A7F9EEC8E2049C04F48C793B58452A7A3
Malicious:	false
Preview:	--mp3 sound extension....if oldcreateMemoryStream==nil then oldcreateMemoryStream = createMemoryStream end..function createMemoryStream().. local obj = oldcreateMemoryStream().. local oldwrite=obj.write.... obj.write = function (t,n) -- override default write.. local count=0.. for _,v in ipairs(t) do.. if count==n then break end.. oldwrite({v},1).. count=count+1.. end.. end.... obj.writeDword = function (v) obj.write(dwordToByteTable(v)) end.. obj.writeWord = function (v) obj.write(wordToByteTable(v)) end.... return obj..end......--convertMP3ToRIFFMP3(stream)..function convertMP3ToRIFFMP3(stream).. local riffmp3 = createMemoryStream().... local header = {.. 0x46464952,0x00000000,0x45564157,0x20746D66,0x0000001E,0x00020055,.. 0x0000AC44,0x00000000,0x00000001,0x0001000C,0x00000002,0x00010001,.. 0x61660571,0x00047463,0x2FF80000,0x61640014.. } -- default is 44100Hz , Stereo.... loca

C:\Program Files\Cheat Engine 7.5\autorun\versioncheck.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7574
Entropy (8bit):	4.744280698083541
Encrypted:	false
SSDEEP:	192:J+/R0h8p0wyUYCCTLysSUDfH0HwjOtHdqFB2i6uMPV:LWBUDU9Er4V
MD5:	D609EA53AD996E63300E703ED98EAB08
SHA1:	8E19906C32BEE40E9A24CB82AB57D109AE11E038
SHA-256:	E0C48C9033C52F77AD7B1DF44E2BB81C2FEF868CE08D46054723BC8441F0C742
SHA-512:	CC85857D449F507477A12CB7D5BE31288BAECB3B41BD760EBF1BAD289771CC7EAAF608B74E421EDA948D0B45E02A6FC188474C0E926EAE20510C77D2AF8890A6
Malicious:	false
Preview:	--version check update script for cheat engine..--Don't like it? Just delete this file. Easy as that....--For the translators:..if getTranslationFolder()~='' then.. loadPOFile(getTranslationFolder()..'VersionCheck.po')..end....local vsettings=getSettings("VersionCheck")....local VersionCheckThread....function CheckVersion(automatic).. --create a thread that will get the latest version and buildnumber.. if versionCheckThread==nil then.. versionCheckThread=createThread(function(t).. local i=getInternet('CEVersionCheck').. local r=i.getURL('https://cheatengine.org/latestversion.txt').... if r then.. local sl=createStringlist().. local newerVersion=false.. local latestVersionCompleteBuildNumber.. local latestVersionNumber.. local latestVersionString --separate for crap like 6.5.1 (can't show 6.51 to the user).. sl.Text=r.... if sl.Count<3 then.. t.synchronize(function().. if au

C:\Program Files\Cheat Engine 7.5\autorun\xml\is-VSIQB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6083
Entropy (8bit):	4.574208772239494
Encrypted:	false
SSDEEP:	96:j2S/HgQOsILKD/nMed210naDVOPkkmVBgB+CPcGhJpl:j2iHgQOsILKD/nMed210ngOPkkmVBPG3
MD5:	274946677CB1FB1C63A04AEB641E21D0
SHA1:	B4C71B59792773F20878E3BA582331CF4EA7D592
SHA-256:	05258E280F53C5905AE374F808F4383CFD0898F6E620D875136EDEB0FDBA34F5
SHA-512:	AAC74D0DA491AC3E9465964A3861F93EACD63D2C445C1F235FED444F60F9CE19D3BF5069BD012AE72593516DB96CA4A0FDFA07E83218466743551CBF1A6A64EF
Malicious:	false
Preview:	--module(..., package.seeall)..local f={}....---------------------------------------------------------------------------------..---------------------------------------------------------------------------------..--..-- Original source: https://github.com/Cluain/Lua-Simple-XML-Parser..--..-- xml.lua - XML parser for use with the Corona SDK...--..-- version: 1.2..--..-- CHANGELOG:..--..-- 1.2 - Created new structure for returned table..-- 1.1 - Fixed base directory issue with the loadFile() function...--..-- NOTE: This is a modified version of Alexander Makeev's Lua-only XML parser..-- found here: http://lua-users.org/wiki/LuaXml..--..---------------------------------------------------------------------------------..---------------------------------------------------------------------------------..function f.newParser().... XmlParser = {};.... function XmlParser:ToXmlString(value).. value = string.gsub(value, "&", "&"); -- '&' -> "&".. value = string.gsub(value

C:\Program Files\Cheat Engine 7.5\autorun\xml\xmlSimple.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6083
Entropy (8bit):	4.574208772239494
Encrypted:	false
SSDEEP:	96:j2S/HgQOsILKD/nMed210naDVOPkkmVBgB+CPcGhJpl:j2iHgQOsILKD/nMed210ngOPkkmVBPG3
MD5:	274946677CB1FB1C63A04AEB641E21D0
SHA1:	B4C71B59792773F20878E3BA582331CF4EA7D592
SHA-256:	05258E280F53C5905AE374F808F4383CFD0898F6E620D875136EDEB0FDBA34F5
SHA-512:	AAC74D0DA491AC3E9465964A3861F93EACD63D2C445C1F235FED444F60F9CE19D3BF5069BD012AE72593516DB96CA4A0FDFA07E83218466743551CBF1A6A64EF
Malicious:	false
Preview:	--module(..., package.seeall)..local f={}....---------------------------------------------------------------------------------..---------------------------------------------------------------------------------..--..-- Original source: https://github.com/Cluain/Lua-Simple-XML-Parser..--..-- xml.lua - XML parser for use with the Corona SDK...--..-- version: 1.2..--..-- CHANGELOG:..--..-- 1.2 - Created new structure for returned table..-- 1.1 - Fixed base directory issue with the loadFile() function...--..-- NOTE: This is a modified version of Alexander Makeev's Lua-only XML parser..-- found here: http://lua-users.org/wiki/LuaXml..--..---------------------------------------------------------------------------------..---------------------------------------------------------------------------------..function f.newParser().... XmlParser = {};.... function XmlParser:ToXmlString(value).. value = string.gsub(value, "&", "&"); -- '&' -> "&".. value = string.gsub(value

C:\Program Files\Cheat Engine 7.5\badassets\bullet.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 5 x 8, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.975104411893651
Encrypted:	false
SSDEEP:	3:yionv//thPlg5UwjHTAadCmy9h/rywOia85Fxf1v1JClwBWfxvo4AzsOfdp:6v/lhP+KWHT19ghmIFxRiwBYFfAzswdp
MD5:	8BCC2E16763817795E4E81EC86457038
SHA1:	050BDB436ADC138D2559D96842A5DD39FA1CF315
SHA-256:	CDFC96FBA6EFD3F26C779B4A892AFFFC292D451CC94104C3272B258E17204D07
SHA-512:	E992395ABE6F058F3135F5734789C1F4865F865E763BBB10CCE371BCC191E9DD358C1C633C8597601695B73AC008FC864A1AF6920501731E9FCF1C26344ACC22
Malicious:	false
Preview:	.PNG........IHDR.............1.5;....bKGD..............pHYs..........+......tIME......%..{....HIDAT..}.... ......tD?&..LM..8....*.:...=/...mVb....U....@.V.".ge.?.~6r...4Nw..!....IEND.B`.

C:\Program Files\Cheat Engine 7.5\badassets\door.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 15 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.695302062158259
Encrypted:	false
SSDEEP:	3:yionv//thPlul4fRAadCmy9h/rywOievplxdGt0skV6UhhJnElnbgsrZsYp0rx1p:6v/lhPVfR19ghmFlyOho5gesE0Pp
MD5:	036394E78B67C1F5C2E1773B74D148E9
SHA1:	3B78B52F1C67BBA12A147BFCB805D6F913E70667
SHA-256:	96200DBE8BD64BDF2A85E1FE45FF2169FA08B080425A0F32E4F08A65D83CAB5B
SHA-512:	2156BD6E61EA3299F8CB83D9AB1A24062A7AAD743FCED71FBB108AE6F9FC5EBA72843D1619EFA5A9091402631739DDD960C17968B1A4A1027296CECC254C0E65
Malicious:	false
Preview:	.PNG........IHDR..............\Dt....bKGD..............pHYs..........+......tIME........<.s...@IDAT8.c....?......0p.Y...H.......qE..........YHS....C.f....LG........6....IEND.B`.

C:\Program Files\Cheat Engine 7.5\badassets\infobutton.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 66 x 61, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	707
Entropy (8bit):	7.4418596058676645
Encrypted:	false
SSDEEP:	12:6v/7GmBjAkh8fjIqLe7yagUPqvMPwE5t7frC1Tt00JETw0jg3Or2ksPd:/mBjAkh8fsqa7W2wEPDov3oQl
MD5:	45E0091B87215F768F524DBBEDEDD74E
SHA1:	9835B0E117146128C5EED7E43FBE1602C5C1BC23
SHA-256:	576467863491FAEDE8053F95BD0C66CF3C273F6B27A05984F81F51AA289191BE
SHA-512:	D627E4A81E32542A455A26B775E6CE30580658F4443CB84CF23022ADEC83A315264CE3FAEDD4315A62625843582396B76E994C6C0A91C2C63BB514B05B9ABE6B
Malicious:	false
Preview:	.PNG........IHDR...B...=...... ......bKGD..............pHYs..........+......tIME........-.%...PIDATh...1R.0...;?.W@E.".`.@..<.2?....R....4.M&...DCf.cY'..t2.....,..IFP..s...DD.~a.A.;.......5.H.`... ..........F.....T....\|.SQbA..As....` .B....B....810...@.H.......H....+.<.....(...\"B.F..u....]........~^..C7q..k.zp.Lh.p..{z.EG.. #.Z'........ w....c.^9.!v....3.&.!>-Zp..../.... 7.......O...>.f.*y..3....G.....)=.......+G...... F...G....`.b+.QV..WB0.1.";.....F.~+.?.D..L.p7...j.0.~..R...W...T...N.Z..2~...j,..@....3bi.#4.&..&y..d3V.#j...k.,.K...C%...%..s..yj.....7sJK]A..&p.D_17.$^../..).Z"a6"..zd...ZO.Q B..@r.H..1.N.R1.A......)~:?...E. .".#...7xrA4~;.C..1.._....}J.T.&0.j....aL#/.....IEND.B`.

C:\Program Files\Cheat Engine 7.5\badassets\is-01QEO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 15 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.695302062158259
Encrypted:	false
SSDEEP:	3:yionv//thPlul4fRAadCmy9h/rywOievplxdGt0skV6UhhJnElnbgsrZsYp0rx1p:6v/lhPVfR19ghmFlyOho5gesE0Pp
MD5:	036394E78B67C1F5C2E1773B74D148E9
SHA1:	3B78B52F1C67BBA12A147BFCB805D6F913E70667
SHA-256:	96200DBE8BD64BDF2A85E1FE45FF2169FA08B080425A0F32E4F08A65D83CAB5B
SHA-512:	2156BD6E61EA3299F8CB83D9AB1A24062A7AAD743FCED71FBB108AE6F9FC5EBA72843D1619EFA5A9091402631739DDD960C17968B1A4A1027296CECC254C0E65
Malicious:	false
Preview:	.PNG........IHDR..............\Dt....bKGD..............pHYs..........+......tIME........<.s...@IDAT8.c....?......0p.Y...H.......qE..........YHS....C.f....LG........6....IEND.B`.

C:\Program Files\Cheat Engine 7.5\badassets\is-08GVN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 19 x 29, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	505
Entropy (8bit):	7.311302195073986
Encrypted:	false
SSDEEP:	12:6v/7CxmVcG25JcQqCKNaPzPmsI+BRBN3TMj2QQ:5oVDW2+BV37h
MD5:	8A33D6B05882AB755DFC9EE9C30526E1
SHA1:	FCFF4675AAE6CA1DD1AC67276779E023F33BC7FF
SHA-256:	234923BC14F06948F335599612BAE4E7CC422A8F6B8C0DEE34612618874A4149
SHA-512:	3FD3A3827DFD409B37FEE63547527A778AF589895D8136279FB3C4940EFB166017951FE5B0E30BCA95D19E57FD63DB38C6D21CF439084492FBC1287820260207
Malicious:	false
Preview:	.PNG........IHDR.............HZW.....bKGD..............pHYs..........+......tIME.........d....IDATH.U1O.@.}_u...d.[.....?...B\]...,n]\.1)1...F..I#..e.D......w.q$.4..}...zWbf....d.h\|~..H5...9...i..h.`.:...r"tR..f.=K?..4.I..vO..&0^..W{...t.W%t[ d./...%.......Z..f........<..sw..6v:....8o..R..g...2....J0..c.....^....1..iVUM_.eU.I...s2z..B.....a.......x.....67.Q@..F\|..._...;.'...jL.R....jLk...mD.4AuX.%"..h... Vk...F.....i....-c0.R.[FR...lLge.(...-MH^.....=D.q..!..}D......Y..)....IEND.B`.

C:\Program Files\Cheat Engine 7.5\badassets\is-17K0H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 66 x 61, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.502991938803606
Encrypted:	false
SSDEEP:	12:6v/7G1sYhROoOG76OFtzvDM28m4mH8qGjGMXOKvnzAiWbPQK+BQuIlFA4lii:/1sYhRrOUn8AH8NjGMlAhr9iIV
MD5:	EEBEE9670CFBE610C723F0FBF219C836
SHA1:	35F843D45886AC31773BB437580B5B423923F911
SHA-256:	CF3B603A78EAA24C63B082A4CD3936C139CD1885B6D3E60BA58FD47201BD374E
SHA-512:	C71AE264BF958A95E741B58BD1BBBE9ED975281EDBD95B25D1C5479E6EDA9C85B4DFC861B7B72B6A566B158E495B12CC835B17A4F5A35B32B6361E0F984BFF65
Malicious:	false
Preview:	.PNG........IHDR...B...=...... ......bKGD..............pHYs..........+......tIME......$...S...`IDATh...MJ.@.........".Bv.....7p..[..v.......,...i5..B......7Ig..43?.3yi'..[...3.........Qb..<x.(...%...@..6.t.k.[.....H...).R.P..(. X'..........Q.Q.@....@S...: 2.l.BU.AY.8..#v..;.J2v....`.!....4.B....t..X....`>...\.]...4I.......8..<:...Tx.X.0....X./...%p.1.W.A.....e...Nf..ES.....cx..o..0..L..S#.......;0......^.....([.x..kx..j...{p...0.?...0.rL~.6B.`t.nT..+.3.\|..].O..$...../Q_..,..$....v......e...)p..\|.a........O...%..j[;@. .6=d...y.....aj4lz..C..m.Bij....=W%.6.o.}ETk...m.;..u.#.../I..}.....=T.]u.2.N U.. .cX.y..a...^l..j...M@.D......a....<UA..$.@..a.......}R.x.$p.W..}...)4[8.q.....IEND.B`.

C:\Program Files\Cheat Engine 7.5\badassets\is-27QGG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 178 x 111, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5886
Entropy (8bit):	7.9428678398148485
Encrypted:	false
SSDEEP:	96:9fJTvp2iAJf329FCfsjYsvEG56SyjfEa186J70Lhvxg+NVE:9dvpPA129FC0WSyj06t0LNx3NVE
MD5:	5CFF22E5655D267B559261C37A423871
SHA1:	B60AE22DFD7843DD1522663A3F46B3E505744B0F
SHA-256:	A8D8227B8E97A713E0F1F5DB5286B3DB786B7148C1C8EB3D4BBFE683DC940DB9
SHA-512:	E00F5B4A7FA1989382DF800D168871530917FCD99EFCFE4418EF1B7E8473CAEA015F0B252CAC6A982BE93B5D873F4E9ACDB460C8E03AE1C6EEA9C37F84105E50
Malicious:	false
Preview:	.PNG........IHDR.......o.....H......bKGD..............pHYs..........+......tIME......,.<.....IDATx..{.TU~.?.....a.D..F..].....e.-....R....A.SX[....T.Xn.J.I..P$.......F..v.F....d...1......?..pO...<....u...w.{......;...8..2Q.f.....1....g.......V...c....J).:#.-.....}..VJA.....<^.7.<b..l...4.l.l..N..$ g.....b.t.}..V....7g.Y.[).0.,..R.`..;..w-..V....qQ\!.b,%..6..'...L.37.<..l_.........Y`6....0...MQ.......5.......H..&z.@.j.(Ol..R.J...f.(.....<.m.j...}5.Owy......c.z\|.L..e.{..\|i...{]....m..H..3R.E...^..D.u...N...,...K......^C#..>.~.<......r4.\...D.gg..W..5.........u.l...~..&..`-.:8.....X.o..W.dw...8.a....Iw.D.gg'O.S.?~.f.~.=`;p..........f.\....... ..y.....?....a...f..+Gm..WQh..hGX......y..h.f...1....9j\..>xq]...5.......+...ndK./6.K_E....h....K@"..&....8......p....d6.....$....I.C.&..rA.]...<.........f&i.'...P.3-.\.$...\|.>..V'kt..<.4..A...X][............PQq.A8../._.dh.\I..O>5.q...q.....].../.z.M kk4...: /... .....#8..c....ah..>..T..:...ay..l

C:\Program Files\Cheat Engine 7.5\badassets\is-83TT8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 19 x 29, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	504
Entropy (8bit):	7.275571489523102
Encrypted:	false
SSDEEP:	12:6v/7CxvhbFNUklTDVkB8TFMMOdlKKyYxAPG7AfGA4xCrx8Xv:55JN76B8TC5dlKKj7AeAif
MD5:	921DB78A66A3136C5866505D07BB29DD
SHA1:	B2E64DBE7E6DD9CDFA1590C8E4921796AAC81E7C
SHA-256:	62CCDA5C25930E2828891D7278A204DE4D3F35A2C6DA8CA029E9F859E34C4ABC
SHA-512:	A0B25C167E3DA1C2992473BDA15D7D10FAC0728421DD2CE27C165B8DB895E7CC349728382437D8F46EB38F0B36594DD0B3F3DC5912CF6FEF6FAB66D919F7CCFE
Malicious:	false
Preview:	.PNG........IHDR.............HZW.....bKGD..............pHYs..........+......tIME.......\5.....IDATH..1n.@.E...6.Uz."..p.."Q..9.e.%......H.)).%Mr.HH...$.:...l`w=."....._o.....8..5...`.S...~.5......"..9.!..S$("..3..8..4..C.....).....=....,d..d.pK.@2Zs..A.W....o..I..-.Yk.A.{N..t@9...YKtH&j..%...Z.T.!.=n.~.!......T+.:.:.xV~..3...8..1.c(......;.T..5w._.x...j.P=..7y......)..B..".)..3..M.+.-7....&!..h.._.\|.v...P../.....k....R[.d..iM.j.TM...f..y@.j..U5..>...A...Y......\|Y.c.1.A....IEND.B`.

C:\Program Files\Cheat Engine 7.5\badassets\is-9SETD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 67 x 62, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	652
Entropy (8bit):	7.426141389563401
Encrypted:	false
SSDEEP:	12:6v/7mDiFdklN0XVdLVd4tdOEMM018x56ps6zEL1J1lx70xbHYsAZhrljEXJ:DUklNmVdLV+dMM018ys5L15N0xLYhZBm
MD5:	BE0368A2650AAFCA0B6935E959BFF614
SHA1:	E55B9E3B7B49B04864E2254075385BACB25ACD12
SHA-256:	AED337C318176A195EC44E9ACC1D30FB1CC8154FF31F0ACB36DCC57867C50F20
SHA-512:	59E81D1EA29321E9BDA950188BBC4B531105B8907757EE7BCB1117724CB321F452D7930800D5E789A9BB9A4E38F1EED84E893123D8277196DA7B04CCDD4E6C64
Malicious:	false
Preview:	.PNG........IHDR...C...>.....pv.l....bKGD..............pHYs..........(J.....tIME.....).........IDATx..=s. ...........P....k}.A.....9..... B%.m.V..{!B.HY;?.... .......f................B.."A..J..BH.; .....B..{.'.(- ..".........7...........^...o:..l 4.9........g.....y.N...5D!.J......Z..........&........zCmM..R..q..^.9......6.Pa...Al.....m.H<.?.{.x.....D....:.!."I.Z.,.I...g.....j...`$.!.....T..x.B...J..{.S.m.?T!.}..uT0J.&I;.b/Dk.N..L....~.@.U.. ..4...k.I.f....B....G. .\.!...!R.b.o+.t..qd.V..#..$.T.......C.Fsth4.!QG..@..f..R.....%.(....eh.........ZH.....je.\.@...B.c.(a....ra/...W93@Iw.7.....`".....E..H&.f....IEND.B`.

C:\Program Files\Cheat Engine 7.5\badassets\is-CUSKP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 15 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	597
Entropy (8bit):	7.446044912854569
Encrypted:	false
SSDEEP:	12:6v/7NZFGnsl0cBhl9iF1Qhn9MfpUL7toskF5LGAim0ocq3nwwKKiN:i8slXGF1QhnKKLGi83iN
MD5:	8F1AF33632BEB4885863AB973CD781E6
SHA1:	547580EBBA11F0E51E68933F4355BBF981B2E306
SHA-256:	01698B5F5990658505BEB654446B367D5CCBA0FCA1D893D1C17E79489C379B29
SHA-512:	696CF1C9831B2528A6040F1F9DF38CACE6F5B992882F2BC48814EC88834921A558F2F0E55FB9921764A0DF885CC50B9A8D191CC3291903D0A6B58F140BFFAF64
Malicious:	false
Preview:	.PNG........IHDR..............\Dt....bKGD..............pHYs..........+......tIME......:........IDAT8..KVQ....y.$...!R\.I\.tqqpr...s.@..qs...%0.E......I.....Z..... .Po.y.^.....{......{.sB^.%.f1.W.....50...(.j..p......S5.SI...b..<..lt.6...,...8...u..%]...b..&6....M4...2...`.u0...s..Wlc.....N.E..E..Vr.FR.?.Y..q.... .U...F..I.......Y.op.....y..D......3i..y........,.K. .J..&.Yz..*.M[..........!..I......ld1\|i..2.E.a,....S.#y..Y..i.O.....(.b..m..L.\|%........1.R..9/....X.Y,&.5.4>..\|....m..(o..b......c...=.S.;...N.CH[..^f1..qb<O}.~......'.V._....b.^.t...M..K'.K....IEND.B`.

C:\Program Files\Cheat Engine 7.5\badassets\is-FS25O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 28 x 35, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	429
Entropy (8bit):	6.854308103958898
Encrypted:	false
SSDEEP:	12:6v/7I7PI/kFxNu/V0T0fCKBKkJCPbK1lwEcJz:7PlPoBKaCTK1rcJz
MD5:	835A1AC950006E5E0CB1F296BEA85DB0
SHA1:	D07388741EED5F29C83802519FC7DB7FE86E8163
SHA-256:	C448D3B58A8336780D31CF73F87EA2805B5786A7DB985A48C3B3EE4B4BC4E2C0
SHA-512:	5F5EBA5A8EAACBE02A3C01D9E689AB169EAFF9F1C09F0DDB289E92287A809089E72D8ED5E2FDBC16476AB64B66ACB799D4F75B5929A2D08543E8DA5A407ADBA6
Malicious:	false
Preview:	.PNG........IHDR.......#......!j.....sRGB.........gAMA......a.....pHYs..........(J.....bKGD..............tIME.......@M.9....IDATXGcdX.$.'....E/..,....&..[.......,.......:...n.....0....`3.b!.....".........f&J.R.2.@7.p.......[.AD.....`.YHD.a..zH.!r.Z......V...I..-$'8a..^.\|x..a(........!.`.Z./.H....Cb\|@./G..I.....?H!M}.e.[..(.4 ..........CX"....P.......l`.../0...jlmm.4...CRR':...Rk.\|H{.....q...{>d`..1...o.......IEND.B`.

C:\Program Files\Cheat Engine 7.5\badassets\is-H42I8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 67 x 62, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	619
Entropy (8bit):	7.419166205831757
Encrypted:	false
SSDEEP:	12:6v/7mDiFdr85Wibc7ez5jD2rSafCbOSVZ/jUHxyZCPpIV7RFvIdhR:DUvibcKztD2rnCqSDgQZApMdFvIdD
MD5:	C9A2D0DC2F22EC069650A82E64CEBB71
SHA1:	4FCC6F1A04A19B75E64A84943135DACF68488E2F
SHA-256:	9EA075327886EA4157DF25A64D9402EC6ACBEF24EE06C1D5DA3AEF96197F26EC
SHA-512:	356299EE44CFA760098AF2CB1EDEF250A5DEC285C0338B49A7F37B9B2D661353C4C356FD1FBE586A0C3844A665FE9B1C2DA38C735B6ED26DDCADA68772E47744
Malicious:	false
Preview:	.PNG........IHDR...C...>.....pv.l....bKGD..............pHYs..........(J.....tIME.....*........IDATx...Mr.0..`....g....e.\..:.fh.~.,...._.D.mpI:Zk.s>..cD..?....d.`V...fG.D.. . 8....g... ...... `B0..+N.........."!2..(G .."..^.....w ..t ?Fc.....a.}v..2.....6+.Cx.f...\F<.HV.h.....s<.J..7..e....E.W.1h;...++...C..\.}.....Ht..5......y......kL....h2..j.AhQ".J.1.....prY..X...(..~.7Vf.....7#.cC.{O...y...Dt\..i......=C{.e..+e./..J...].T...#.=M..jx......6..{w2}z1sF..q......<Af....M#.vI.k.NE.+.{.Vm....Z..1.H..G+H.J..X...e.ri/H.......>.....d.l.`...0a...-.:..{.P.o.Rn.o6....0.....2.[.&......IEND.B`.

C:\Program Files\Cheat Engine 7.5\badassets\is-IOO6H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 29 x 20, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	363
Entropy (8bit):	6.997646592515667
Encrypted:	false
SSDEEP:	6:6v/lhP2WwlqC19ghmqbMYO3RewQLzM1dVdsgj4TAqK4cOeQPJJEkGKWVp:6v/7WQ2KPPM1VjUAt/laKkGKU
MD5:	58967A69295A833A93B30E1A3D03C333
SHA1:	B0F984616A3EB0856284D6F5C98415510FB55E7F
SHA-256:	3278F339F9A3964D92C1BEF5C4E0A300C9C68587CDDA0F7A82B34FD73B95B409
SHA-512:	B1FA11ADB2DEBB9F5595DE056985BD39F9DF5A4F925DCDCFEB24A2BC500376C17FF42BF0644BD158D91C38CDD806C3AF7F2E22D041398EE092FE1C776FF86B85
Malicious:	false
Preview:	.PNG........IHDR.............q.6.....bKGD..............pHYs..........+......tIME.....03V.>.....IDATH...J.1......E;.].......x...Fg_.G.../.W.\|S._....3h.".....Czv0i..A.!.KB...\|Y{..2....../.VjS...'.k.x....v.?.@.U _..T.....\..4?:\|LaL..K./8K/.......\...c...^.-p.K...U.s......gK..)...TY^..x.+N.5.........I...&waB.1jY,..'j.Y.b.v.N'?...4....o(J1v..T.....IEND.B`.

C:\Program Files\Cheat Engine 7.5\badassets\is-L7LJI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 5 x 8, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.975104411893651
Encrypted:	false
SSDEEP:	3:yionv//thPlg5UwjHTAadCmy9h/rywOia85Fxf1v1JClwBWfxvo4AzsOfdp:6v/lhP+KWHT19ghmIFxRiwBYFfAzswdp
MD5:	8BCC2E16763817795E4E81EC86457038
SHA1:	050BDB436ADC138D2559D96842A5DD39FA1CF315
SHA-256:	CDFC96FBA6EFD3F26C779B4A892AFFFC292D451CC94104C3272B258E17204D07
SHA-512:	E992395ABE6F058F3135F5734789C1F4865F865E763BBB10CCE371BCC191E9DD358C1C633C8597601695B73AC008FC864A1AF6920501731E9FCF1C26344ACC22
Malicious:	false
Preview:	.PNG........IHDR.............1.5;....bKGD..............pHYs..........+......tIME......%..{....HIDAT..}.... ......tD?&..LM..8....*.:...=/...mVb....U....@.V.".ge.?.~6r...4Nw..!....IEND.B`.

C:\Program Files\Cheat Engine 7.5\badassets\is-LT1SS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 32 x 80, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1603
Entropy (8bit):	7.766393035061922
Encrypted:	false
SSDEEP:	48:tOvzUQQyWWYpwUbDBHeNAbVp42j5dMa5H:tWU/yWWYjbDBf4Cv7h
MD5:	F6264DDCEA613DC98D253BCB9B1FE484
SHA1:	FB85C887F5EF5440FE9837D7A8E578DBDE4DDB8B
SHA-256:	283DD43C10FF331011938D962F9B49C4D85D92AC044DC779A9EAE38640FD62DE
SHA-512:	CE052311662DBBF39D86963F0ACAA42713735101F15A16839584E1D6EACFB5FDA68381EDCB52F226A14D0B217B95FA4D5AD44186CF4A02830C52EE74CA617F42
Malicious:	false
Preview:	.PNG........IHDR... ...P.....xXw5....bKGD..............pHYs..........+......tIME......2Z......IDATh..kl.U....-..bk.H"zJ.(1. ..`........4."..T..,..~...`..I5E...J.`J.......(D.....P.....~.,......I6.3s.....{.=wB.X....e.B..x.....\|....E...$......6.k}...T.H[F..j.p..PD....Nb......v.O..U...@.2WD~..@U...dN.E.3..T...5%,.\|..5%.......Z.x<..u....q=LmM).u.V..X2},..E..^_..r7>.9..v\.5.eS.h...j4..&.....p.cSY..^...w..H.. .~...nT..`EU;.wDYQ.N.r..xe...mS..4T.N.(.Wl./...e.\}..o..o..p?...S....i~....H._.88...^..v.n.E........z.u.AO....A..y.A[g....w...c....-....$....t.....Y...O...!v..........@XU.,zjn......S>....m.C(..x.._Uca.AU......x;6b...]H.D..c!h.:...cl..0..u.".H..@D^.HH>.h)F..&CO....I. .....\|'......\|a1>...;....G.J....K....Uu..)..QN..Gv....a.K[<p3....H.G.V..L..."..0..Xb.["".B.H.3`..B+Pn8N).&....[..E..j{.e.=..HM..<'.t'.'.."...R\.+.....AD^...Tu.p..4.{..].....S"....Uu4...f)...f.H.g8V.I..,.@DB.c.....Y...o8..%..$M.Tu<p...rY4./._..1AD.'b`#...C....f..R.....F.[}@U.....

C:\Program Files\Cheat Engine 7.5\badassets\is-PPAMP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 178 x 111, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5886
Entropy (8bit):	7.9428678398148485
Encrypted:	false
SSDEEP:	96:9fJTvp2iAJf329FCfsjYsvEG56SyjfEa186J70Lhvxg+NVE:9dvpPA129FC0WSyj06t0LNx3NVE
MD5:	5CFF22E5655D267B559261C37A423871
SHA1:	B60AE22DFD7843DD1522663A3F46B3E505744B0F
SHA-256:	A8D8227B8E97A713E0F1F5DB5286B3DB786B7148C1C8EB3D4BBFE683DC940DB9
SHA-512:	E00F5B4A7FA1989382DF800D168871530917FCD99EFCFE4418EF1B7E8473CAEA015F0B252CAC6A982BE93B5D873F4E9ACDB460C8E03AE1C6EEA9C37F84105E50
Malicious:	false
Preview:	.PNG........IHDR.......o.....H......bKGD..............pHYs..........+......tIME......,.<.....IDATx..{.TU~.?.....a.D..F..].....e.-....R....A.SX[....T.Xn.J.I..P$.......F..v.F....d...1......?..pO...<....u...w.{......;...8..2Q.f.....1....g.......V...c....J).:#.-.....}..VJA.....<^.7.<b..l...4.l.l..N..$ g.....b.t.}..V....7g.Y.[).0.,..R.`..;..w-..V....qQ\!.b,%..6..'...L.37.<..l_.........Y`6....0...MQ.......5.......H..&z.@.j.(Ol..R.J...f.(.....<.m.j...}5.Owy......c.z\|.L..e.{..\|i...{]....m..H..3R.E...^..D.u...N...,...K......^C#..>.~.<......r4.\...D.gg..W..5.........u.l...~..&..`-.:8.....X.o..W.dw...8.a....Iw.D.gg'O.S.?~.f.~.=`;p..........f.\....... ..y.....?....a...f..+Gm..WQh..hGX......y..h.f...1....9j\..>xq]...5.......+...ndK./6.K_E....h....K@"..&....8......p....d6.....$....I.C.&..rA.]...<.........f&i.'...P.3-.\.$...\|.>..V'kt..<.4..A...X][............PQq.A8../._.dh.\I..O>5.q...q.....].../.z.M kk4...: /... .....#8..c....ah..>..T..:...ay..l

C:\Program Files\Cheat Engine 7.5\badassets\is-PVGIS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 66 x 61, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	707
Entropy (8bit):	7.4418596058676645
Encrypted:	false
SSDEEP:	12:6v/7GmBjAkh8fjIqLe7yagUPqvMPwE5t7frC1Tt00JETw0jg3Or2ksPd:/mBjAkh8fsqa7W2wEPDov3oQl
MD5:	45E0091B87215F768F524DBBEDEDD74E
SHA1:	9835B0E117146128C5EED7E43FBE1602C5C1BC23
SHA-256:	576467863491FAEDE8053F95BD0C66CF3C273F6B27A05984F81F51AA289191BE
SHA-512:	D627E4A81E32542A455A26B775E6CE30580658F4443CB84CF23022ADEC83A315264CE3FAEDD4315A62625843582396B76E994C6C0A91C2C63BB514B05B9ABE6B
Malicious:	false
Preview:	.PNG........IHDR...B...=...... ......bKGD..............pHYs..........+......tIME........-.%...PIDATh...1R.0...;?.W@E.".`.@..<.2?....R....4.M&...DCf.cY'..t2.....,..IFP..s...DD.~a.A.;.......5.H.`... ..........F.....T....\|.SQbA..As....` .B....B....810...@.H.......H....+.<.....(...\"B.F..u....]........~^..C7q..k.zp.Lh.p..{z.EG.. #.Z'........ w....c.^9.!v....3.&.!>-Zp..../.... 7.......O...>.f.*y..3....G.....)=.......+G...... F...G....`.b+.QV..WB0.1.";.....F.~+.?.D..L.p7...j.0.~..R...W...T...N.Z..2~...j,..@....3bi.#4.&..&y..d3V.#j...k.,.K...C%...%..s..yj.....7sJK]A..&p.D_17.$^../..).Z"a6"..zd...ZO.Q B..@r.H..1.N.R1.A......)~:?...E. .".#...7xrA4~;.C..1.._....}J.T.&0.j....aL#/.....IEND.B`.

C:\Program Files\Cheat Engine 7.5\badassets\is-V8UK4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 19 x 29, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	527
Entropy (8bit):	7.318123094870197
Encrypted:	false
SSDEEP:	12:6v/7CxqPIQ2+gvx+GZgCqWeJImCZx93IKOncOD:58DM4CJqWeizhZCcOD
MD5:	2D9E64B327D7DA0985A12E7E0A5425F4
SHA1:	00C63CA44D76210664A3FAD141E15A9A5A41720C
SHA-256:	D6B4699B0F3F69472163785DD20592C8BBB45FFF3843CB75D09CA9AF8AF66CB8
SHA-512:	27AFC9ACEC960911193EC1F3E939C5594DB0D0EA40A3590BBC9F24F0A51B1B5391696F9FC66042F2A475F539D7709EB04CEAE8A6741B58A8AE7F076C6D681A4B
Malicious:	false
Preview:	.PNG........IHDR.............HZW.....bKGD..............pHYs..........+......tIME......&...i....IDATH..?N.0...vm#eb..J=@r...:p......=..\.....,p..Jao.H.+...&4..R.......g. ..@R...I..........B.C..B.WHS.Y..!...YP...-..P!....d..N...i"..0L.....O......_..N.:.....i0...R.@......W.K}<../...^..;...j..n.l..u.J.S.^..<.}.t+...$.".q.....td.z}..R....r.r....3.5.(rn1."h.......T.:9........&...5.......0.`.....r..K.*.<. .8.mB2...}...>.6D[B.5.J.^+.......2.....i+.j.VM.3...7..J\..l..\|.....O..8........0..Q{:....IEND.B`.

C:\Program Files\Cheat Engine 7.5\badassets\lock.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 15 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	597
Entropy (8bit):	7.446044912854569
Encrypted:	false
SSDEEP:	12:6v/7NZFGnsl0cBhl9iF1Qhn9MfpUL7toskF5LGAim0ocq3nwwKKiN:i8slXGF1QhnKKLGi83iN
MD5:	8F1AF33632BEB4885863AB973CD781E6
SHA1:	547580EBBA11F0E51E68933F4355BBF981B2E306
SHA-256:	01698B5F5990658505BEB654446B367D5CCBA0FCA1D893D1C17E79489C379B29
SHA-512:	696CF1C9831B2528A6040F1F9DF38CACE6F5B992882F2BC48814EC88834921A558F2F0E55FB9921764A0DF885CC50B9A8D191CC3291903D0A6B58F140BFFAF64
Malicious:	false
Preview:	.PNG........IHDR..............\Dt....bKGD..............pHYs..........+......tIME......:........IDAT8..KVQ....y.$...!R\.I\.tqqpr...s.@..qs...%0.E......I.....Z..... .Po.y.^.....{......{.sB^.%.f1.W.....50...(.j..p......S5.SI...b..<..lt.6...,...8...u..%]...b..&6....M4...2...`.u0...s..Wlc.....N.E..E..Vr.FR.?.Y..q.... .U...F..I.......Y.op.....y..D......3i..y........,.K. .J..&.Yz..*.M[..........!..I......ld1\|i..2.E.a,....S.#y..Y..i.O.....(.b..m..L.\|%........1.R..9/....X.Y,&.5.4>..\|....m..(o..b......c...=.S.;...N.CH[..^f1..qb<O}.~......'.V._....b.^.t...M..K'.K....IEND.B`.

C:\Program Files\Cheat Engine 7.5\badassets\pausebutton.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 66 x 61, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.502991938803606
Encrypted:	false
SSDEEP:	12:6v/7G1sYhROoOG76OFtzvDM28m4mH8qGjGMXOKvnzAiWbPQK+BQuIlFA4lii:/1sYhRrOUn8AH8NjGMlAhr9iIV
MD5:	EEBEE9670CFBE610C723F0FBF219C836
SHA1:	35F843D45886AC31773BB437580B5B423923F911
SHA-256:	CF3B603A78EAA24C63B082A4CD3936C139CD1885B6D3E60BA58FD47201BD374E
SHA-512:	C71AE264BF958A95E741B58BD1BBBE9ED975281EDBD95B25D1C5479E6EDA9C85B4DFC861B7B72B6A566B158E495B12CC835B17A4F5A35B32B6361E0F984BFF65
Malicious:	false
Preview:	.PNG........IHDR...B...=...... ......bKGD..............pHYs..........+......tIME......$...S...`IDATh...MJ.@.........".Bv.....7p..[..v.......,...i5..B......7Ig..43?.3yi'..[...3.........Qb..<x.(...%...@..6.t.k.[.....H...).R.P..(. X'..........Q.Q.@....@S...: 2.l.BU.AY.8..#v..;.J2v....`.!....4.B....t..X....`>...\.]...4I.......8..<:...Tx.X.0....X./...%p.1.W.A.....e...Nf..ES.....cx..o..0..L..S#.......;0......^.....([.x..kx..j...{p...0.?...0.rL~.6B.`t.nT..+.3.\|..].O..$...../Q_..,..$....v......e...)p..\|.a........O...%..j[;@. .6=d...y.....aj4lz..C..m.Bij....=W%.6.o.}ETk...m.;..u.#.../I..}.....=T.]u.2.N U.. .cX.y..a...^l..j...M@.D......a....<UA..$.@..a.......}R.x.$p.W..}...)4[8.q.....IEND.B`.

C:\Program Files\Cheat Engine 7.5\badassets\platformenemy.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 29 x 20, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	363
Entropy (8bit):	6.997646592515667
Encrypted:	false
SSDEEP:	6:6v/lhP2WwlqC19ghmqbMYO3RewQLzM1dVdsgj4TAqK4cOeQPJJEkGKWVp:6v/7WQ2KPPM1VjUAt/laKkGKU
MD5:	58967A69295A833A93B30E1A3D03C333
SHA1:	B0F984616A3EB0856284D6F5C98415510FB55E7F
SHA-256:	3278F339F9A3964D92C1BEF5C4E0A300C9C68587CDDA0F7A82B34FD73B95B409
SHA-512:	B1FA11ADB2DEBB9F5595DE056985BD39F9DF5A4F925DCDCFEB24A2BC500376C17FF42BF0644BD158D91C38CDD806C3AF7F2E22D041398EE092FE1C776FF86B85
Malicious:	false
Preview:	.PNG........IHDR.............q.6.....bKGD..............pHYs..........+......tIME.....03V.>.....IDATH...J.1......E;.].......x...Fg_.G.../.W.\|S._....3h.".....Czv0i..A.!.KB...\|Y{..2....../.VjS...'.k.x....v.?.@.U _..T.....\..4?:\|LaL..K./8K/.......\...c...^.-p.K...U.s......gK..)...TY^..x.+N.5.........I...&waB.1jY,..'j.Y.b.v.N'?...4....o(J1v..T.....IEND.B`.

C:\Program Files\Cheat Engine 7.5\badassets\platformplayer.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 32 x 80, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1603
Entropy (8bit):	7.766393035061922
Encrypted:	false
SSDEEP:	48:tOvzUQQyWWYpwUbDBHeNAbVp42j5dMa5H:tWU/yWWYjbDBf4Cv7h
MD5:	F6264DDCEA613DC98D253BCB9B1FE484
SHA1:	FB85C887F5EF5440FE9837D7A8E578DBDE4DDB8B
SHA-256:	283DD43C10FF331011938D962F9B49C4D85D92AC044DC779A9EAE38640FD62DE
SHA-512:	CE052311662DBBF39D86963F0ACAA42713735101F15A16839584E1D6EACFB5FDA68381EDCB52F226A14D0B217B95FA4D5AD44186CF4A02830C52EE74CA617F42
Malicious:	false
Preview:	.PNG........IHDR... ...P.....xXw5....bKGD..............pHYs..........+......tIME......2Z......IDATh..kl.U....-..bk.H"zJ.(1. ..`........4."..T..,..~...`..I5E...J.`J.......(D.....P.....~.,......I6.3s.....{.=wB.X....e.B..x.....\|....E...$......6.k}...T.H[F..j.p..PD....Nb......v.O..U...@.2WD~..@U...dN.E.3..T...5%,.\|..5%.......Z.x<..u....q=LmM).u.V..X2},..E..^_..r7>.9..v\.5.eS.h...j4..&.....p.cSY..^...w..H.. .~...nT..`EU;.wDYQ.N.r..xe...mS..4T.N.(.Wl./...e.\}..o..o..p?...S....i~....H._.88...^..v.n.E........z.u.AO....A..y.A[g....w...c....-....$....t.....Y...O...!v..........@XU.,zjn......S>....m.C(..x.._Uca.AU......x;6b...]H.D..c!h.:...cl..0..u.".H..@D^.HH>.h)F..&CO....I. .....\|'......\|a1>...;....G.J....K....Uu..)..QN..Gv....a.K[<p3....H.G.V..L..."..0..Xb.["".B.H.3`..B+Pn8N).&....[..E..j{.e.=..HM..<'.t'.'.."...R\.+.....AD^...Tu.p..4.{..].....S"....Uu4...f)...f.H.g8V.I..,.@DB.c.....Y...o8..%..$M.Tu<p...rY4./._..1AD.'b`#...C....f..R.....F.[}@U.....

C:\Program Files\Cheat Engine 7.5\badassets\playership.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 28 x 35, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	429
Entropy (8bit):	6.854308103958898
Encrypted:	false
SSDEEP:	12:6v/7I7PI/kFxNu/V0T0fCKBKkJCPbK1lwEcJz:7PlPoBKaCTK1rcJz
MD5:	835A1AC950006E5E0CB1F296BEA85DB0
SHA1:	D07388741EED5F29C83802519FC7DB7FE86E8163
SHA-256:	C448D3B58A8336780D31CF73F87EA2805B5786A7DB985A48C3B3EE4B4BC4E2C0
SHA-512:	5F5EBA5A8EAACBE02A3C01D9E689AB169EAFF9F1C09F0DDB289E92287A809089E72D8ED5E2FDBC16476AB64B66ACB799D4F75B5929A2D08543E8DA5A407ADBA6
Malicious:	false
Preview:	.PNG........IHDR.......#......!j.....sRGB.........gAMA......a.....pHYs..........(J.....bKGD..............tIME.......@M.9....IDATXGcdX.$.'....E/..,....&..[.......,.......:...n.....0....`3.b!.....".........f&J.R.2.@7.p.......[.AD.....`.YHD.a..zH.!r.Z......V...I..-$'8a..^.\|x..a(........!.`.Z./.H....Cb\|@./G..I.....?H!M}.e.[..(.4 ..........CX"....P.......l`.../0...jlmm.4...CRR':...Rk.\|H{.....q...{>d`..1...o.......IEND.B`.

C:\Program Files\Cheat Engine 7.5\badassets\scoreboard.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 178 x 111, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5886
Entropy (8bit):	7.9428678398148485
Encrypted:	false
SSDEEP:	96:9fJTvp2iAJf329FCfsjYsvEG56SyjfEa186J70Lhvxg+NVE:9dvpPA129FC0WSyj06t0LNx3NVE
MD5:	5CFF22E5655D267B559261C37A423871
SHA1:	B60AE22DFD7843DD1522663A3F46B3E505744B0F
SHA-256:	A8D8227B8E97A713E0F1F5DB5286B3DB786B7148C1C8EB3D4BBFE683DC940DB9
SHA-512:	E00F5B4A7FA1989382DF800D168871530917FCD99EFCFE4418EF1B7E8473CAEA015F0B252CAC6A982BE93B5D873F4E9ACDB460C8E03AE1C6EEA9C37F84105E50
Malicious:	false
Preview:	.PNG........IHDR.......o.....H......bKGD..............pHYs..........+......tIME......,.<.....IDATx..{.TU~.?.....a.D..F..].....e.-....R....A.SX[....T.Xn.J.I..P$.......F..v.F....d...1......?..pO...<....u...w.{......;...8..2Q.f.....1....g.......V...c....J).:#.-.....}..VJA.....<^.7.<b..l...4.l.l..N..$ g.....b.t.}..V....7g.Y.[).0.,..R.`..;..w-..V....qQ\!.b,%..6..'...L.37.<..l_.........Y`6....0...MQ.......5.......H..&z.@.j.(Ol..R.J...f.(.....<.m.j...}5.Owy......c.z\|.L..e.{..\|i...{]....m..H..3R.E...^..D.u...N...,...K......^C#..>.~.<......r4.\...D.gg..W..5.........u.l...~..&..`-.:8.....X.o..W.dw...8.a....Iw.D.gg'O.S.?~.f.~.=`;p..........f.\....... ..y.....?....a...f..+Gm..WQh..hGX......y..h.f...1....9j\..>xq]...5.......+...ndK./6.K_E....h....K@"..&....8......p....d6.....$....I.C.&..rA.]...<.........f&i.'...P.3-.\.$...\|.>..V'kt..<.4..A...X][............PQq.A8../._.dh.\I..O>5.q...q.....].../.z.M kk4...: /... .....#8..c....ah..>..T..:...ay..l

C:\Program Files\Cheat Engine 7.5\badassets\shieldedtarget.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 67 x 62, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	652
Entropy (8bit):	7.426141389563401
Encrypted:	false
SSDEEP:	12:6v/7mDiFdklN0XVdLVd4tdOEMM018x56ps6zEL1J1lx70xbHYsAZhrljEXJ:DUklNmVdLV+dMM018ys5L15N0xLYhZBm
MD5:	BE0368A2650AAFCA0B6935E959BFF614
SHA1:	E55B9E3B7B49B04864E2254075385BACB25ACD12
SHA-256:	AED337C318176A195EC44E9ACC1D30FB1CC8154FF31F0ACB36DCC57867C50F20
SHA-512:	59E81D1EA29321E9BDA950188BBC4B531105B8907757EE7BCB1117724CB321F452D7930800D5E789A9BB9A4E38F1EED84E893123D8277196DA7B04CCDD4E6C64
Malicious:	false
Preview:	.PNG........IHDR...C...>.....pv.l....bKGD..............pHYs..........(J.....tIME.....).........IDATx..=s. ...........P....k}.A.....9..... B%.m.V..{!B.HY;?.... .......f................B.."A..J..BH.; .....B..{.'.(- ..".........7...........^...o:..l 4.9........g.....y.N...5D!.J......Z..........&........zCmM..R..q..^.9......6.Pa...Al.....m.H<.?.{.x.....D....:.!."I.Z.,.I...g.....j...`$.!.....T..x.B...J..{.S.m.?T!.}..uT0J.&I;.b/Dk.N..L....~.@.U.. ..4...k.I.f....B....G. .\.!...!R.b.o+.t..qd.V..#..$.T.......C.Fsth4.!QG..@..f..R.....%.(....eh.........ZH.....je.\.@...B.c.(a....ra/...W93@Iw.7.....`".....E..H&.f....IEND.B`.

C:\Program Files\Cheat Engine 7.5\badassets\target.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 67 x 62, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	619
Entropy (8bit):	7.419166205831757
Encrypted:	false
SSDEEP:	12:6v/7mDiFdr85Wibc7ez5jD2rSafCbOSVZ/jUHxyZCPpIV7RFvIdhR:DUvibcKztD2rnCqSDgQZApMdFvIdD
MD5:	C9A2D0DC2F22EC069650A82E64CEBB71
SHA1:	4FCC6F1A04A19B75E64A84943135DACF68488E2F
SHA-256:	9EA075327886EA4157DF25A64D9402EC6ACBEF24EE06C1D5DA3AEF96197F26EC
SHA-512:	356299EE44CFA760098AF2CB1EDEF250A5DEC285C0338B49A7F37B9B2D661353C4C356FD1FBE586A0C3844A665FE9B1C2DA38C735B6ED26DDCADA68772E47744
Malicious:	false
Preview:	.PNG........IHDR...C...>.....pv.l....bKGD..............pHYs..........(J.....tIME.....*........IDATx...Mr.0..`....g....e.\..:.fh.~.,...._.D.mpI:Zk.s>..cD..?....d.`V...fG.D.. . 8....g... ...... `B0..+N.........."!2..(G .."..^.....w ..t ?Fc.....a.}v..2.....6+.Cx.f...\F<.HV.h.....s<.J..7..e....E.W.1h;...++...C..\.}.....Ht..5......y......kL....h2..j.AhQ".J.1.....prY..X...(..~.7Vf.....7#.cC.{O...y...Dt\..i......=C{.e..+e./..J...].T...#.=M..jx......6..{w2}z1sF..q......<Af....M#.vI.k.NE.+.{.Vm....Z..1.H..G+H.J..X...e.ri/H.......>.....d.l.`...0a...-.:..{.P.o.Rn.o6....0.....2.[.&......IEND.B`.

C:\Program Files\Cheat Engine 7.5\badassets\xxx.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 19 x 29, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	505
Entropy (8bit):	7.311302195073986
Encrypted:	false
SSDEEP:	12:6v/7CxmVcG25JcQqCKNaPzPmsI+BRBN3TMj2QQ:5oVDW2+BV37h
MD5:	8A33D6B05882AB755DFC9EE9C30526E1
SHA1:	FCFF4675AAE6CA1DD1AC67276779E023F33BC7FF
SHA-256:	234923BC14F06948F335599612BAE4E7CC422A8F6B8C0DEE34612618874A4149
SHA-512:	3FD3A3827DFD409B37FEE63547527A778AF589895D8136279FB3C4940EFB166017951FE5B0E30BCA95D19E57FD63DB38C6D21CF439084492FBC1287820260207
Malicious:	false
Preview:	.PNG........IHDR.............HZW.....bKGD..............pHYs..........+......tIME.........d....IDATH.U1O.@.}_u...d.[.....?...B\]...,n]\.1)1...F..I#..e.D......w.q$.4..}...zWbf....d.h\|~..H5...9...i..h.`.:...r"tR..f.=K?..4.I..vO..&0^..W{...t.W%t[ d./...%.......Z..f........<..sw..6v:....8o..R..g...2....J0..c.....^....1..iVUM_.eU.I...s2z..B.....a.......x.....67.Q@..F\|..._...;.'...jL.R....jLk...mD.4AuX.%"..h... Vk...F.....i....-c0.R.[FR...lLge.(...-MH^.....=D.q..!..}D......Y..)....IEND.B`.

C:\Program Files\Cheat Engine 7.5\badassets\xxx2.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 19 x 29, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	504
Entropy (8bit):	7.275571489523102
Encrypted:	false
SSDEEP:	12:6v/7CxvhbFNUklTDVkB8TFMMOdlKKyYxAPG7AfGA4xCrx8Xv:55JN76B8TC5dlKKj7AeAif
MD5:	921DB78A66A3136C5866505D07BB29DD
SHA1:	B2E64DBE7E6DD9CDFA1590C8E4921796AAC81E7C
SHA-256:	62CCDA5C25930E2828891D7278A204DE4D3F35A2C6DA8CA029E9F859E34C4ABC
SHA-512:	A0B25C167E3DA1C2992473BDA15D7D10FAC0728421DD2CE27C165B8DB895E7CC349728382437D8F46EB38F0B36594DD0B3F3DC5912CF6FEF6FAB66D919F7CCFE
Malicious:	false
Preview:	.PNG........IHDR.............HZW.....bKGD..............pHYs..........+......tIME.......\5.....IDATH..1n.@.E...6.Uz."..p.."Q..9.e.%......H.)).%Mr.HH...$.:...l`w=."....._o.....8..5...`.S...~.5......"..9.!..S$("..3..8..4..C.....).....=....,d..d.pK.@2Zs..A.W....o..I..-.Yk.A.{N..t@9...YKtH&j..%...Z.T.!.=n.~.!......T+.:.:.xV~..3...8..1.c(......;.T..5w._.x...j.P=..7y......)..B..".)..3..M.+.-7....&!..h.._.\|.v...P../.....k....R[.d..iM.j.TM...f..y@.j..U5..>...A...Y......\|Y.c.1.A....IEND.B`.

C:\Program Files\Cheat Engine 7.5\badassets\xxx3.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PNG image data, 19 x 29, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	527
Entropy (8bit):	7.318123094870197
Encrypted:	false
SSDEEP:	12:6v/7CxqPIQ2+gvx+GZgCqWeJImCZx93IKOncOD:58DM4CJqWeizhZCcOD
MD5:	2D9E64B327D7DA0985A12E7E0A5425F4
SHA1:	00C63CA44D76210664A3FAD141E15A9A5A41720C
SHA-256:	D6B4699B0F3F69472163785DD20592C8BBB45FFF3843CB75D09CA9AF8AF66CB8
SHA-512:	27AFC9ACEC960911193EC1F3E939C5594DB0D0EA40A3590BBC9F24F0A51B1B5391696F9FC66042F2A475F539D7709EB04CEAE8A6741B58A8AE7F076C6D681A4B
Malicious:	false
Preview:	.PNG........IHDR.............HZW.....bKGD..............pHYs..........+......tIME......&...i....IDATH..?N.0...vm#eb..J=@r...:p......=..\.....,p..Jao.H.+...&4..R.......g. ..@R...I..........B.C..B.WHS.Y..!...YP...-..P!....d..N...i"..0L.....O......_..N.:.....i0...R.@......W.K}<../...^..;...j..n.l..u.J.S.^..<.}.t+...$.".q.....td.z}..R....r.r....3.5.(rn1."h.......T.:9........&...5.......0.`.....r..K.*.<. .8.mB2...}...>.6D[B.5.J.^+.......2.....i+.j.VM.3...7..J\..l..\|.....O..8........0..Q{:....IEND.B`.

C:\Program Files\Cheat Engine 7.5\ced3d10hook.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131480
Entropy (8bit):	6.84563405497219
Encrypted:	false
SSDEEP:	1536:jRXPVJPMo10+PfXl/IRTlsfQstLh66crJWeWyPCUpfrCWV13P1+CUOEvCvOEMI7:BdJPMlMb1g6e0dU9rf3P7UObvOja
MD5:	43DAC1F3CA6B48263029B348111E3255
SHA1:	9E399FDDC2A256292A07B5C3A16B1C8BDD8DA5C1
SHA-256:	148F12445F11A50EFBD23509139BF06A47D453E8514733B5A15868D10CC6E066
SHA-512:	6E77A429923B503FC08895995EB8817E36145169C2937DACC2DA92B846F45101846E98191AEB4F0F2F13FFF05D0836AA658F505A04208188278718166C5E3032
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[.;.:.h.:.h.:.h.h4h.:.h.h"h.:.h.h%h.:.hN.jh.:.hAh=h.:.h.:.h.:.h.h+h.:.h.h3h.:.h.h0h.:.hRich.:.h........................PE..L...~..S...........!.........h......wd.......@......................................EA....@.........................pr..G....j..P........................g......d....A..............................._..@............@..X............................text....,.......................... ..`.rdata...3...@...4...2..............@..@.data....0...........f..............@....rsrc................\|..............@..@.reloc..$............~..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\ced3d10hook64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	144280
Entropy (8bit):	6.553148474736184
Encrypted:	false
SSDEEP:	3072:Kd3u82FbW5v1B9omLKfBbYWFhFCsfa5z8saPFZ1sL3OD1Ow:Kd+NFbWUMKfBTjFxfa5a1y4N
MD5:	0DAF9F07847CCEB0F0760BF5D770B8C1
SHA1:	992CC461F67ACEA58A866A78B6EEFB0CBCC3AAA1
SHA-256:	A2AC2BA27B0ED9ACC3F0EA1BEF9909A59169BC2EB16C979EF8E736A784BF2FA4
SHA-512:	B4DDA28721DE88A372AF39D4DFBA6E612CE06CC443D6A6D636334865A9F8CA555591FB36D9829B54BC0FB27F486D4F216D50F68E1C2DF067439FE8EBBF203B6A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q..7...d...d...d..Vd{..d..@d...d..Qd9..d...d...d.Id...d...dq..d.._d...d..Gd...d..Dd...dRich...d........PE..d...p..S.........." .....F...........t.......................................0............@.........................................p...G......P........................g... ..h...0c...............................................`...............................text...fD.......F.................. ..`.rdata...J...`...L...J..............@..@.data....<..........................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\ced3d11hook.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	140696
Entropy (8bit):	6.856834819192468
Encrypted:	false
SSDEEP:	1536:onOLYqoZQBD3m7bmVLcuVGpGXlWXQznQN8erRxQEmsYOT1GlERbo3iV8n/7DkCWy:o4YqoZNHi7VBAXvXMZ7ll3iyn3WOR3Oc
MD5:	42E2BF4210F8126E3D655218BD2AF2E4
SHA1:	78EFCB9138EB0C800451CF2BCC10E92A3ADF5B72
SHA-256:	1E30126BADFFFB231A605C6764DD98895208779EF440EA20015AB560263DD288
SHA-512:	C985988D0832CE26337F774B160AC369F2957C306A1D82FBBFFE87D9062AE5F3AF3C1209768CD574182669CD4495DBA26B6F1388814C0724A7812218B0B8DC74
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s.u...&...&...&.@r&...&.@d&...&.@c&...&=.,&...&2@{&...&...&...&.@m&...&.@u&...&.@v&...&Rich...&........................PE..L...~..S...........!.....@...z......*l.......P......................................x.....@.........................`...G...l...P........................g...........Q.................................@............P..X............................text....>.......@.................. ..`.rdata...E...P...F...D..............@..@.data....1..........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\ced3d11hook64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	149912
Entropy (8bit):	6.586184520889439
Encrypted:	false
SSDEEP:	3072:/20T06lYodB6ZcnHgSFulvfV0tYP/ipaQ8PFRBIiOBNOW:1Y6bdB6uHgSwtfV0+P/is1BIpD
MD5:	0EAAC872AADC457C87EE995BBF45A9C1
SHA1:	5E9E9B98F40424AD5397FC73C13B882D75499D27
SHA-256:	6F505CC5973687BBDA1C2D9AC8A635D333F57C12067C54DA7453D9448AB40B8F
SHA-512:	164D1E6EF537D44AC4C0FD90D3C708843A74AC2E08FA2B3F0FDD4A180401210847E0F7BB8EC3056F5DC1D5A54D3239C59FB37914CE7742A4C0EB81578657D24B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Pr.P.............As.e....Ae......At.:.....;......Al.........p....Az......Ab......Aa.....Rich............................PE..d...p..S.........." .....Z..........@\|.......................................@......b.....@.............................................G.......P.... ...................g...0..h...0s...............................................p...............................text....Y.......Z.................. ..`.rdata...L...p...N...^..............@..@.data....<..........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\ced3d9hook.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	127384
Entropy (8bit):	6.856313478886397
Encrypted:	false
SSDEEP:	1536:yq8Iw0TnMfrUEuKo+w/lT35oBqhSw3kmuqW3Crf0d3N1NsCeOEy6jCMpOEsC:yq8IdTMTyXUR2JJry3NreOnMpOu
MD5:	5F1A333671BF167730ED5F70C2C18008
SHA1:	C8233BBC6178BA646252C6566789B82A3296CAB5
SHA-256:	FD2A2B4FE4504C56347C35F24D566CC0510E81706175395D0A2BA26A013C4DAF
SHA-512:	6986D93E680B3776EB5700143FC35D60CA9DBBDF83498F8731C673F9FD77C8699A24A4849DB2A273AA991B8289E4D6C3142BBDE77E11F2FAF603DF43E8FEA105
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[.;.:.h.:.h.:.h.h8h.:.h.h.h.:.h.h)h.:.hN.fh.:.hAh1h.:.h.:.h.:.h.h'h.:.h.h?h.:.h.h<h.:.hRich.:.h........................PE..L...}..S...........!.........j......#T.......0......................................r.....@..........................c..b....Z..P........................g......<....1..............................(P..@............0..`............................text............................... ..`.rdata..r4...0...6... ..............@..@.data....0...p.......V..............@....rsrc................l..............@..@.reloc...............n..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\ced3d9hook64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	140184
Entropy (8bit):	6.5832665674944435
Encrypted:	false
SSDEEP:	3072:6UoPePVhoZB34/UWFdQomnRepTPFn35eoONSO2:j8ZBvWrnmnR2Un+
MD5:	61BA5199C4E601FA6340E46BEF0DFF2D
SHA1:	7C1A51D6D75B001BA1ACDE2ACB0919B939B392C3
SHA-256:	8783F06F7B123E16042BB0AF91FF196B698D3CD2AA930E3EA97CFC553D9FC0F4
SHA-512:	8CE180A622A5788BB66C5F3A4ABFDE62C858E86962F29091E9C157753088DDC826C67C51FF26567BFE2B75737897F14E6BB17EC89F52B525F6577097F1647D31
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.k6...e...e...e...e{..e...e...e...e9..e...e...e..e...e...es..e...e...e...e...e...e...eRich...e........PE..d...p..S.........." .....4...........b....................................... .......1....@......................................... ...b...D...P........................g......h...@S...............................................P...............................text....2.......4.................. ..`.rdata...L...P...N...8..............@..@.data....<..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\celua.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with very long lines (520), with CRLF line terminators
Category:	dropped
Size (bytes):	215333
Entropy (8bit):	4.786182096058482
Encrypted:	false
SSDEEP:	6144:VcIxsXTXvMeRTWJANaOOwubWiSe65oCmL/+5y/McvJVNry++Ctso2NwVWy+cOcEV:JLSRgun
MD5:	924416232DF99AEF96A2D9E8125AFE78
SHA1:	7F29A338CEFA00BE5FCDC8B94C41FFC31EE625B9
SHA-256:	77C6D324F03A8429BCE858824CFFFCFB7A50D39616D2F9D2729910E086F5AD9A
SHA-512:	470C55E302C86353584EEABB3510B4EFF6353ED16F549DB7C155B2C8283216F2B413D77C9FE20A12F6F55A07C9BE24614DF3A8F5B2CABF1597010249239D63F5
Malicious:	false
Preview:	List of CE specific functions and variables:....Global Variables:..TrainerOrigin : A variable that contains the path of the trainer that launched cheat engine (Only set when launched as a trainer)..process : A variable that contains the main modulename of the currently opened process..MainForm: The main ce gui..AddressList: The address list of the main ce gui......Global Functions:..getCEVersion(): Returns a floating point value specifying the version of cheat engine..getCheatEngineFileVersion(): Returns the full version data of the cheat engine version. A raw integer, and a table containing major, minor, release and build....getOperatingSystem(): Returns 0 if CE is running in Windows, 1 for Mac....darkMode(): Returns true if CE is running in windows Dark Mode. Has no effect on mac....activateProtection(): Prevents basic memory scanners from opening the cheat engine process (Not that useful)..enableDRM(altitude OPTIONAL, secondaryprocessid OPTIONAL ) : Prevents normal memory scanners f

C:\Program Files\Cheat Engine 7.5\ceregreset.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	309664
Entropy (8bit):	5.8237432164000404
Encrypted:	false
SSDEEP:	6144:TDwf7I4zq0ZDVQ5uIqp5rkenPajp80Gc5:T0f7Bz/G5uImQaPajp3
MD5:	59089C96334966EDFFC70BF4AE829910
SHA1:	8DC37D6F2364749D52DB1BCB9AD9FE30FB93930D
SHA-256:	49A55638C5A0F8112B89C45A24A2BCD102FF5DE2D22386649D7F6FFD283AF1FD
SHA-512:	3EDD411905298FDE78DF57B063B4B2000FA2D16F0E1A14E8940D4FBC2226C1CBA6925C47D3BECC10E76BBA9C5864CF671F5EF3B29CFA430823D0FA9BF9BBC3A9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................e.......).. .............@.........................................................................`..d....p...............N...k......\|...........................P........................b...............................text....e.......f.................. ..`.data................j..............@....rdata...~..........................@..@.bss.....)... ...........................CRT.........P......................@....idata.......`......................@....rsrc........p......................@....reloc..\|........0..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\cheatengine-i386.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12807608
Entropy (8bit):	6.604078603198481
Encrypted:	false
SSDEEP:	393216:ueBcnBaXXA3MnU+239JmqUKSw6knnbWUuMu25s8U:uis/c2GF
MD5:	5BE6A65F186CF219FA25BDD261616300
SHA1:	B5D5AE2477653ABD03B56D1C536C9A2A5C5F7487
SHA-256:	274E91A91A7A520F76C8E854DC42F96484AF2D69277312D861071BDE5A91991C
SHA-512:	69634D85F66127999EA4914A93B3B7C90BC8C8FAB1B458CFA6F21AB0216D1DACC50976354F7F010BB31C5873CC2D2C30B4A715397FB0E9E01A5233C2521E7716
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................./......&h..t...q...<.......@h...@.................................$........................................P...........................k..................................P@h......................\..L............................text....&h......(h................. ..`.data....t...@h..v...,h.............@....rdata..X.B...u...B...u.............@..@.bss.....q...............................CRT.........@......................@....idata...H...P...J..................@....rsrc............ .................@.../4..................................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\cheatengine-i386.exe.sig (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	data
Category:	dropped
Size (bytes):	132
Entropy (8bit):	6.551821770808043
Encrypted:	false
SSDEEP:	3:SNjBeQx+FGOujzBAk+skvy2a4nfJKnBTa6C:+jkk+dsAk+Fzag+BTab
MD5:	ADAFB7CDCA51FC803718F25172652DD3
SHA1:	DD882B60A842B0992F478349898415A857934330
SHA-256:	B1B61B2570DBAF2747C4862B8429424514D300A7E14B5065C8BBB4B751179E7E
SHA-512:	D0B3D17F0F1EFB8F2F0BCAA1295AED08043F0218BCFA092A47D46308911EC4BC2441711CAB300B852DE3DBCED1C83536750B1A77A75EAE5C8CBF95991AA88714
Malicious:	false
Preview:	.CaG.(9......q.5..4S..%..+...U*.>{5.......M.....-..kF.....7.."z..W.Lc...."6/.V.N..p.YC?...:m.D.k.T....u.0...c.U.h...\;1`.`B..

C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16708024
Entropy (8bit):	6.11289505731243
Encrypted:	false
SSDEEP:	196608:H/KthjnNWKtC5bqOrXSFjmnIQGQCW/4PRtYRN3Ticx8cP:fKthjnNWKtC5bqOrXSjmnxGQaTdy8c
MD5:	910DE25BD63B5DA521FC0B598920C4EC
SHA1:	94A15930AAF99F12B349BE80924857673CDC8566
SHA-256:	8CAEF5000B57BCA014EF33E962DF4FCA21AEAD0664892724674619EF732440AD
SHA-512:	6FF910BB4912FEA1FA8FD91E47AE6348C8BF2EFF4F2F5F9EF646A775CA1ECFEF02C23F81BAF6FE2D0B0BDDA7617D91DF52E75DC6063E86EA0444B0538CBD4E6C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./.......{.....@....=........@......................................!.......................................................P...............p..L........k..................................p.{.(....................i..H............................text.....{.......{................. ..`.data.........{.......{.............@....rdata...qa......ra................@..@.pdata..L....p.......F..............@..@.bss....@....0...........................CRT.........@......................@....idata...b...P...d..................@....rsrc............ ...d..............@.../4......(...........................@..B........................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe.sig (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	data
Category:	dropped
Size (bytes):	132
Entropy (8bit):	6.561254441246199
Encrypted:	false
SSDEEP:	3:OP/KrtviZQl8kimG0bj/xeRBtjajKdp2tAdNQL6aj:8/XQl823j5eRBtOjK2tGNe6aj
MD5:	735EAEA06DAE6CD67680127419FBA366
SHA1:	A38126141A4266CDBA17B22CBC4588D88CCFCEB5
SHA-256:	5A2D3E0F10E3701DFB251C3F270B00493CEAD1C3D1CEB34FF976D70C57DC1B58
SHA-512:	92374BDC99BDDDCC2A8B74049B9FF1623EE03B505BA2607E31301F95F2DF8EF3513ECAD4491E2B6B61934F64816E3E9AD3FA3B0914E96D6E55A4B4DF4ED5E028
Malicious:	true
Preview:	.....s.....N..-.........YI .....L.`0......H...Ko.Y....f....Z.pe....... ..)..3.Go...F..s.U.C....{../._U.}\|.."*x..z..bn.D.>;....

C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16718264
Entropy (8bit):	6.110071636301838
Encrypted:	false
SSDEEP:	393216:sjcp4nsiRMX7ZbqE14ImAfltGYav/HX8h:bbqE1RmLvvY
MD5:	EDEEF697CBF212B5ECFCD9C1D9A8803D
SHA1:	E90585899AE4B4385A6D0BF43C516C122E7883E2
SHA-256:	AC9BCC7813C0063BDCD36D8E4E79A59B22F6E95C2D74C65A4249C7D5319AE3F6
SHA-512:	1AAA8FC2F9FAFECBE88ABF07FBC97DC03A7C68CC1D870513E921BF3CAEAA97128583293BF5078A69AECBB93BF1E531605B36BD756984DB8D703784627D1877D1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./.......{..........=........@......................................e.......................................................p...........................k..................................p.\|.(.......................H............................text.....{.......{................. ..`.data.........\|.......{.............@....rdata...xa......za................@..@.pdata...............n..............@..@.bss.........P...........................CRT.........`.......&..............@....idata...b...p...d...(..............@....rsrc............ ..................@.../4..................................@..B........................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64.exe.sig (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	data
Category:	dropped
Size (bytes):	132
Entropy (8bit):	6.608714005689305
Encrypted:	false
SSDEEP:	3:/toxN4m4GbUss7S2tY1wnwi9DU4liplagVMlWqOUFgaUSR708:Lm4GbnkSHunwlaiplNmlVOUaar08
MD5:	FE5E5B8B50F441DD772BFA1996AC744E
SHA1:	11D00533ADE98E94C7C6609F4E4B002A94CB440C
SHA-256:	A769BC72C97106722BF5CE8D76AFDC3EC54FC38931872B0637D8B7A281FFFE22
SHA-512:	559FB92A2C58B84AC1CDA6115AA175B0285EA98903EB1F6C91E3A0ECF39F6D667711F97D0EFF8CD98BA25256EC7B339E38D892A90186DB482587E1A80462A6EB
Malicious:	false
Preview:	.^..'....'..d.]-+4.].....Q..m...bs...w.M.kTBU..5C...e.....].a..0.N+rF^.-..\......f...B).#H......XM....Ej`.q....I.3p...p:.(.Y

C:\Program Files\Cheat Engine 7.5\clibs32\is-AQQPT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	109568
Entropy (8bit):	6.474745502920158
Encrypted:	false
SSDEEP:	1536:3jVqSAqTNsYdNB3XT8le/lqWG3v0ESpz7cv+qsWjcd4JJ:3jgYd3T88Up/0wu+J
MD5:	B0A3CB1FC2B5195842E8BF12FD9B87F4
SHA1:	EDC423C35A48EFFC139A224C10D1EDDE42B31BCE
SHA-256:	D39677CF84E33E4A55494D0AB4873B9F3BE16F83AD381B72B14D6C62CEF71518
SHA-512:	B93B073021DD63E4383CC2370D003CA058236A3E0860E034515EA894F6995B0ED4F198CB471CB2A5E0BF4330A4D84FBDA254C5A6F367781CD4A47B9C16D9371D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@.!...!...!...se..!...s[..!...sd.?!..\|.O..!...XY..!...!..'!....`..!....X..!...s_..!....Z..!..Rich.!..........................PE..L...b9/V...........!.....$..........84.......@............................................@.............................F...(...<...................................0B..8...........................x...@............@...............................text...{".......$.................. ..`.rdata...X...@...Z...(..............@..@.data....2..........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\clibs32\lfs.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	109568
Entropy (8bit):	6.474745502920158
Encrypted:	false
SSDEEP:	1536:3jVqSAqTNsYdNB3XT8le/lqWG3v0ESpz7cv+qsWjcd4JJ:3jgYd3T88Up/0wu+J
MD5:	B0A3CB1FC2B5195842E8BF12FD9B87F4
SHA1:	EDC423C35A48EFFC139A224C10D1EDDE42B31BCE
SHA-256:	D39677CF84E33E4A55494D0AB4873B9F3BE16F83AD381B72B14D6C62CEF71518
SHA-512:	B93B073021DD63E4383CC2370D003CA058236A3E0860E034515EA894F6995B0ED4F198CB471CB2A5E0BF4330A4D84FBDA254C5A6F367781CD4A47B9C16D9371D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@.!...!...!...se..!...s[..!...sd.?!..\|.O..!...XY..!...!..'!....`..!....X..!...s_..!....Z..!..Rich.!..........................PE..L...b9/V...........!.....$..........84.......@............................................@.............................F...(...<...................................0B..8...........................x...@............@...............................text...{".......$.................. ..`.rdata...X...@...Z...(..............@..@.data....2..........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\clibs64\is-701OU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	128000
Entropy (8bit):	6.022352271630432
Encrypted:	false
SSDEEP:	3072:BzlRkrowTiYa0u6lQUf3V/4MSfayysXZzjGRobJy:BRylTHa+/yMByyupY
MD5:	5E8AD34FF069B6A2E1AE00BDFE96B612
SHA1:	3C83AA3EBD95D9A060ED1F06E236E046C6CD93A7
SHA-256:	4EE8D3375F2EEB8E5AFB230D13C2CF9EE0379B0EDFA76AD8DBF5EBC686A629C1
SHA-512:	54404199C3B5B3597DC8FB5A6E3C6772F2729045AA5C9AEE648C4306358481DEF2BC15538899AB5E0F5E33D202CEC863348830A090B144E00D1662CCF4175828
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......dr[. .5. .5. .5.fB...5.fB...5.fB.).5.....".5.]j.#.5. .4...5....!.5....!.5.-A.!.5....!.5.Rich .5.........PE..d...\9/V.........." .....<...........7.......................................@............`.............................................F.......<.... .......................0......`T..8...........................@...p............P...............................text...p:.......<.................. ..`.rdata...~...P.......@..............@..@.data...p=..........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\clibs64\lfs.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	128000
Entropy (8bit):	6.022352271630432
Encrypted:	false
SSDEEP:	3072:BzlRkrowTiYa0u6lQUf3V/4MSfayysXZzjGRobJy:BRylTHa+/yMByyupY
MD5:	5E8AD34FF069B6A2E1AE00BDFE96B612
SHA1:	3C83AA3EBD95D9A060ED1F06E236E046C6CD93A7
SHA-256:	4EE8D3375F2EEB8E5AFB230D13C2CF9EE0379B0EDFA76AD8DBF5EBC686A629C1
SHA-512:	54404199C3B5B3597DC8FB5A6E3C6772F2729045AA5C9AEE648C4306358481DEF2BC15538899AB5E0F5E33D202CEC863348830A090B144E00D1662CCF4175828
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......dr[. .5. .5. .5.fB...5.fB...5.fB.).5.....".5.]j.#.5. .4...5....!.5....!.5.-A.!.5....!.5.Rich .5.........PE..d...\9/V.........." .....<...........7.......................................@............`.............................................F.......<.... .......................0......`T..8...........................@...p............P...............................text...p:.......<.................. ..`.rdata...~...P.......@..............@..@.data...p=..........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\commonmodulelist.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1882
Entropy (8bit):	4.658116184932645
Encrypted:	false
SSDEEP:	24:60wIlJhxWXs/2h8OjrGCLyO7OjO6NsVhVyQk7FUBL9HuTsx0refVS+IsZZsznGd2:HTP8gE8OvnKy6NsVu7FYLswlW/
MD5:	CC0F8B66BFEDC67DA8DBB2A7DF2AA006
SHA1:	C6D86CC43A042581E389DC9A28AFFDDF64294AC8
SHA-256:	CDDD0F35F7351E6F19486CCD7EEE5D31F0134C5C3554A12C7D51131DDE8E29CD
SHA-512:	A4AEC40AC6BEA2ADACF15829AEEEBE66117473A542303024669A828710C6AFD072C0F4890A6A334B35AC894A1A80A5BDD5E91A6FFCB7149540E304117A7E5800
Malicious:	false
Preview:	#write down modulenames that are commonly used by games..#this decreases the number of wrong results in various types of memory inspection....1911.dll..speedtreert.dll..visionengineplugin.vplugin..vision90.dll..vbase90.dll..nvscpapi.dll..physxcore.dll #nvidia physx..nxcooking.dll..physxloader.dll..physxextensions.dll..cudart.dll..openal32.dll..vorbisfile.dll..ogg.dll..vorbis.dll..vorbisenc.dll..vorbisfile.dll..binkw32.dll..bink2w64.dll..iconv.dll..gameoverlayrenderer.dll #steam..steam_api.dll..steam_api64.dll..steamclient.dll..steamclient64.dll..tier0_s.dll..vstdlib_s.dll..steam.dll..steam2.dll..mss32.dll..dbghelp.dll..umbra.dll..unrar.dll....#CE dll's..cehook.dll..allochook.dll..allochook-x86_64.dll..allochook-i386.dll..vehdebug-i386.dll..vehdebug-x86_64.dll..speedhack-i386.dll..speedhack-x86_64.dll..luaclient-i386.dll..luaclient-x86_64.dll..d3dhook.dll..d3dhook64.dll..ced3d9hook.dll..ced3d9hook64.dll..ced3d10hook.dll..ced3d10hook64.dll..ced3d11hook.dll..ced3d11hook64.dll..luaclient-

C:\Program Files\Cheat Engine 7.5\d3dhook.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	122776
Entropy (8bit):	6.859839225631497
Encrypted:	false
SSDEEP:	1536:QyfNvGKKZVGcuasOKQBBTff07PSZHCSVKOCDCA32XQaOCKnOEPChMOE6:lNvG7vGcIiBTMS18RD7325YO/hMOr
MD5:	2A2EBE526ACE7EEA5D58E416783D9087
SHA1:	5DABE0F7586F351ADDC8AFC5585EE9F70C99E6C4
SHA-256:	E2A7DF4C380667431F4443D5E5FC43964B76C8FCB9CF4C7DB921C4140B225B42
SHA-512:	94ED0038068ABDDD108F880DF23422E21F9808CE04A0D14299AACC5D573521F52626C0C2752B314CDA976F64DE52C4D5BCAC0158B37D43AFB9BC345F31FDBBC0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............h...h...h...:U..h...:D..h...:R..h..\|....h...h...h...:[..h...:@..h..Rich.h..........PE..L...}..S...........!.........j.......K....... .......................................d....@..................................L..<....................x...g...........!..............................XB..@............ ..\|............................text............................... ..`.rdata...5... ...6..................@..@.data...<0...`.......D..............@....rsrc................X..............@..@.reloc..h............Z..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\d3dhook64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	135064
Entropy (8bit):	6.612681349758152
Encrypted:	false
SSDEEP:	3072:ZGrrgbU27p/nFdpF/vwFLUjh2v5VjObfSVMPFtE8PdYO3kOc:crk3ZFdpRYUjh2verh6
MD5:	2AF7AFE35AB4825E58F43434F5AE9A0F
SHA1:	B67C51CAD09B236AE859A77D0807669283D6342F
SHA-256:	7D82694094C1BBC586E554FA87A4B1ED6EBC9EB14902FD429824DCD501339722
SHA-512:	23B7C6DB0CB9C918AD9F28FA0E4E683C7E2495E89A136B75B7E1BE6380591DA61B6FB4F7248191F28FD3D80C4A391744A96434B4AB96B9531B5EBB0EC970B9D0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........nV..............................%..........................Rich............PE..d...p..S.........." .....&...~......0\...............................................8....@.................................................l...<........................g......$....C...............................................@...............................text....%.......&.................. ..`.rdata..~K...@...L.................@..@.data....;...........v..............@....pdata..............................@..@.rsrc...............................@..@.reloc..>...........................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\dbk32.cepack (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	data
Category:	dropped
Size (bytes):	46468
Entropy (8bit):	7.994038510231404
Encrypted:	true
SSDEEP:	768:knKJWrjSpYCoxMO0HqzZuCxbSbONOirgFENxbWUYfQsQB/ju9x0QhS5d7uuNMRgH:knKJorQO0KcFigi841WUYfQhju9x0OcF
MD5:	715D61B9BCC484E271775F36865A4CDE
SHA1:	8AE158AEF6F6005AA3D6E6F8A09A05FD95551784
SHA-256:	C4B5797588C80520745732B96D7C6681F8420BDF55E426C40B852E56E5630124
SHA-512:	5C8E462FA504AC91D928617C74E287B598CE326A323C8A05533D4245D018A4A4CC354D05A0568785E7642D8CF779805950D70FE167C456B2D15F8901D714C037
Malicious:	false
Preview:	CEPACK0:....\|T..?~7..,...0.(....%........%.DL...uAE.....7...k...,..c[.........I.....Bk.y..........=..n6.}.......Wf.33g..9s..[r.V!U..#9E.........?...^.&.2..c....y.b...9..<..5?x(...<..#.....Y.x8...s..t.<......:d....K~.......O_....J...Q.S.y.o.m........^....F..G..s.A....D.E.......0.&...w....R...aV^.'.r_E?Vr.Z-.=E....K..j.].^i.4..Q.#"n.x.Y......l.r... ..N9.......7...m.U...o....~z........I.9. NY........N.....Q...=..bP......w..o(.P.a...7.o..V=B.Pv..I..o..-......1.sp.P(x........M...~-.......R.N7...P.o..:....0)...+.Rq.(../....L.O.e.......^..8'.{"..!.=R.\...\|.o.. ..U.c.5-.~g.S..3.A....p..+.#JC.....j..;.1S... ..STX.`y...Z....f.d....SI..Q....(P\|d....l0....<{...0{.r..Pr}...BE....{...2/;....H..kg.o....r<j.K3.S.U.e>X.<...c.4.d7/.`....k....YV.zU........).GO....Y.x....[.9.p...q.........G...7z.....y.......a.El.F9&...[3...XF.P.<l.rU.o.C.a.4w..jI.UeU.tUi......0.O..~J..^.a.M%VzwZ...U.WU$..qMU..h.\..MU...A.....1<...-......'...gG.U6!X.M.s

C:\Program Files\Cheat Engine 7.5\dbk64.cepack (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	data
Category:	dropped
Size (bytes):	55173
Entropy (8bit):	7.995644990698608
Encrypted:	true
SSDEEP:	1536:aPQbr8Hv6jZwnB8K5vHTcM2b9+lmFD/cEt1kbD5F:Tbr8Hv6ji75vHTx9kD/cquP
MD5:	3885F7AF9007DF5A9874E61EDBB45F58
SHA1:	F7A7719E5A9036604CC64922FF2DC4FD40D253DD
SHA-256:	52EAA08C57AA0BA9737ED4413786DAB747DF4C692F34BF601D4FB0B37F231D08
SHA-512:	CAFF16F4171D205A1B44B18651FBA7B72D33F7FDD657C5EBA44853B26929B3F48749D9C5B07F158EA903D41C09A905D27D0A4E3D7B6228550B8C255FC64D5A3D
Malicious:	false
Preview:	CEPACK.....{\|SE.8~o...4$"..."...JQ.P.Z..[.j}.E.VE..j]A[[.1........oD..)E[\.........1..."".....4e..........;....3g.9.V-O.47<..i./.........b..B...i....gB.EW.k....+'_..2....../.......E...N9=x..S.....D..>...W...g......Wr)../.s....C...}=..6.b.s[..~.?y...w.........i.M..t{.B..6..>.../W...0..k._;..........4.&.].....G....E.y....t....O..Wmj.K.P..ti...e...X`...I..k%;.3u....ow..D..E...:.h..D..E...r...dM.{WNS...%z...y..i...?5:..V.....F.:B]...=.gz.O.?..l.F.@.=G.....\9m..S4n.h+.wF........l..6[..W..f............W..pr]X..z+..t:.......5;......a.Y.u..R.{..f......X4Tx....o2..._.1o........d7.....g.......~.....XG_.._1c....}.......\|.........0.u....-.u..N..y=.~..:x5..C.k....j.A.HIuQ4...cZ./.6}.X........;.:5.....0?.N.`....x.......l..w...BEf\|F..GC.h....oe....V2..B.Y...b......'......q$6..k.7@M1x...i..o.Y.M....N+.N.1..x.~.r...............Qa...a..].p...._....d..$L....g..Nn.SQ[.......Mb..b\|y...}....%v1....D].,Jji..(Q.h..M..G.q...[B.h.j.y`

C:\Program Files\Cheat Engine 7.5\defines.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12502
Entropy (8bit):	5.40558493486102
Encrypted:	false
SSDEEP:	192:0egHuderGTd4G9mSZk/8fdtINfbLmJFcSC5xm+9qh07EBS5pekFrLUK80u9ETxst:AHuderlSZk/8FtIF4umMqEpDg3fT
MD5:	62E1FA241D417668F7C5DA6E4009A5A6
SHA1:	F887409E3C204A87731F317A999DC7E4CC8D3FCD
SHA-256:	82E8EF7DF20A86791CEF062F2DCACB1D91B4ADC9F5DEA2FD274886BE8365B2F8
SHA-512:	2283CBB9E1D5D53AD1ED9BC9DB6034FB3C53C633B11001F373523640BBBBA95DA9A3A0866C7D5FA0620FACAB7D18C8577DFD69496FC7319E0A4A74D0B9E10C45
Malicious:	false
Preview:	--Defines:....--checkbox state defines..cbUnchecked=0..cbChecked=1..cbGrayed=2......--onMouseEvent button defines:..mbLeft=0..mbRight=1..mbMiddle=2..mbExtra1=3..mbExtra2=4......--memo scrollbar defines..ssNone=0..ssHorizontal=1..ssVertical=2..ssBoth=3..ssAutoHorizontal=4..ssAutoVertical=5..ssAutoBoth=6......bsNone=0..bsSingle=1..bsSizeable=2..bsDialog=3..bsToolWindow=4..bsSizeToolWin=5........--scan types: (fast scan methods)..fsmNotAligned=0..fsmAligned=1..fsmLastDigits=2....--rounding types..rtRounded=0..rtExtremerounded=1..rtTruncated=2....--scan options..soUnknownValue=0..soExactValue=1..soValueBetween=2..soBiggerThan=3..soSmallerThan=4..soIncreasedValue=5..soIncreasedValueBy=6..soDecreasedValue=7..soDecreasedValueBy=8..soChanged=9..soUnchanged=10......--debug variables..--Breakpoint methods:..bpmInt3=0..bpmDebugRegister=1..bpmException=2......--Breakpoint triggers:..bptExecute=0..bptAccess=1..bptWrite=2....--breakpoint continue methods:..co_run=0..co_stepinto=1..co_stepover=2....-

C:\Program Files\Cheat Engine 7.5\donottrace.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.292808527787486
Encrypted:	false
SSDEEP:	3:VSPAiQ7UeSaClo+tHEu3jdXgOYsO:Vr7Ueyl4u3jdQOS
MD5:	A2E60A2F01F69D0DA415C58F25C37E5B
SHA1:	FA1A0D6183FEE10DE5FA4C554370556217E3AF26
SHA-256:	DC9354CCF9667D1E5CA13D6468BA2C258256042D7C25E6D91ADE7F8E2A2FF3BF
SHA-512:	CE7F5F8365D2EF3DA14D4123CC7EF053A7F99E8F98D47E6C5967F267B8EC7FDAC2DA993D0FC26DF8EB2FACE176BA56B7359BA1F29F021E1DFDD561B15EFE64AF
Malicious:	false
Preview:	#Enter modulenames you do not wish to trace..#kernel32.dll #example. comment out to ignore kernel32.dll

C:\Program Files\Cheat Engine 7.5\gtutorial-i386.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	3208608
Entropy (8bit):	6.4378051911330445
Encrypted:	false
SSDEEP:	49152:itwSHCeicAlYJhPx7Ur4+Kn8KTqeUrncXbvTCeVxkg8vL5V2zRkit6bch6WuDgR1:itwAf64swnNmnfsR3ccJkKSib
MD5:	0D4BDC37F5031A827B2877770974FE49
SHA1:	7D7D63F1CC49FB94D2FD59AF8A0BA89966CE0E07
SHA-256:	F3C536EC5307D71260FA5D6D70AC56A20A00DBC3FB785E0DEB4EF0F7DC66FC2E
SHA-512:	D1FAF9BCF6BBF6E458780F4D913BA600A5F987FF33BE8D24A1165F5BFA925B2D1DFFDAA6E666712D09D58478174BC2956877A4A60376F7773D1E818BB38A23E1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........................d...D....-.......0....@..........................@1.......1.......................................-...... ................0..k..................................P0......................8.-.\............................text............................... ..`.data...d....0......................@....rdata...=... %..>....%.............@..@.bss....D....`-..........................CRT..........-......F-.............@....idata.../....-..0...H-.............@....rsrc........ .......x-.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\gtutorial-x86_64.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4210080
Entropy (8bit):	6.041283402178925
Encrypted:	false
SSDEEP:	49152:aMiOO5AqojVbq2s2Kyvzq/9E3piKR+77v5WiESldKtyQ6WuDgRPOjgy+OSijV:aMiOOaBbq2VVvnlykESip
MD5:	AEC662CEAE2C4D5ABAEEEE084D828582
SHA1:	A57CEB95E3FD3F8E8C59C0B7E913E2681B64751D
SHA-256:	2DD35A044D1291D593F1DA15C40FD124DA3E4D52D0D045EC61465B725E58079D
SHA-512:	FF28EB79795A6D4AD97A5C79CEB5314208C616BE7CC9196622B9BB2AB8149C6CAA166EED6165923DC8FA253A400422CBEE9E061E72DCF61CE66C700D1451AE7A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./.......#..m......-........................................@...... A......................................................@=.......=......0:.Ta....?..k..................................p.$.(....................O=..............................text.....#.......#................. ..`.data....m....$..n....#.............@....rdata.......p......b.............@..@.pdata..Ta...0:..b....:.............@..@.bss.........<..........................CRT.........0=......~<.............@....idata..@>...@=..@....<.............@....rsrc.........=.......<.............@...................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\include\_mingw.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	3865
Entropy (8bit):	5.239566441223487
Encrypted:	false
SSDEEP:	48:aOgQsLqPQLHbXTN6oYsNhd6vgAwFQCbTprO5BPPTeraG9n0WP/zgSRQh:aOgQO3hdE8KBPPTrGHU5
MD5:	DC2829239704CDD5A5109699666FA573
SHA1:	60C09E102F552444D59ED9ED474E667136C16DC0
SHA-256:	AB4BE7D34E7FA0E722F0948E0C90AD4D95B8A1EC649C2F186DFA387B57BE7833
SHA-512:	F3551AEF2A0FFE42A16F1A8BE26B2C2722E773A59D21B60B2454AB0B68B008402623F378D2AFAA30FEBA87F560475A52D2899E6D062BD7F88E22119B25231F17
Malicious:	false
Preview:	/. _mingw.h. . This file is for TinyCC and not part of the Mingw32 package.. . THIS SOFTWARE IS NOT COPYRIGHTED. . This source code is offered for use in the public domain. You may. * use, modify or distribute it freely.. . This code is distributed in the hope that it will be useful but. * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY. * DISCLAIMED. This includes but is not limited to warranties of. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.. . /..#ifndef __MINGW_H.#define __MINGW_H../* some winapi files define these before including _mingw.h --> /.#undef __cdecl.#undef _X86_.#undef WIN32./ <-- */..#include <stddef.h>.#include <stdarg.h>..#define __int8 char.#define __int16 short.#define __int32 int.#define __int64 long long.#define _HAVE_INT64..#define __cdecl.#define __declspec(x) __attribute__((x)).#define __unaligned __attribute__((packed)).#define __fastcall __attribute__((fastcall))..#define __MSVCRT__ 1.#undef _MSVCRT_

C:\Program Files\Cheat Engine 7.5\include\assert.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	1439
Entropy (8bit):	5.2295620824781714
Encrypted:	false
SSDEEP:	24:i2PSh0PDaGduHH7PPW3ep0m3Vp0GrHt+5p0CKpmucLNw/HHsuHfgpbrRD:GRdm3emm3Vm+HOmCKmC1fgdp
MD5:	9C022D741996DB6D32411BFEF4EADB41
SHA1:	4BA93D77927EB8CFDCFE07F56D6EDADE180AF1DD
SHA-256:	3AB7EDEC5E55840C35BE252BAD52236955C3B4F9143810CDB1F09C34510EB8C4
SHA-512:	E448608BFECB770A087CB19934A1B45A5C564EA10BDF5A40BBB250F472830ECEE4990C669E90E495ECB5D4E48C3871CC2A33CE84F2D38524449FC9F5FD501DA0
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef __ASSERT_H_.#define __ASSERT_H_..#include <_mingw.h>.#ifdef __cplusplus.#include <stdlib.h>.#endif..#ifdef NDEBUG.#ifndef assert.#define assert(_Expression) ((void)0).#endif.#else..#ifndef _CRT_TERMINATE_DEFINED.#define _CRT_TERMINATE_DEFINED. void __cdecl __MINGW_NOTHROW exit(int _Code) __MINGW_ATTRIB_NORETURN;. _CRTIMP void __cdecl __MINGW_NOTHROW _exit(int _Code) __MINGW_ATTRIB_NORETURN;.#if !defined __NO_ISOCEXT / extern stub in static libmingwex.a /./ C99 function name */.void __cdecl _Exit(int) __MINGW_ATTRIB_NORETURN;.__CRT_INLINE __MINGW_ATTRIB_NORETURN void __cdecl _Exit(int status).{ _exit(status); }.#endif..#pragma push_macro("abort").#undef abort. void __cdecl __declspec(noreturn) abort(void);.#pragma pop_macro("abort")..#endif..#ifdef __cplusplus.ext

C:\Program Files\Cheat Engine 7.5\include\celib.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.396200340591225
Encrypted:	false
SSDEEP:	3:YRTvF08wB32DsxQGG+TSERKR9BeCTSERKRIHTSERKR7LsyodP1XGZovVOMD:oF08iGDsx9TSEIToCTSEIcTSEIVun4yJ
MD5:	623F15DB2D9075E9DE1E1E5217854933
SHA1:	247EBCAA4F74507EDC5E06E2382378561E67027E
SHA-256:	2C63CD52CD589A204C8E5F75B9179FD520BE1A0770A698303526BE4069613E3B
SHA-512:	34555DF799E9F54EFDFF3BE4498CF20565935A0D5A116D030475042E3BD1CEA9F949A8CC4D9DD5C320FD528879B6221CA70CA0B9068C1AC6381B55C4756D92C4
Malicious:	false
Preview:	#ifndef celib_h..#define celib_h....typedef struct _cecs..{.. volatile int locked;.. volatile int threadif;.. volatile int lockcount; ..} cecs, *Pcecs;....#endif

C:\Program Files\Cheat Engine 7.5\include\conio.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	11130
Entropy (8bit):	4.886603456377803
Encrypted:	false
SSDEEP:	192:R9IFnJJzpoJItwJ+Y31t1d1uF8sFX9B17lHLQWq4QcHyQA3sG1:XI4IJ2WzPw
MD5:	6A61E54AD2614BA528414C7B69147CAF
SHA1:	242479133484E15A2AF816D95DDB053835BF4C64
SHA-256:	DE7161F85835D98B38FE6A19EF8973DCAF58EC237B1C91CF05AC535B2FF3845F
SHA-512:	468702A606E20FFA893054F676C56DFE6EB3D28A002BAE143298422AB388A2F2F78E318714F5274BC9EBD243863F5228D5EBEAD5F31D892E96D8742C8E6846A1
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_CONIO.#define _INC_CONIO..#include <_mingw.h>..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP char _cgets(char _Buffer);. _CRTIMP int __cdecl _cprintf(const char _Format,...);. _CRTIMP int __cdecl _cputs(const char _Str);. _CRTIMP int __cdecl _cscanf(const char _Format,...);. _CRTIMP int __cdecl _cscanf_l(const char _Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _getch(void);. _CRTIMP int __cdecl _getche(void);. _CRTIMP int __cdecl _vcprintf(const char _Format,va_list _ArgList);. _CRTIMP int __cdecl _cprintf_p(const char _Format,...);. _CRTIMP int __cdecl _vcprintf_p(const char _Format,va_list _ArgList);. _CRTIMP int __cdecl _cprintf_l(const char _Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _vcprintf_l(const char _Format,_loc

C:\Program Files\Cheat Engine 7.5\include\ctype.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	9755
Entropy (8bit):	5.0535405224800884
Encrypted:	false
SSDEEP:	192:aK0sBzLLoy8q3JHZDrs+UAt0g7WnBeaIlzjD:EALLb8ars+Flzf
MD5:	22E5A00491E32D15B40B196397AD01C1
SHA1:	B0DB6FCBF4ABD2F4FDEA2771399C1E502D9F8106
SHA-256:	4CFAAA43B3F7414984126E8B1CDF65F9DAC0EF68D9A3396BE0B8828376A74A6B
SHA-512:	28839104776441738233334A20DE6CE3ADA51179FB50366C27AB60432949FC78E1CCF735D2E80216F8779D84328634005C322D0010875E8FE0FF33D699ECC114
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_CTYPE.#define _INC_CTYPE..#include <_mingw.h>..#ifdef __cplusplus.extern "C" {.#endif..#ifndef WEOF.#define WEOF (wint_t)(0xFFFF).#endif..#ifndef _CRT_CTYPEDATA_DEFINED.#define _CRT_CTYPEDATA_DEFINED.#ifndef _CTYPE_DISABLE_MACROS..#ifndef __PCTYPE_FUNC.#define __PCTYPE_FUNC __pctype_func().#ifdef _MSVCRT_.#define __pctype_func().(_pctype).#else.#define __pctype_func().(_imp___pctype).#endif.#endif..#ifndef _pctype.#ifdef _MSVCRT_. extern unsigned short _pctype;.#else. extern unsigned short _imp___pctype;.#define _pctype (_imp___pctype).#endif.#endif..#endif.#endif..#ifndef _CRT_WCTYPEDATA_DEFINED.#define _CRT_WCTYPEDATA_DEFINED.#ifndef _CTYPE_DISABLE_MACROS.#ifndef _wctype.#ifdef _MSVCRT_. extern unsigned short _wctype;.#else. extern unsigned short *_im

C:\Program Files\Cheat Engine 7.5\include\dir.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	952
Entropy (8bit):	4.981227039868006
Encrypted:	false
SSDEEP:	24:i2PSh0PDadJeDoxsClLEdPQq15Fo30wLwNOk60:GYo6XDQsLp
MD5:	EF5C7267DF270272BFA8F8EBD1B516F2
SHA1:	1E3F8A9AFD814EFA8CF7C88DC480E9914A5BC570
SHA-256:	84064B17E501D691C43D47E45B112C2884DB467417910B5FA1482B72342BADFB
SHA-512:	8CA2B0E08B66EAA843FC7AD0F8F4063450A469914819A637AA3F8CAC39DD38E32CC0403F2B04F767AE486934026585B56F93544C8A1F5D92CCE32CE84A4506F4
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /./ . * dir.h. . This file OBSOLESCENT and only provided for backward compatibility.. * Please use io.h instead.. . This file is part of the Mingw32 package.. . Contributors:. * Created by Colin Peters <colin@bird.fu.is.saga-u.ac.jp>. * Mumit Khan <khan@xraylith.wisc.edu>. . THIS SOFTWARE IS NOT COPYRIGHTED. . This source code is offered for use in the public domain. You may. * use, modify or distribute it freely.. . This code is distributed in the hope that it will be useful but. * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY. * DISCLAIMED. This includes but is not limited to warranties of. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.. . /..#include <io.h>..

C:\Program Files\Cheat Engine 7.5\include\direct.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	1979
Entropy (8bit):	5.047752773488744
Encrypted:	false
SSDEEP:	24:i2PSh0PDnZTwNe2FhqA7DiyX40E090m0c0/0vF7Gl0lF+yivXw0vZ0CZ0F2xFeHv:Gs6Z7aNA7bmwGOK0gZBZCQs
MD5:	83679DA78AAF8F8352ACB1883B9EF868
SHA1:	FD89079636571A93755120120AB4F03B91076478
SHA-256:	179C3204312D7CF8032102773629BCB3E5FFF792D1D808931CB6619A431D2435
SHA-512:	13AF1F2C118E898E6055CA61286C9766DF75366FF4F30708F613193CD8F89AFC4A4CC2FD31FC3AC6DCE5D577EE83E203F79ACA3B739D9D9E9E60B42CD9C7036E
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_DIRECT.#define _INC_DIRECT..#include <_mingw.h>.#include <io.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _DISKFREE_T_DEFINED.#define _DISKFREE_T_DEFINED. struct _diskfree_t {. unsigned total_clusters;. unsigned avail_clusters;. unsigned sectors_per_cluster;. unsigned bytes_per_sector;. };.#endif.. _CRTIMP char __cdecl _getcwd(char _DstBuf,int _SizeInBytes);. _CRTIMP char __cdecl _getdcwd(int _Drive,char _DstBuf,int _SizeInBytes);. char __cdecl _getdcwd_nolock(int _Drive,char _DstBuf,int _SizeInBytes);. _CRTIMP int __cdecl _chdir(const char _Path);. _CRTIMP int __cdecl _mkdir(const char _Path);. _CRTIMP int __cdecl _rmdir(const char _Path);. _CRTIMP int __cdecl _chdrive(int _Drive);. _CRTIMP in

C:\Program Files\Cheat Engine 7.5\include\dirent.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	3339
Entropy (8bit):	4.737300914010111
Encrypted:	false
SSDEEP:	48:GzyKQvcpqt7K7PnON+J3esAYUJ0q/nfB2Vt7K7qpdSVNsJ35sAYqJ0q/WaLcC:ayfv0ONgcKqvspkVNyh8q+UcC
MD5:	AFBE32EE6DED8CBAD33D6FE3FBBF077D
SHA1:	A7F0D3EDEE5F49E127575EB25E64E2747108E7C3
SHA-256:	88C1F767FDCD6D51B991EE3234792DA48C8576F5F8816F17A42344F9C8BBB1C1
SHA-512:	F655A40F8C87A0CB43A34AE47612D5CEF2CF7814FD2AE9CE1C8566F97F45E91470364BD87E8C12861CCE44FB8CCA54717546BAACC6CCBDACE51D0D15206304DD
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /./ All the headers include this file. /.#include <_mingw.h>..#ifndef.__STRICT_ANSI__..#ifndef _DIRENT_H_.#define _DIRENT_H_...#pragma pack(push,_CRT_PACKING)..#include <io.h>..#ifndef RC_INVOKED..#ifdef __cplusplus.extern "C" {.#endif.. struct dirent. {. long..d_ino;../ Always zero. /. unsigned short.d_reclen;./ Always zero. /. unsigned short.d_namlen;./ Length of name in d_name. /. char..d_name;../* File name. /. / NOTE: The name in the dirent structure points to the name in the. * finddata_t structure in the DIR. /. };.. /. * This is an internal data structure. Good programmers will not use it. * except as an argument to one of the functions below.. * dd_stat field is now int (was short in older versions).. */. typedef struct. {.

C:\Program Files\Cheat Engine 7.5\include\dos.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.185707945606799
Encrypted:	false
SSDEEP:	24:i2PSh0PDLDhTwNeehqAaZzTcvYRkvF76bUge/xXmy:GyDCHcOV6bULZv
MD5:	3B6FBC94238DF0FD001B04D55BC899DB
SHA1:	231E18CE6A5488B2353FB9EF052FD6677C2CF555
SHA-256:	3AFEA4AE85C68987FE59F40592AC5EA3EF1049B4FB72612BB185358D628E2DEC
SHA-512:	28BA3ED6CC9511F17798822FA81A2D16DA17CA4AF9DA64F3EDC9170FBB883801BF07390214C54B58A32251E6A1C3BB359CB76E892DDB77FBF8C1BF3985E13E5E
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_DOS.#define _INC_DOS..#include <_mingw.h>.#include <io.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _DISKFREE_T_DEFINED.#define _DISKFREE_T_DEFINED.. struct _diskfree_t {. unsigned total_clusters;. unsigned avail_clusters;. unsigned sectors_per_cluster;. unsigned bytes_per_sector;. };.#endif..#define _A_NORMAL 0x00.#define _A_RDONLY 0x01.#define _A_HIDDEN 0x02.#define _A_SYSTEM 0x04.#define _A_SUBDIR 0x10.#define _A_ARCH 0x20..#ifndef _GETDISKFREE_DEFINED.#define _GETDISKFREE_DEFINED. _CRTIMP unsigned __cdecl _getdiskfree(unsigned _Drive,struct _diskfree_t _DiskFree);.#endif..#if (defined(_X86_) && !defined(__x86_64)). void __cdecl _disable(void);. void __cdecl _enable(void);.#endif..#ifndef.NO_OLDNAMES.#de

C:\Program Files\Cheat Engine 7.5\include\errno.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	5.11838654592129
Encrypted:	false
SSDEEP:	24:i2PSh0PDZ8CF1niJLkkutU0IdH6lO7baol3fRfUJhBJXs:Gi4YeH8915s
MD5:	B81E5A965ABD076FB52DE6DFA22A78C4
SHA1:	DC11ACF6A38871E60D79108DAD6C3156715F05E7
SHA-256:	7C8494FE57D944773861C4C1CC1F2B46B3111144A24BF505B3D47B32F0AC1E8A
SHA-512:	8F3057882753150FEFA734897ECFD8DC4082580E856947910FCD891D744651706338A7DF78C1DCF1C7E54EE79EA2A6E8D2646BE9DAC92EF301D7347801F04273
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_ERRNO.#define _INC_ERRNO..#include <_mingw.h>..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CRT_ERRNO_DEFINED.#define _CRT_ERRNO_DEFINED. _CRTIMP extern int __cdecl _errno(void);.#define errno (_errno()).. errno_t __cdecl _set_errno(int _Value);. errno_t __cdecl _get_errno(int _Value);.#endif..#define EPERM 1.#define ENOENT 2.#define ESRCH 3.#define EINTR 4.#define EIO 5.#define ENXIO 6.#define E2BIG 7.#define ENOEXEC 8.#define EBADF 9.#define ECHILD 10.#define EAGAIN 11.#define ENOMEM 12.#define EACCES 13.#define EFAULT 14.#define EBUSY 16.#define EEXIST 17.#define EXDEV 18.#define ENODEV 19.#define ENOTDIR 20.#define EISDIR 21.#define ENFILE 23.#define EMFILE 24.#define ENOTTY 25.#define EFBIG 27.#define ENOSPC 28.#define ESPIPE 29.#define EROFS 30.#de

C:\Program Files\Cheat Engine 7.5\include\excpt.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	3796
Entropy (8bit):	5.3190944253059405
Encrypted:	false
SSDEEP:	48:GdUcbUGSCnlAxeSeFkvSp2wCoIt6TcUEYEJ+CkbUHfXF0XQtVI:QTIGTWeFk6pw/6TOMvIfFsA+
MD5:	D236372CBA09E14C37B4E48F81BAEF83
SHA1:	11A3BFFAACEDFA1CAA4B4BB836CD95297A4ECC6D
SHA-256:	0098E51602C94F8A9702F4B776D3630F56EEC27ED67B9FC36D9204933B58AC4D
SHA-512:	D7C22525FBB97BF8950DB69645511420F1198ABE33F5D0FE07A5EE8DD6B5CDA07038B6DB71A2995C6F5EC1B85D8B98E4370330193132E95F2A65E3A847F04408
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_EXCPT.#define _INC_EXCPT..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif.. struct _EXCEPTION_POINTERS;..#ifndef EXCEPTION_DISPOSITION.#define EXCEPTION_DISPOSITION int.#endif.#define ExceptionContinueExecution 0.#define ExceptionContinueSearch 1.#define ExceptionNestedException 2.#define ExceptionCollidedUnwind 3..#if (defined(_X86_) && !defined(__x86_64)). struct _EXCEPTION_RECORD;. struct _CONTEXT;.. EXCEPTION_DISPOSITION __cdecl _except_handler(struct _EXCEPTION_RECORD _ExceptionRecord,void _EstablisherFrame,struct _CONTEXT _ContextRecord,void _DispatcherContext);.#elif defined(__ia64__).. typedef struct _EXCEPTION_POINTERS Exception_info_ptr;. struct _EXCEPTION_RECORD;. struct _CONTEXT;. struct _DISP

C:\Program Files\Cheat Engine 7.5\include\fcntl.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	5.067511244355359
Encrypted:	false
SSDEEP:	24:i2PSh0PDeLwFq64bCszOD1zr/Aob1UBFv1tDaMLQHy2RoP/17FN:GOFq6UkybLGMLgyx/17z
MD5:	478ADD63D2C741D03A60A11BDC4FC0D3
SHA1:	E9E0C857D2C409F23C346D81B77C5634F1C395AB
SHA-256:	FBD94F945A57165AC897BDBACD2A861B1351E7850FA76752703C0A622E0646FA
SHA-512:	BCCC563718B1A03E93E5BF8CF0D79BB3128A3FC1FDD6FBC17792CBAF3C5DE70DE06EC2F88D8EED7105FF62056E32E9A79570F5890E75F4443033421D283B2FEC
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#include <_mingw.h>..#include <io.h>..#ifndef _INC_FCNTL.#define _INC_FCNTL..#define _O_RDONLY 0x0000.#define _O_WRONLY 0x0001.#define _O_RDWR 0x0002.#define _O_APPEND 0x0008.#define _O_CREAT 0x0100.#define _O_TRUNC 0x0200.#define _O_EXCL 0x0400.#define _O_TEXT 0x4000.#define _O_BINARY 0x8000.#define _O_WTEXT 0x10000.#define _O_U16TEXT 0x20000.#define _O_U8TEXT 0x40000.#define _O_ACCMODE (_O_RDONLY\|_O_WRONLY\|_O_RDWR)..#define _O_RAW _O_BINARY.#define _O_NOINHERIT 0x0080.#define _O_TEMPORARY 0x0040.#define _O_SHORT_LIVED 0x1000..#define _O_SEQUENTIAL 0x0020.#define _O_RANDOM 0x0010..#if !defined(NO_OLDNAMES) \|\| defined(_POSIX).#define O_RDONLY _O_RDONLY.#define O_WRONLY _O_WRONLY.#define O_RDWR _O_RDWR.#define O_APPEND _O_APPEND.#define O_CREAT _O_CREAT.#define O_TRUNC _O_TRUNC

C:\Program Files\Cheat Engine 7.5\include\fenv.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	3146
Entropy (8bit):	5.109358717547865
Encrypted:	false
SSDEEP:	48:GjF4XfZlIPU0rBLeGwDO0QZFxI2bMCaZSpEhW8bxv:CivoPU0rBLeRDO0QfxI2YCaZZhNl
MD5:	DEEC7C35F77EC8E22074667641CA8851
SHA1:	8CCE6B663A9A04B3C13AA6621B0798E487A8A88E
SHA-256:	67A827ACF4E09653AFB5D18F2ECAA5FCDFB7471D8A5B8197C2F33D06E8462F84
SHA-512:	8DE2B82B0579E6C37546A26BC1AB5D7603090E815D8CE728474B1405339AB4EF4F0794DF19FF4CC3780AA7259288D4D93FD50B0E9C63D413FF22AD5E72BFCBE5
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _FENV_H_.#define _FENV_H_..#include <_mingw.h>../ FPU status word exception flags /.#define FE_INVALID.0x01.#define FE_DENORMAL.0x02.#define FE_DIVBYZERO.0x04.#define FE_OVERFLOW.0x08.#define FE_UNDERFLOW.0x10.#define FE_INEXACT.0x20.#define FE_ALL_EXCEPT (FE_INVALID \| FE_DENORMAL \| FE_DIVBYZERO \... \| FE_OVERFLOW \| FE_UNDERFLOW \| FE_INEXACT)../ FPU control word rounding flags /.#define FE_TONEAREST.0x0000.#define FE_DOWNWARD.0x0400.#define FE_UPWARD.0x0800.#define FE_TOWARDZERO.0x0c00../ The MXCSR exception flags are the same as the. FE flags. /.#define __MXCSR_EXCEPT_FLAG_SHIFT 0../ How much to shift FE status word exception flags. to get MXCSR rounding flags, /.#define __MXCSR_ROUND_FLAG_SHIFT 3..#ifndef RC_INVOKED./. For now, support only for t

C:\Program Files\Cheat Engine 7.5\include\float.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	1374
Entropy (8bit):	5.161015521868813
Encrypted:	false
SSDEEP:	24:9Mz83vjoKY2mg/oCrPy+lUmCSh/PTtcmBSED9smlS1:9MEj+bkoCrqahXBPSEDWJ
MD5:	3B2E4B0C01E5B0B790F4F6751E977CC9
SHA1:	06DB05E1C73809CD442EF58F775A8E87D708421D
SHA-256:	C9BAAA478E3BA85897B781F7065B9E144FAACC8E81CAFA5A642B5D49C78434EB
SHA-512:	28DD57DC4360292B987D38A408771B5E1D5B423BFD9656BEE9DFA2F9BC19696AF63A7F90CD350C8445BB27C5049987D97D9530AB15F3697D37652A91AAA7F892
Malicious:	false
Preview:	#ifndef _FLOAT_H_.#define _FLOAT_H_..#define FLT_RADIX 2../* IEEE float /.#define FLT_MANT_DIG 24.#define FLT_DIG 6.#define FLT_ROUNDS 1.#define FLT_EPSILON 1.19209290e-07F.#define FLT_MIN_EXP (-125).#define FLT_MIN 1.17549435e-38F.#define FLT_MIN_10_EXP (-37).#define FLT_MAX_EXP 128.#define FLT_MAX 3.40282347e+38F.#define FLT_MAX_10_EXP 38../ IEEE double /.#define DBL_MANT_DIG 53.#define DBL_DIG 15.#define DBL_EPSILON 2.2204460492503131e-16.#define DBL_MIN_EXP (-1021).#define DBL_MIN 2.2250738585072014e-308.#define DBL_MIN_10_EXP (-307).#define DBL_MAX_EXP 1024.#define DBL_MAX 1.7976931348623157e+308.#define DBL_MAX_10_EXP 308../ horrible intel long double */.#if defined __i386__ \|\| defined __x86_64__..#define LDBL_MANT_DIG 64.#define LDBL_DIG 18.#define LDBL_EPSILON 1.08420217248550443401e-19L.#define LDBL_MIN_EXP (-16381).#define LDBL_MIN 3.36210314311209350626e-4932L.#define LDBL_MIN_10_EXP (-4931).#define LDBL_MAX_EXP 16384.#define LDBL_MAX 1.18973149535723176502e+4932L.#defin

C:\Program Files\Cheat Engine 7.5\include\inttypes.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	6072
Entropy (8bit):	5.148919168403688
Encrypted:	false
SSDEEP:	96:a0GgtlRUn9ZpD5AgcpqdvDp/pwZzSAGkKTskBkbBpbwlHrhchgM2bRBhuYBbV3VU:a0GgJUn9ZpD+gcpqdvDp/pwZzP1iskSX
MD5:	6BB72461C8C72CC3B96F78C73FA803BA
SHA1:	4506FB8BFA1622D4533DB176B3DCFAB0AE021672
SHA-256:	4194C0408CDBA330B7CFA1D2091D72A0CFBF2077FF1FEB19F436F3F3AA2ADF18
SHA-512:	5F6D95651183FBCE7490A619D37672F2D3BAC516319D0EDCD4E782A77632B457632EB83AB54B67132752649FBBFBD1D4EB2B4ABA2622BDF729F0C4BD7509DB2B
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /./ 7.8 Format conversion of integer types <inttypes.h> /..#ifndef _INTTYPES_H_.#define _INTTYPES_H_..#include <_mingw.h>.#include <stdint.h>.#define __need_wchar_t.#include <stddef.h>..#ifdef.__cplusplus.extern."C".{.#endif..typedef struct {..intmax_t quot;..intmax_t rem;..} imaxdiv_t;..#if !defined(__cplusplus) \|\| defined(__STDC_FORMAT_MACROS)../ 7.8.1 Macros for format specifiers. * . * MS runtime does not yet understand C9x standard "ll". * length specifier. It appears to treat "ll" as "l".. * The non-standard I64 length specifier causes warning in GCC,. * but understood by MS runtime functions.. /../ fprintf macros for signed types */.#define PRId8 "d".#define PRId16 "d".#define PRId32 "d".#define PRId64 "I64d"..#define PRIdLEAST8 "d".#define PRIdLEAST16 "d".#define PR

C:\Program Files\Cheat Engine 7.5\include\io.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	13067
Entropy (8bit):	5.032337228232408
Encrypted:	false
SSDEEP:	384:Y8Bx8BjP8BJPKf37Rw8z/hI9B3mpv6O3O8iONUO5OG0xLIJ8SNgVSAMczPO8cONU:r02oxz7vX+8fNxIG0S8SNgVxz28ZNU
MD5:	4AC0744EF16453FEBED8DE4242997946
SHA1:	B092C9006DE0A8DBE7F0FF568B6CAAFB00B4C90A
SHA-256:	5DA97C850E8E2AB608C42947A33411F556F6D75B8264E1E5CF29CA7BA7B96256
SHA-512:	1EC9947C6FE0160954F3922D6990863865D274874C31355F0838CCBB1BBF6650A9A3F0D3590537A189AFBF80E33CDE5393260FDD5F3EA5A736A066CDCC5FF815
Malicious:	false
Preview:	./*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _IO_H_.#define _IO_H_..#include <_mingw.h>.#include <string.h>..#pragma pack(push,_CRT_PACKING)..#ifndef _POSIX_..#ifdef __cplusplus.extern "C" {.#endif.._CRTIMP char __cdecl _getcwd (char, int);.#ifndef _FSIZE_T_DEFINED. typedef unsigned long _fsize_t;.#define _FSIZE_T_DEFINED.#endif..#ifndef _FINDDATA_T_DEFINED.. struct _finddata32_t {. unsigned attrib;. __time32_t time_create;. __time32_t time_access;. __time32_t time_write;. _fsize_t size;. char name[260];. };../#if _INTEGRAL_MAX_BITS >= 64*/.. struct _finddata32i64_t {. unsigned attrib;. __time32_t time_create;. __time32_t time_access;. __time32_t time_write;. __int64 size;. char name[260];. };.. struct _finddata64i32_t {. unsigned attrib;. __time64_t time_create

C:\Program Files\Cheat Engine 7.5\include\is-0K952.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	3796
Entropy (8bit):	5.3190944253059405
Encrypted:	false
SSDEEP:	48:GdUcbUGSCnlAxeSeFkvSp2wCoIt6TcUEYEJ+CkbUHfXF0XQtVI:QTIGTWeFk6pw/6TOMvIfFsA+
MD5:	D236372CBA09E14C37B4E48F81BAEF83
SHA1:	11A3BFFAACEDFA1CAA4B4BB836CD95297A4ECC6D
SHA-256:	0098E51602C94F8A9702F4B776D3630F56EEC27ED67B9FC36D9204933B58AC4D
SHA-512:	D7C22525FBB97BF8950DB69645511420F1198ABE33F5D0FE07A5EE8DD6B5CDA07038B6DB71A2995C6F5EC1B85D8B98E4370330193132E95F2A65E3A847F04408
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_EXCPT.#define _INC_EXCPT..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif.. struct _EXCEPTION_POINTERS;..#ifndef EXCEPTION_DISPOSITION.#define EXCEPTION_DISPOSITION int.#endif.#define ExceptionContinueExecution 0.#define ExceptionContinueSearch 1.#define ExceptionNestedException 2.#define ExceptionCollidedUnwind 3..#if (defined(_X86_) && !defined(__x86_64)). struct _EXCEPTION_RECORD;. struct _CONTEXT;.. EXCEPTION_DISPOSITION __cdecl _except_handler(struct _EXCEPTION_RECORD _ExceptionRecord,void _EstablisherFrame,struct _CONTEXT _ContextRecord,void _DispatcherContext);.#elif defined(__ia64__).. typedef struct _EXCEPTION_POINTERS Exception_info_ptr;. struct _EXCEPTION_RECORD;. struct _CONTEXT;. struct _DISP

C:\Program Files\Cheat Engine 7.5\include\is-0PACH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	164
Entropy (8bit):	4.396200340591225
Encrypted:	false
SSDEEP:	3:YRTvF08wB32DsxQGG+TSERKR9BeCTSERKRIHTSERKR7LsyodP1XGZovVOMD:oF08iGDsx9TSEIToCTSEIcTSEIVun4yJ
MD5:	623F15DB2D9075E9DE1E1E5217854933
SHA1:	247EBCAA4F74507EDC5E06E2382378561E67027E
SHA-256:	2C63CD52CD589A204C8E5F75B9179FD520BE1A0770A698303526BE4069613E3B
SHA-512:	34555DF799E9F54EFDFF3BE4498CF20565935A0D5A116D030475042E3BD1CEA9F949A8CC4D9DD5C320FD528879B6221CA70CA0B9068C1AC6381B55C4756D92C4
Malicious:	false
Preview:	#ifndef celib_h..#define celib_h....typedef struct _cecs..{.. volatile int locked;.. volatile int threadif;.. volatile int lockcount; ..} cecs, *Pcecs;....#endif

C:\Program Files\Cheat Engine 7.5\include\is-0PE6T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10222
Entropy (8bit):	5.118611530215232
Encrypted:	false
SSDEEP:	96:cwxjJoLCBGnjq/Kn4aq3qvsbLJKr7nnJik1gngZxl9e7PpTGO+HT7R8AitqazIh5:cwzbLJyLnJ6O8PpTGOEiNzIhIbIXP3JF
MD5:	ACE688BCE0201B3B8BC3B7AF3CEC1BA7
SHA1:	7B967DE03772076207537292C4163994D4EAD095
SHA-256:	FACA8509C87FAE987A5E98CDC95171E036895037427D12930E2A83092D23FBB5
SHA-512:	A83753F6A1B82BCDFCF0B948C93F2E09A0A13105A112C161ABAD6DE84162DA67600CF5458FF51264DDC462077033DE3C8496E7B2251831871005D747AE58A24A
Malicious:	false
Preview:	/* tccdefs.h.... Nothing is defined before this file except target machine, target os.. and the few things related to option settings in tccpp.c:tcc_predefs()..... This file is either included at runtime as is, or converted and.. included as C-strings at compile-time (depending on CONFIG_TCC_PREDEFS)..... Note that line indent matters:.... - in lines starting at column 1, platform macros are replaced by.. corresponding TCC target compile-time macros. See conftest.c for.. the list of platform macros supported in lines starting at column 1..... - only lines indented >= 4 are actually included into the executable,.. check tccdefs_.h.../....#if __SIZEOF_POINTER__ == 4.. / 32bit systems. */..#if defined TARGETOS_OpenBSD.. #define __SIZE_TYPE__ unsigned long.. #define __PTRDIFF_TYPE__ long..#else.. #define __SIZE_TYPE__ unsigned int.. #define __PTRDIFF_TYPE__ int..#endif.. #define __ILP32__ 1.. #define __INT64_TYPE__ long long..#el

C:\Program Files\Cheat Engine 7.5\include\is-1C906.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	3867
Entropy (8bit):	5.235190435579294
Encrypted:	false
SSDEEP:	96:hINzkdpqiPK62I7m503BDSX92h1Mjw9dQZOpxrW7qcvshO+RgA2CRu/PXOE:hINzkdpqiPKdI7m503FSXUhOjw9Fpxrs
MD5:	8BF97DC43B347CBCF622768EF43090EF
SHA1:	E6BE2C1B1FE50C19BCD2814E3827C7D94680E51B
SHA-256:	B6164EB7FAE4A12163251492F7F4E56CC50D146EC7A2F5640D86ECA4D095046F
SHA-512:	F2F1A16A1D719B10A20B8BE8B5046E151C50792D8D07A2E7F6BC8EB0D53FFCE7E66E53934E688FD1C3FDFE00545BF203267FB59CBD289AD92F3786E473F8198F
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_SETJMP.#define _INC_SETJMP..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#if (defined(_X86_) && !defined(__x86_64))..#define _JBLEN 16.#define _JBTYPE int.. typedef struct __JUMP_BUFFER {. unsigned long Ebp;. unsigned long Ebx;. unsigned long Edi;. unsigned long Esi;. unsigned long Esp;. unsigned long Eip;. unsigned long Registration;. unsigned long TryLevel;. unsigned long Cookie;. unsigned long UnwindFunc;. unsigned long UnwindData[6];. } _JUMP_BUFFER;.#elif defined(__ia64__). typedef _CRT_ALIGN(16) struct _SETJMP_FLOAT128 {. __int64 LowPart;. __int64 HighPart;. } SETJMP_FLOAT128;..#define _JBLEN 33. typedef SETJMP_FLOAT128 _JBTYPE;.. typedef struct __JUMP_BUFFER {..

C:\Program Files\Cheat Engine 7.5\include\is-2OU3Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	9091
Entropy (8bit):	5.046593382105061
Encrypted:	false
SSDEEP:	192:kVIYQ03tIPjxoNimr4mJ6hIO0XtcsQQ05vQTcsBOdFS3b6dyntql+:kVIYQ03tIPjxoNimr4mJ6hIOmcsQQ05E
MD5:	F06EDAF6AB750607C33C37BFE50B2EB2
SHA1:	CA3AFC7781760D84432B06567AFBDA24587757DD
SHA-256:	6947C954F2AF676E66CC38D64B1A165428734000E2E272F883C2D74A85B82020
SHA-512:	9926B19FBD4B30ECF6682AE5945401E4387D2B5CE02D7643B51C660462B761B08F52A99F2B7DA73B574C7BC6388CD23CA3ED8451A3CF2B3501AD217925A503EB
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_PROCESS.#define _INC_PROCESS..#include <_mingw.h>../ Includes a definition of _pid_t and pid_t /.#include <sys/types.h>..#ifndef _POSIX_.#ifdef __cplusplus.extern "C" {.#endif..#define _P_WAIT 0.#define _P_NOWAIT 1.#define _OLD_P_OVERLAY 2.#define _P_NOWAITO 3.#define _P_DETACH 4.#define _P_OVERLAY 2..#define _WAIT_CHILD 0.#define _WAIT_GRANDCHILD 1.. _CRTIMP uintptr_t __cdecl _beginthread(void (__cdecl _StartAddress) (void ),unsigned _StackSize,void _ArgList);. _CRTIMP void __cdecl _endthread(void);. _CRTIMP uintptr_t __cdecl _beginthreadex(void _Security,unsigned _StackSize,unsigned (__stdcall _StartAddress) (void ),void _ArgList,unsigned _InitFlag,unsigned *_ThrdAddr);. _CRTIMP void __cdecl _endthreadex(unsigned _Retval);..#ifndef _CRT_TERMINATE_DE

C:\Program Files\Cheat Engine 7.5\include\is-4232T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	1439
Entropy (8bit):	5.2295620824781714
Encrypted:	false
SSDEEP:	24:i2PSh0PDaGduHH7PPW3ep0m3Vp0GrHt+5p0CKpmucLNw/HHsuHfgpbrRD:GRdm3emm3Vm+HOmCKmC1fgdp
MD5:	9C022D741996DB6D32411BFEF4EADB41
SHA1:	4BA93D77927EB8CFDCFE07F56D6EDADE180AF1DD
SHA-256:	3AB7EDEC5E55840C35BE252BAD52236955C3B4F9143810CDB1F09C34510EB8C4
SHA-512:	E448608BFECB770A087CB19934A1B45A5C564EA10BDF5A40BBB250F472830ECEE4990C669E90E495ECB5D4E48C3871CC2A33CE84F2D38524449FC9F5FD501DA0
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef __ASSERT_H_.#define __ASSERT_H_..#include <_mingw.h>.#ifdef __cplusplus.#include <stdlib.h>.#endif..#ifdef NDEBUG.#ifndef assert.#define assert(_Expression) ((void)0).#endif.#else..#ifndef _CRT_TERMINATE_DEFINED.#define _CRT_TERMINATE_DEFINED. void __cdecl __MINGW_NOTHROW exit(int _Code) __MINGW_ATTRIB_NORETURN;. _CRTIMP void __cdecl __MINGW_NOTHROW _exit(int _Code) __MINGW_ATTRIB_NORETURN;.#if !defined __NO_ISOCEXT / extern stub in static libmingwex.a /./ C99 function name */.void __cdecl _Exit(int) __MINGW_ATTRIB_NORETURN;.__CRT_INLINE __MINGW_ATTRIB_NORETURN void __cdecl _Exit(int status).{ _exit(status); }.#endif..#pragma push_macro("abort").#undef abort. void __cdecl __declspec(noreturn) abort(void);.#pragma pop_macro("abort")..#endif..#ifdef __cplusplus.ext

C:\Program Files\Cheat Engine 7.5\include\is-48C7L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	23077
Entropy (8bit):	5.0910424086795425
Encrypted:	false
SSDEEP:	384:lpwI012C9/SKSP4qROW8JuWucZBFRzWhHONMLPik9OeY:lpq2C9/FA4OOJr
MD5:	631F16C4A65CF2F47FA49C9220D9C500
SHA1:	330EADF08FDCB31747BF7C84182F2A5EECFA3FAB
SHA-256:	0BC33882BD2AF1E7D33C38C0160E2A0AE737836815360765750CDC7E98E5DFC5
SHA-512:	92EB690CA7D563269CEAEFFAC1F0FFBA6D010568431843F2DD82DCA7A1ACA0E6634C3335202ED5559FE631B0ED7C585DC1C3F5BB248FE3D571BA754B22B6AD5A
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _MATH_H_.#define _MATH_H_..#if __GNUC__ >= 3.#pragma GCC system_header.#endif..#include <_mingw.h>..struct exception;..#pragma pack(push,_CRT_PACKING)..#define _DOMAIN 1.#define _SING 2.#define _OVERFLOW 3.#define _UNDERFLOW 4.#define _TLOSS 5.#define _PLOSS 6..#ifndef __STRICT_ANSI__.#ifndef.NO_OLDNAMES.#define DOMAIN _DOMAIN.#define SING _SING.#define OVERFLOW _OVERFLOW.#define UNDERFLOW _UNDERFLOW.#define TLOSS _TLOSS.#define PLOSS _PLOSS.#endif.#endif..#ifndef __STRICT_ANSI__.#define M_E 2.71828182845904523536.#define M_LOG2E 1.44269504088896340736.#define M_LOG10E 0.434294481903251827651.#define M_LN2 0.693147180559945309417.#define M_LN10 2.30258509299404568402.#define M_PI 3.14159265358979323846.#define M_PI_2 1.57079632679489661923.#define M_PI_4 0.785398163397

C:\Program Files\Cheat Engine 7.5\include\is-4IT51.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	2494
Entropy (8bit):	4.862990168468474
Encrypted:	false
SSDEEP:	48:QAs3d3qmP8lV0TTPWuj/ATVhpIOFf6yrsEgTvVOFobil:QAGdafP0P/IiA
MD5:	4FE6BA37DEC896AB822646118B5343CE
SHA1:	EA68660748139159643AB495AA1EC9287A5E20FF
SHA-256:	116504A7C3FEABBC4551E9DB0BEC957170647EF2067EB46A4304BCBFDDCE5A30
SHA-512:	6B3304630293A2A5C1D4870B088A7FA2681354A4D28D6DFD97CDA16E102D6E97A19CB5C9A840C8587479E4A559AB3EE781F1E9001F1336C9318988B1F2F22CC7
Malicious:	false
Preview:	#ifndef _STDARG_H.#define _STDARG_H..#ifdef __x86_64__.#ifndef _WIN64..//This should be in sync with the declaration on our lib/libtcc1.c./* GCC compatible definition of va_list. /.typedef struct {. unsigned int gp_offset;. unsigned int fp_offset;. union {. unsigned int overflow_offset;. char overflow_arg_area;. };. char reg_save_area;.} __va_list_struct;..typedef __va_list_struct va_list[1];..void __va_start(__va_list_struct ap, void fp);.void __va_arg(__va_list_struct ap, int arg_type, int size, int align);..#define va_start(ap, last) __va_start(ap, __builtin_frame_address(0)).#define va_arg(ap, type) \. ((type )(__va_arg(ap, __builtin_va_arg_types(type), sizeof(type), __alignof__(type)))).#define va_copy(dest, src) ((dest) = (src)).#define va_end(ap)../ avoid conflicting definition for va_list on Macs. /.#define _VA_LIST_T..#else / _WIN64 /.typedef char va_list;.#define va_start(ap,last) _

C:\Program Files\Cheat Engine 7.5\include\is-51LG7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.185707945606799
Encrypted:	false
SSDEEP:	24:i2PSh0PDLDhTwNeehqAaZzTcvYRkvF76bUge/xXmy:GyDCHcOV6bULZv
MD5:	3B6FBC94238DF0FD001B04D55BC899DB
SHA1:	231E18CE6A5488B2353FB9EF052FD6677C2CF555
SHA-256:	3AFEA4AE85C68987FE59F40592AC5EA3EF1049B4FB72612BB185358D628E2DEC
SHA-512:	28BA3ED6CC9511F17798822FA81A2D16DA17CA4AF9DA64F3EDC9170FBB883801BF07390214C54B58A32251E6A1C3BB359CB76E892DDB77FBF8C1BF3985E13E5E
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_DOS.#define _INC_DOS..#include <_mingw.h>.#include <io.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _DISKFREE_T_DEFINED.#define _DISKFREE_T_DEFINED.. struct _diskfree_t {. unsigned total_clusters;. unsigned avail_clusters;. unsigned sectors_per_cluster;. unsigned bytes_per_sector;. };.#endif..#define _A_NORMAL 0x00.#define _A_RDONLY 0x01.#define _A_HIDDEN 0x02.#define _A_SYSTEM 0x04.#define _A_SUBDIR 0x10.#define _A_ARCH 0x20..#ifndef _GETDISKFREE_DEFINED.#define _GETDISKFREE_DEFINED. _CRTIMP unsigned __cdecl _getdiskfree(unsigned _Drive,struct _diskfree_t _DiskFree);.#endif..#if (defined(_X86_) && !defined(__x86_64)). void __cdecl _disable(void);. void __cdecl _enable(void);.#endif..#ifndef.NO_OLDNAMES.#de

C:\Program Files\Cheat Engine 7.5\include\is-5BN1Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	5.11838654592129
Encrypted:	false
SSDEEP:	24:i2PSh0PDZ8CF1niJLkkutU0IdH6lO7baol3fRfUJhBJXs:Gi4YeH8915s
MD5:	B81E5A965ABD076FB52DE6DFA22A78C4
SHA1:	DC11ACF6A38871E60D79108DAD6C3156715F05E7
SHA-256:	7C8494FE57D944773861C4C1CC1F2B46B3111144A24BF505B3D47B32F0AC1E8A
SHA-512:	8F3057882753150FEFA734897ECFD8DC4082580E856947910FCD891D744651706338A7DF78C1DCF1C7E54EE79EA2A6E8D2646BE9DAC92EF301D7347801F04273
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_ERRNO.#define _INC_ERRNO..#include <_mingw.h>..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CRT_ERRNO_DEFINED.#define _CRT_ERRNO_DEFINED. _CRTIMP extern int __cdecl _errno(void);.#define errno (_errno()).. errno_t __cdecl _set_errno(int _Value);. errno_t __cdecl _get_errno(int _Value);.#endif..#define EPERM 1.#define ENOENT 2.#define ESRCH 3.#define EINTR 4.#define EIO 5.#define ENXIO 6.#define E2BIG 7.#define ENOEXEC 8.#define EBADF 9.#define ECHILD 10.#define EAGAIN 11.#define ENOMEM 12.#define EACCES 13.#define EFAULT 14.#define EBUSY 16.#define EEXIST 17.#define EXDEV 18.#define ENODEV 19.#define ENOTDIR 20.#define EISDIR 21.#define ENFILE 23.#define EMFILE 24.#define ENOTTY 25.#define EFBIG 27.#define ENOSPC 28.#define ESPIPE 29.#define EROFS 30.#de

C:\Program Files\Cheat Engine 7.5\include\is-6QL5T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	5214
Entropy (8bit):	5.2821319558661655
Encrypted:	false
SSDEEP:	96:y4bSZjA6r8VdQINtNy6XVqB4/mLErYQ015U/dIuvwQRbZBq35jU:9urrSXIzGdIuvwQR9YJo
MD5:	537BC027E86F7252D88B6BF2FE5B2F35
SHA1:	7F3361D220F96AD1B93669254937929F267CC333
SHA-256:	7307FF330B8D7954D548E19E45887ED64DE36DA5BEE1FDA2CC021F0C1C1892BD
SHA-512:	3D7693F46FE1272DECBA8EFB6A01853786419055CF338CC900C9FE3EC1B795BA25E16878A5D53261BF3BC3BAB7525110B6F1844501D5FB6BE45C57B5D277F625
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _MALLOC_H_.#define _MALLOC_H_..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifndef _MM_MALLOC_H_INCLUDED.#define _MM_MALLOC_H_INCLUDED.#endif..#ifdef __cplusplus.extern "C" {.#endif..#ifdef _WIN64.#define _HEAP_MAXREQ 0xFFFFFFFFFFFFFFE0.#else.#define _HEAP_MAXREQ 0xFFFFFFE0.#endif..#ifndef _STATIC_ASSERT.#define _STATIC_ASSERT(expr) extern void __static_assert_t(int [(expr)?1:-1]).#endif../ Return codes for _heapwalk() /.#define _HEAPEMPTY (-1).#define _HEAPOK (-2).#define _HEAPBADBEGIN (-3).#define _HEAPBADNODE (-4).#define _HEAPEND (-5).#define _HEAPBADPTR (-6)../ Values for _heapinfo.useflag /.#define _FREEENTRY 0.#define _USEDENTRY 1..#ifndef _HEAPINFO_DEFINED.#define _HEAPINFO_DEFINED. / The structure used to walk through the heap with _heapwalk.

C:\Program Files\Cheat Engine 7.5\include\is-77A2I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	6072
Entropy (8bit):	5.148919168403688
Encrypted:	false
SSDEEP:	96:a0GgtlRUn9ZpD5AgcpqdvDp/pwZzSAGkKTskBkbBpbwlHrhchgM2bRBhuYBbV3VU:a0GgJUn9ZpD+gcpqdvDp/pwZzP1iskSX
MD5:	6BB72461C8C72CC3B96F78C73FA803BA
SHA1:	4506FB8BFA1622D4533DB176B3DCFAB0AE021672
SHA-256:	4194C0408CDBA330B7CFA1D2091D72A0CFBF2077FF1FEB19F436F3F3AA2ADF18
SHA-512:	5F6D95651183FBCE7490A619D37672F2D3BAC516319D0EDCD4E782A77632B457632EB83AB54B67132752649FBBFBD1D4EB2B4ABA2622BDF729F0C4BD7509DB2B
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /./ 7.8 Format conversion of integer types <inttypes.h> /..#ifndef _INTTYPES_H_.#define _INTTYPES_H_..#include <_mingw.h>.#include <stdint.h>.#define __need_wchar_t.#include <stddef.h>..#ifdef.__cplusplus.extern."C".{.#endif..typedef struct {..intmax_t quot;..intmax_t rem;..} imaxdiv_t;..#if !defined(__cplusplus) \|\| defined(__STDC_FORMAT_MACROS)../ 7.8.1 Macros for format specifiers. * . * MS runtime does not yet understand C9x standard "ll". * length specifier. It appears to treat "ll" as "l".. * The non-standard I64 length specifier causes warning in GCC,. * but understood by MS runtime functions.. /../ fprintf macros for signed types */.#define PRId8 "d".#define PRId16 "d".#define PRId32 "d".#define PRId64 "I64d"..#define PRIdLEAST8 "d".#define PRIdLEAST16 "d".#define PR

C:\Program Files\Cheat Engine 7.5\include\is-7UMKO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	952
Entropy (8bit):	4.981227039868006
Encrypted:	false
SSDEEP:	24:i2PSh0PDadJeDoxsClLEdPQq15Fo30wLwNOk60:GYo6XDQsLp
MD5:	EF5C7267DF270272BFA8F8EBD1B516F2
SHA1:	1E3F8A9AFD814EFA8CF7C88DC480E9914A5BC570
SHA-256:	84064B17E501D691C43D47E45B112C2884DB467417910B5FA1482B72342BADFB
SHA-512:	8CA2B0E08B66EAA843FC7AD0F8F4063450A469914819A637AA3F8CAC39DD38E32CC0403F2B04F767AE486934026585B56F93544C8A1F5D92CCE32CE84A4506F4
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /./ . * dir.h. . This file OBSOLESCENT and only provided for backward compatibility.. * Please use io.h instead.. . This file is part of the Mingw32 package.. . Contributors:. * Created by Colin Peters <colin@bird.fu.is.saga-u.ac.jp>. * Mumit Khan <khan@xraylith.wisc.edu>. . THIS SOFTWARE IS NOT COPYRIGHTED. . This source code is offered for use in the public domain. You may. * use, modify or distribute it freely.. . This code is distributed in the hope that it will be useful but. * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY. * DISCLAIMED. This includes but is not limited to warranties of. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.. . /..#include <io.h>..

C:\Program Files\Cheat Engine 7.5\include\is-AGEPC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.607652660491414
Encrypted:	false
SSDEEP:	3:YDC60AhCWNRSh4Hf9OKhW70rAcM05eB70AUrEtvQ7DM0zU2kx4Cv:mp0AnRoCkKu0McM0sF0AUn7f4Tv
MD5:	7D294F4EC2C9640974803A61153EF3DD
SHA1:	3BC244518F863B754A97CA1B756580974C0D4356
SHA-256:	5252824225DDC486B0460677F765E4157AF5D3ED7ACD65B310A4045EAFB56AF7
SHA-512:	FF09177DCD695A185D66AFA8405EB7BF0883D4C1E6507F00A12CD958562E2F0444867F6DABDEE6E50CD5977897E4D878F31CB51888BA6878829C96CBF80FB283
Malicious:	false
Preview:	#ifndef _STDBOOL_H.#define _STDBOOL_H../* ISOC99 boolean /..#define bool._Bool.#define true.1.#define false.0.#define __bool_true_false_are_defined 1..#endif / _STDBOOL_H */.

C:\Program Files\Cheat Engine 7.5\include\is-BF42V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	20426
Entropy (8bit):	5.091356495974476
Encrypted:	false
SSDEEP:	384:X5I7a44IVaadf7trkr6vrRcbCGX8XnaTjWb5:Uvf7trkr6vrRHaTjWb5
MD5:	53D74BF044942015FEC4AFD293D2F9A8
SHA1:	010AB014E3B81B3A7E2D1D87FF0281A8736A4ABC
SHA-256:	5BBA095A2D22A6BC0670F73BFEBBA63CFEC65F8B7C248E84E36B3D7EDE0A4F3C
SHA-512:	64B66F0D610D37E6F55702130FAD39F39D30F44D33221C6A985CD03948968D4C4CAFB7676402A9A4A029C8539EFBFA5801C0D1BCBF667B876F3E7BB08F9BF89F
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_STDLIB.#define _INC_STDLIB..#include <_mingw.h>.#include <limits.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef NULL.#ifdef __cplusplus.#define NULL 0.#else.#define NULL ((void )0).#endif.#endif..#define EXIT_SUCCESS 0.#define EXIT_FAILURE 1..#ifndef _ONEXIT_T_DEFINED.#define _ONEXIT_T_DEFINED.. typedef int (__cdecl *_onexit_t)(void);..#ifndef NO_OLDNAMES.#define onexit_t _onexit_t.#endif.#endif..#ifndef _DIV_T_DEFINED.#define _DIV_T_DEFINED.. typedef struct _div_t {. int quot;. int rem;. } div_t;.. typedef struct _ldiv_t {. long quot;. long rem;. } ldiv_t;.#endif..#ifndef _CRT_DOUBLE_DEC.#define _CRT_DOUBLE_DEC..#pragma pack(4). typedef struct {. unsigned char ld[10];. } _LDOUBLE;.#pragma pack()..#defin

C:\Program Files\Cheat Engine 7.5\include\is-C2D8P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	2135
Entropy (8bit):	5.113182765405398
Encrypted:	false
SSDEEP:	48:GXWM0CJUOsxXX0MLOMMMRgusuLZum+3Pw+8yFGX7Mu1LkuLS91uuHeLWv:35TW/Vf5FS7Mu1IuLium6Wv
MD5:	5F6A3E42F8EB297B888B498D93437C3C
SHA1:	09729D7892A1ED36AFADDEC40674ACEB62B5FA88
SHA-256:	882626FA25DBC1B5903E6FD98CC8516F1E54C4E06945026653F05B38125DFF2C
SHA-512:	587BB7BE57DDA7DB0BF8C454A78DD67D850342D97BC7C99A9804D53FA7929EB42C1194E13456170C0902CA7A15C028A6C635879889F0AF6A9ED833C2E046B9EC
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_LOCALE.#define _INC_LOCALE..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef NULL.#ifdef __cplusplus.#define NULL 0.#else.#define NULL ((void )0).#endif.#endif..#define LC_ALL 0.#define LC_COLLATE 1.#define LC_CTYPE 2.#define LC_MONETARY 3.#define LC_NUMERIC 4.#define LC_TIME 5..#define LC_MIN LC_ALL.#define LC_MAX LC_TIME..#ifndef _LCONV_DEFINED.#define _LCONV_DEFINED. struct lconv {. char decimal_point;. char thousands_sep;. char grouping;. char int_curr_symbol;. char currency_symbol;. char mon_decimal_point;. char mon_thousands_sep;. char mon_grouping;. char positive_sign;. char negative_sign;. char int_frac_digits;. char frac_digits;. char p_cs_precedes;.

C:\Program Files\Cheat Engine 7.5\include\is-C9L6B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	14903
Entropy (8bit):	5.137879509844942
Encrypted:	false
SSDEEP:	192:VgGovkt8YzcfdLDQgPVj85xhpp0DghdWRUeuzIDcDW40aMsGQLZX9QLbiR:KGr8ocfdL0w5shpwf40lsGQ6biR
MD5:	F4948ADEA7D9F60748DE8B427AB85684
SHA1:	101AD5424E182236EB7F537F17CE846C917CED27
SHA-256:	749059834143BCD5BDCEA13FC863C8B6587A89D6DFC84CD5017A98DF190DEFBD
SHA-512:	49847CA1A78BC100739B3AFC8A0D607AC37E340CEBBB0C04B2C067CDBDD6ED33AC5557214282699A89E39F4B8BB3A8B6383FC0A25C19265089E09B08765EA693
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_STDIO.#define _INC_STDIO..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#define BUFSIZ 512.#define _NFILE _NSTREAM_.#define _NSTREAM_ 512.#define _IOB_ENTRIES 20.#define EOF (-1)..#ifndef _FILE_DEFINED. struct _iobuf {. char _ptr;. int _cnt;. char _base;. int _flag;. int _file;. int _charbuf;. int _bufsiz;. char _tmpfname;. };. typedef struct _iobuf FILE;.#define _FILE_DEFINED.#endif..#ifdef _POSIX_.#define _P_tmpdir "/".#define _wP_tmpdir L"/".#else.#define _P_tmpdir "\\".#define _wP_tmpdir L"\\".#endif..#define L_tmpnam (sizeof(_P_tmpdir) + 12)..#ifdef _POSIX_.#define L_ctermid 9.#define L_cuserid 32.#endif..#define SEEK_CUR 1.#define SEEK_END 2.#define SEEK_SET 0..#define STDIN_FILENO

C:\Program Files\Cheat Engine 7.5\include\is-CE1AR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	304
Entropy (8bit):	4.976431807239841
Encrypted:	false
SSDEEP:	6:UJg2JESe3SFB+SqicFPoJZVC1r2n2ADbA96Iy/KTMk:UJJISFcShcFP+4BbHYPSN
MD5:	DDA4463DA15121ED7AD4F091FBF61DFF
SHA1:	84B4C4973306EF725C3F61446AB891CAC6AA66A4
SHA-256:	2E6AB359559319A11A80F8F52AA0472CD0B141137F3A1EAA18C40D8827DC51D4
SHA-512:	D3417CF7702A17F0F327CBAF8D167D7830A2955C19D553893329696CDF2312707595CF0F6DDAA36EA18D0CEA41F24E6FA9C15AC14D5BC567BC25A1CC81B733FE
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_VADEFS.#define _INC_VADEFS..//!__TINYC__: GNUC specific stuff removed..#endif.

C:\Program Files\Cheat Engine 7.5\include\is-DANGD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	2686
Entropy (8bit):	5.279528518541247
Encrypted:	false
SSDEEP:	48:GXFLawQcx1ZvUTc/5p3C8QcvAv1p3R0C8+Rve/KQ1i5/o4XqzOvQQHc8/Y:sn91ZgcrCkvQv0C8ksd4na
MD5:	21CE377183014C3535643C9050306A33
SHA1:	41B25206EDD6309884312FD70026096C35A6DBEB
SHA-256:	39C0761F0E43D7B936B9B81C85673DD82896EBFA66E9F1B9A19B45F34E4CD52A
SHA-512:	3B0FA5D6EBB7AC47694C7D04B4835AF6C089344F7F8337DB74B34E3B46A1792295224DC232FAC1FD0DB482FC32C8A6A4BFCAF4F39C35DCCD98600181C314B43D
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#include <_mingw.h>..#ifndef _INC_LIMITS.#define _INC_LIMITS../.* File system limits.. TODO: NAME_MAX and OPEN_MAX are file system limits or not? Are they the.* same as FILENAME_MAX and FOPEN_MAX from stdio.h?.* NOTE: Apparently the actual size of PATH_MAX is 260, but a space is.* required for the NUL. TODO: Test?.*/.#define PATH_MAX.(259)..#define CHAR_BIT 8.#define SCHAR_MIN (-128).#define SCHAR_MAX 127.#define UCHAR_MAX 0xff..#define CHAR_MIN SCHAR_MIN.#define CHAR_MAX SCHAR_MAX..#define MB_LEN_MAX 5.#define SHRT_MIN (-32768).#define SHRT_MAX 32767.#define USHRT_MAX 0xffff.#define INT_MIN (-2147483647 - 1).#define INT_MAX 2147483647.#define UINT_MAX 0xffffffff.#define LONG_MIN (-2147483647L - 1).#define LONG_MAX 2147483647L.#define ULONG_MAX 0xffffffffUL.#def

C:\Program Files\Cheat Engine 7.5\include\is-E1KQ9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	34132
Entropy (8bit):	5.065285191271868
Encrypted:	false
SSDEEP:	384:2186Orc7LIJ8SNgVx6eG17k8MGOHlE4eGP0+aILsGQ86jWIwF2iiEYbS:2IcE8SNgVx61JC6jry2E
MD5:	D6B25F8E3068967751493431B36C4248
SHA1:	3145ED71F286525D1FF492AE920B30694123259E
SHA-256:	C9BF12E02A2AB0783ED1C66DFE43DE43C402B33906CADA9B1157502A82C7C3E4
SHA-512:	02A480389CECC909978130585609F57D03728726E72E5FEE89874ACCA4122D971D74FC615949F8675513EDCFE3198201AD0118F795B147C6FCA10D28E8856645
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_WCHAR.#define _INC_WCHAR..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef WCHAR_MIN / also at stdint.h /.#define WCHAR_MIN 0.#define WCHAR_MAX ((wchar_t) -1) / UINT16_MAX /.#endif..#ifndef __GNUC_VA_LIST.#define __GNUC_VA_LIST. typedef __builtin_va_list __gnuc_va_list;.#endif..#ifndef _VA_LIST_DEFINED.#define _VA_LIST_DEFINED. typedef __gnuc_va_list va_list;.#endif..#ifndef WEOF.#define WEOF (wint_t)(0xFFFF).#endif..#ifndef _FILE_DEFINED. struct _iobuf {. char _ptr;. int _cnt;. char _base;. int _flag;. int _file;. int _charbuf;. int _bufsiz;. char _tmpfname;. };. typedef struct _iobuf FILE;.#define _FILE_DEFINED.#endif..#ifndef _STDIO_DEFINED.#ifdef _WIN64. _CRTIMP FILE *__

C:\Program Files\Cheat Engine 7.5\include\is-EE2JR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	126
Entropy (8bit):	4.580595223579644
Encrypted:	false
SSDEEP:	3:UwqZKUaAJAtMLnKEwOEtLDLaF9rL4AsNXIC:Uwq1LJvnKEcXaF94FNXIC
MD5:	621045AE9CA57FE30C8A99DD52AC5703
SHA1:	39B1E30A678EAC4DF1B78C0EF9D315A18DF4F156
SHA-256:	FA3758847B33F59ABE99B023BE00D8A027C391ECD0580A1FE755497C11E0C723
SHA-512:	AADE260048487D82F129A9A51FBDEA949793465C33DC147B31943D22523FB1A63C48F80FCA370D5929BCCA76B89CD15D9786C439A65C396BB4A5416D387E3F3A
Malicious:	false
Preview:	/. TODO: Nothing here yet. Should provide UNIX compatibility constants. * comparable to those in limits.h and float.h.. */.

C:\Program Files\Cheat Engine 7.5\include\is-EUHVU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	1374
Entropy (8bit):	5.161015521868813
Encrypted:	false
SSDEEP:	24:9Mz83vjoKY2mg/oCrPy+lUmCSh/PTtcmBSED9smlS1:9MEj+bkoCrqahXBPSEDWJ
MD5:	3B2E4B0C01E5B0B790F4F6751E977CC9
SHA1:	06DB05E1C73809CD442EF58F775A8E87D708421D
SHA-256:	C9BAAA478E3BA85897B781F7065B9E144FAACC8E81CAFA5A642B5D49C78434EB
SHA-512:	28DD57DC4360292B987D38A408771B5E1D5B423BFD9656BEE9DFA2F9BC19696AF63A7F90CD350C8445BB27C5049987D97D9530AB15F3697D37652A91AAA7F892
Malicious:	false
Preview:	#ifndef _FLOAT_H_.#define _FLOAT_H_..#define FLT_RADIX 2../* IEEE float /.#define FLT_MANT_DIG 24.#define FLT_DIG 6.#define FLT_ROUNDS 1.#define FLT_EPSILON 1.19209290e-07F.#define FLT_MIN_EXP (-125).#define FLT_MIN 1.17549435e-38F.#define FLT_MIN_10_EXP (-37).#define FLT_MAX_EXP 128.#define FLT_MAX 3.40282347e+38F.#define FLT_MAX_10_EXP 38../ IEEE double /.#define DBL_MANT_DIG 53.#define DBL_DIG 15.#define DBL_EPSILON 2.2204460492503131e-16.#define DBL_MIN_EXP (-1021).#define DBL_MIN 2.2250738585072014e-308.#define DBL_MIN_10_EXP (-307).#define DBL_MAX_EXP 1024.#define DBL_MAX 1.7976931348623157e+308.#define DBL_MAX_10_EXP 308../ horrible intel long double */.#if defined __i386__ \|\| defined __x86_64__..#define LDBL_MANT_DIG 64.#define LDBL_DIG 18.#define LDBL_EPSILON 1.08420217248550443401e-19L.#define LDBL_MIN_EXP (-16381).#define LDBL_MIN 3.36210314311209350626e-4932L.#define LDBL_MIN_10_EXP (-4931).#define LDBL_MAX_EXP 16384.#define LDBL_MAX 1.18973149535723176502e+4932L.#defin

C:\Program Files\Cheat Engine 7.5\include\is-F8B1F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	6333
Entropy (8bit):	5.377774221268906
Encrypted:	false
SSDEEP:	96:Od4Q69/YQhMgPRVQzD+5VO7wRUNsNwxzMD2eT:Ou/f3Riz65VO7wRUNsNwxG
MD5:	90C1945AFA014FC0F8D17078C51502CA
SHA1:	F3A15DC3E32ED97B8CC34C1AFA2C66ECBA3B3BE4
SHA-256:	33C6C8DA7D564B5702AF8C6FF45C00A16842BA3FFE3F95F7F6232752F63C5AFD
SHA-512:	BE8557BDA158662ACC18CBD4445D4D2E6787FB5C78A67F0D0E4A62FFC9D2B1173C30C66CA5C6A247DA8FE7C38B7C57AFF050BD4A35B0120BD95400CFB4C2C2B6
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /./ ISO C9x 7.18 Integer types <stdint.h>. * Based on ISO/IEC SC22/WG14 9899 Committee draft (SC22 N2794). . THIS SOFTWARE IS NOT COPYRIGHTED. . Contributor: Danny Smith <danny_r_smith_2001@yahoo.co.nz>. . This source code is offered for use in the public domain. You may. * use, modify or distribute it freely.. . This code is distributed in the hope that it will be useful but. * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY. * DISCLAIMED. This includes but is not limited to warranties of. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.. . Date: 2000-12-02. */...#ifndef _STDINT_H.#define _STDINT_H..#include <_mingw.h>..#define __need_wint_t.#define __need_wchar_t.#include "stddef.h"..#ifndef __int8_t_defined.#define __int8_t

C:\Program Files\Cheat Engine 7.5\include\is-FEKQ6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.1075312514305296
Encrypted:	false
SSDEEP:	24:i2PSh0PDYqsS6s1UzFf5wNaCmwN0PK0PQvYaH2l2X:GlS6s1k5wNaRwNt95H2U
MD5:	29F62B1ADD26DC1AED3FAAD03FAC030D
SHA1:	6F605B9A153A987F2939AE6500D6391FDC107332
SHA-256:	B4341E188913A819FA3BF101078A95CA077780219373F424C39AD86C94E04B6F
SHA-512:	3D98E9F039DDA694A660BA7D2F7906FCD60016DC6A8FED78CEB7B191618318A68D34169B9480BA5727730F6BD6357A13FD02E0CDCA5439A45E06D2F0D61DABE0
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_MEMORY.#define _INC_MEMORY..#include <_mingw.h>..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CONST_RETURN.#define _CONST_RETURN.#endif..#define _WConst_return _CONST_RETURN..#ifndef _CRT_MEMORY_DEFINED.#define _CRT_MEMORY_DEFINED. _CRTIMP void __cdecl _memccpy(void _Dst,const void _Src,int _Val,size_t _MaxCount);. _CONST_RETURN void __cdecl memchr(const void _Buf ,int _Val,size_t _MaxCount);. _CRTIMP int __cdecl _memicmp(const void _Buf1,const void _Buf2,size_t _Size);. _CRTIMP int __cdecl _memicmp_l(const void _Buf1,const void _Buf2,size_t _Size,_locale_t _Locale);. int __cdecl memcmp(const void _Buf1,const void _Buf2,size_t _Size);. void __cdecl memcpy(void _Dst,const void _Src,size_t _Size);. void __cdecl memset(void *_Dst,int _Val,si

C:\Program Files\Cheat Engine 7.5\include\is-G3L07.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	4.9174278150037285
Encrypted:	false
SSDEEP:	6:UJg2JESe3SFB+SqicFPoJZVC1r2Ti2F0A/ivi+M8WjTffBX5FoKtn+cs:UJJISFcShcFP+4B6Xr/qi+MHjjfBcKta
MD5:	8C659FCB5BA111C2A40716A84A2540D8
SHA1:	20069AF3A3805CF4CB05339F7A7A860F04A1E4B9
SHA-256:	07858857F4EED0A61DF94BEB1A9D678B53FC3D67A0B0E8936155F85DDBCD1DCC
SHA-512:	D1B19DEC523C79320BB3380F29981A49EFB178F06C0538BCE0A5B36AFEABEC9BE0F2A9D02436EDF2AC0970CB14B175B3387BBB14A1E5F62EEC9971C0C7648A99
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _VARARGS_H.#define _VARARGS_H..#error "TinyCC no longer implements <varargs.h>.".#error "Revise your code to use <stdarg.h>."..#endif.

C:\Program Files\Cheat Engine 7.5\include\is-G42GM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	8405
Entropy (8bit):	5.100723832842219
Encrypted:	false
SSDEEP:	192:0ih8Bf8Bx8B6qwyKg758H898Bc8BQGDL2XMR6fm4RFeU6sxhE2JFE:0G8Bf8Bx8Bxwyz58O8Bc8Bv208m4RFeD
MD5:	698EA0C0196BA07E9B949406DBB9FFD7
SHA1:	7296CFE82FAB54F08D44CE9CBAB92BEF7D96C96E
SHA-256:	453793A2D6C6FC772D1CDD60E701FB3D393D752937C1D6B2CA64D5F1CEC9FD36
SHA-512:	49984DDD4866060D8E310CA6A2BD53DEA87ABA70778202C5EFED126C35B244DF90C42D61477775F327B30597138A73FB2B2EE2E1050DC6732FAEB766E870C146
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _TIME_H_.#define _TIME_H_..#include <_mingw.h>..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CRTIMP.#define _CRTIMP __declspec(dllimport).#endif..#ifndef _WCHAR_T_DEFINED.#define _WCHAR_T_DEFINED. typedef unsigned short wchar_t;.#endif..#ifndef _TIME32_T_DEFINED.#define _TIME32_T_DEFINED. typedef long __time32_t;.#endif..#ifndef _TIME64_T_DEFINED.#define _TIME64_T_DEFINED.#if _INTEGRAL_MAX_BITS >= 64.#if defined(__GNUC__) && defined(__STRICT_ANSI__). typedef int _time64_t __attribute__ ((mode (DI)));.#else. typedef __int64 __time64_t;.#endif.#endif.#endif..#ifndef _TIME_T_DEFINED.#define _TIME_T_DEFINED.#ifdef _USE_32BIT_TIME_T. typedef __time32_t time_t;.#else. typ

C:\Program Files\Cheat Engine 7.5\include\is-HBL1M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	4.819819315483337
Encrypted:	false
SSDEEP:	6:UJg2JESe3SFB+SqicFPoJZVC1r7SFlLClXF1qTVSEDbA1CAAqC:UJJISFcShcFP+4B7SFRClV1qDD8CAAqC
MD5:	534517144E5B9ED662526771BB5D7E13
SHA1:	2D1801E4179E2A6E5914764D944A9C472BF65E99
SHA-256:	43956946AEFEE50E01FDD4D54A6C597418ABCB02251F9D7695ED7039FD7A5FF6
SHA-512:	533F30D3288C2B827D29210C6890D600678DB4F67B9FFAB27046E5CA3931BC119DE4AF93FFA63929DCD9D7C0BABD69A25E7F52E697272F3226ED198C93A9A8CD
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /./. * This file is part of the Mingw32 package.. . mem.h maps to string.h. */.#ifndef.__STRICT_ANSI__.#include <string.h>.#endif.

C:\Program Files\Cheat Engine 7.5\include\is-HH378.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	8590
Entropy (8bit):	4.845158903423087
Encrypted:	false
SSDEEP:	192:9SahrQ/tJUaRaV/f7WtxfeiZDHy6U4diocGLIvHKLhfyW7Ja0+8:9sJlS6H
MD5:	7E3AC3220BF883DA2DB8CDC7B8100D0B
SHA1:	666E6F91306EF6412AE912FA386B3DECC6332AD5
SHA-256:	D5C02C22653784792EEFF04CC453467BA22C214D9ACE876127EAB5FCCCBCA762
SHA-512:	1E27E9E73C5D3FBEC7CE41CB3B5FD6615BACC416991321BCE22B599150902352CF60078CD447BBBBD49F3106254C5E88E3FB01CA7DE62DA9A4DEDB6FD60F9B7A
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_STRING.#define _INC_STRING..#include <_mingw.h>..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _NLSCMP_DEFINED.#define _NLSCMP_DEFINED.#define _NLSCMPERROR 2147483647.#endif..#ifndef NULL.#ifdef __cplusplus.#define NULL 0.#else.#define NULL ((void )0).#endif.#endif..#define _WConst_return _CONST_RETURN..#ifndef _CRT_MEMORY_DEFINED.#define _CRT_MEMORY_DEFINED. _CRTIMP void __cdecl _memccpy(void _Dst,const void _Src,int _Val,size_t _MaxCount);. _CONST_RETURN void __cdecl memchr(const void _Buf ,int _Val,size_t _MaxCount);. _CRTIMP int __cdecl _memicmp(const void _Buf1,const void _Buf2,size_t _Size);. _CRTIMP int __cdecl _memicmp_l(const void _Buf1,const void _Buf2,size_t _Size,_locale_t _Locale);. int __cdecl memcmp(const void _Buf1,const void *_Bu

C:\Program Files\Cheat Engine 7.5\include\is-INTCK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	1979
Entropy (8bit):	5.047752773488744
Encrypted:	false
SSDEEP:	24:i2PSh0PDnZTwNe2FhqA7DiyX40E090m0c0/0vF7Gl0lF+yivXw0vZ0CZ0F2xFeHv:Gs6Z7aNA7bmwGOK0gZBZCQs
MD5:	83679DA78AAF8F8352ACB1883B9EF868
SHA1:	FD89079636571A93755120120AB4F03B91076478
SHA-256:	179C3204312D7CF8032102773629BCB3E5FFF792D1D808931CB6619A431D2435
SHA-512:	13AF1F2C118E898E6055CA61286C9766DF75366FF4F30708F613193CD8F89AFC4A4CC2FD31FC3AC6DCE5D577EE83E203F79ACA3B739D9D9E9E60B42CD9C7036E
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_DIRECT.#define _INC_DIRECT..#include <_mingw.h>.#include <io.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _DISKFREE_T_DEFINED.#define _DISKFREE_T_DEFINED. struct _diskfree_t {. unsigned total_clusters;. unsigned avail_clusters;. unsigned sectors_per_cluster;. unsigned bytes_per_sector;. };.#endif.. _CRTIMP char __cdecl _getcwd(char _DstBuf,int _SizeInBytes);. _CRTIMP char __cdecl _getdcwd(int _Drive,char _DstBuf,int _SizeInBytes);. char __cdecl _getdcwd_nolock(int _Drive,char _DstBuf,int _SizeInBytes);. _CRTIMP int __cdecl _chdir(const char _Path);. _CRTIMP int __cdecl _mkdir(const char _Path);. _CRTIMP int __cdecl _rmdir(const char _Path);. _CRTIMP int __cdecl _chdrive(int _Drive);. _CRTIMP in

C:\Program Files\Cheat Engine 7.5\include\is-J1VDF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	5.067511244355359
Encrypted:	false
SSDEEP:	24:i2PSh0PDeLwFq64bCszOD1zr/Aob1UBFv1tDaMLQHy2RoP/17FN:GOFq6UkybLGMLgyx/17z
MD5:	478ADD63D2C741D03A60A11BDC4FC0D3
SHA1:	E9E0C857D2C409F23C346D81B77C5634F1C395AB
SHA-256:	FBD94F945A57165AC897BDBACD2A861B1351E7850FA76752703C0A622E0646FA
SHA-512:	BCCC563718B1A03E93E5BF8CF0D79BB3128A3FC1FDD6FBC17792CBAF3C5DE70DE06EC2F88D8EED7105FF62056E32E9A79570F5890E75F4443033421D283B2FEC
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#include <_mingw.h>..#include <io.h>..#ifndef _INC_FCNTL.#define _INC_FCNTL..#define _O_RDONLY 0x0000.#define _O_WRONLY 0x0001.#define _O_RDWR 0x0002.#define _O_APPEND 0x0008.#define _O_CREAT 0x0100.#define _O_TRUNC 0x0200.#define _O_EXCL 0x0400.#define _O_TEXT 0x4000.#define _O_BINARY 0x8000.#define _O_WTEXT 0x10000.#define _O_U16TEXT 0x20000.#define _O_U8TEXT 0x40000.#define _O_ACCMODE (_O_RDONLY\|_O_WRONLY\|_O_RDWR)..#define _O_RAW _O_BINARY.#define _O_NOINHERIT 0x0080.#define _O_TEMPORARY 0x0040.#define _O_SHORT_LIVED 0x1000..#define _O_SEQUENTIAL 0x0020.#define _O_RANDOM 0x0010..#if !defined(NO_OLDNAMES) \|\| defined(_POSIX).#define O_RDONLY _O_RDONLY.#define O_WRONLY _O_WRONLY.#define O_RDWR _O_RDWR.#define O_APPEND _O_APPEND.#define O_CREAT _O_CREAT.#define O_TRUNC _O_TRUNC

C:\Program Files\Cheat Engine 7.5\include\is-JMF9S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	4782
Entropy (8bit):	5.146949090032166
Encrypted:	false
SSDEEP:	96:4+KnaNsLsNwnSTOXNXgXXXVX+1XPXmXIX6QXJX9XZXdwUSv:4+KA6O6XNXgXXXVXkXPXmXIXfXJX9XZK
MD5:	C238CFA11A44926BECD364AB35BFC821
SHA1:	54D68B8EF71D277BD5173E0AAC794D6EBDB00360
SHA-256:	E12D9C5BCBE4DFB96EA6C75410EA287917B3C24BFF9CD2E716D35E00C1D4906C
SHA-512:	C64F6A3B18D84C8498A2270E7152C4001D6D7EE1ACD04169F616A7808A05A02F34E2876BA0CB8D979AE75752109B50A65A66207C86FE936402BDA39AC93833C0
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_WCTYPE.#define _INC_WCTYPE..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CRTIMP.#define _CRTIMP __declspec(dllimport).#endif..#ifndef _WCHAR_T_DEFINED. typedef unsigned short wchar_t;.#define _WCHAR_T_DEFINED.#endif..#ifndef _WCTYPE_T_DEFINED. typedef unsigned short wint_t;. typedef unsigned short wctype_t;.#define _WCTYPE_T_DEFINED.#endif..#ifndef WEOF.#define WEOF (wint_t)(0xFFFF).#endif..#ifndef _CRT_CTYPEDATA_DEFINED.#define _CRT_CTYPEDATA_DEFINED.#ifndef _CTYPE_DISABLE_MACROS..#ifndef __PCTYPE_FUNC.#define __PCTYPE_FUNC __pctype_func().#ifdef _MSVCRT_.#define __pctype_func() (_pctype).#else.#define __pctype_func() (_imp___pctype).#endif.

C:\Program Files\Cheat Engine 7.5\include\is-KITFQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	9755
Entropy (8bit):	5.0535405224800884
Encrypted:	false
SSDEEP:	192:aK0sBzLLoy8q3JHZDrs+UAt0g7WnBeaIlzjD:EALLb8ars+Flzf
MD5:	22E5A00491E32D15B40B196397AD01C1
SHA1:	B0DB6FCBF4ABD2F4FDEA2771399C1E502D9F8106
SHA-256:	4CFAAA43B3F7414984126E8B1CDF65F9DAC0EF68D9A3396BE0B8828376A74A6B
SHA-512:	28839104776441738233334A20DE6CE3ADA51179FB50366C27AB60432949FC78E1CCF735D2E80216F8779D84328634005C322D0010875E8FE0FF33D699ECC114
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_CTYPE.#define _INC_CTYPE..#include <_mingw.h>..#ifdef __cplusplus.extern "C" {.#endif..#ifndef WEOF.#define WEOF (wint_t)(0xFFFF).#endif..#ifndef _CRT_CTYPEDATA_DEFINED.#define _CRT_CTYPEDATA_DEFINED.#ifndef _CTYPE_DISABLE_MACROS..#ifndef __PCTYPE_FUNC.#define __PCTYPE_FUNC __pctype_func().#ifdef _MSVCRT_.#define __pctype_func().(_pctype).#else.#define __pctype_func().(_imp___pctype).#endif.#endif..#ifndef _pctype.#ifdef _MSVCRT_. extern unsigned short _pctype;.#else. extern unsigned short _imp___pctype;.#define _pctype (_imp___pctype).#endif.#endif..#endif.#endif..#ifndef _CRT_WCTYPEDATA_DEFINED.#define _CRT_WCTYPEDATA_DEFINED.#ifndef _CTYPE_DISABLE_MACROS.#ifndef _wctype.#ifdef _MSVCRT_. extern unsigned short _wctype;.#else. extern unsigned short *_im

C:\Program Files\Cheat Engine 7.5\include\is-MG740.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	13067
Entropy (8bit):	5.032337228232408
Encrypted:	false
SSDEEP:	384:Y8Bx8BjP8BJPKf37Rw8z/hI9B3mpv6O3O8iONUO5OG0xLIJ8SNgVSAMczPO8cONU:r02oxz7vX+8fNxIG0S8SNgVxz28ZNU
MD5:	4AC0744EF16453FEBED8DE4242997946
SHA1:	B092C9006DE0A8DBE7F0FF568B6CAAFB00B4C90A
SHA-256:	5DA97C850E8E2AB608C42947A33411F556F6D75B8264E1E5CF29CA7BA7B96256
SHA-512:	1EC9947C6FE0160954F3922D6990863865D274874C31355F0838CCBB1BBF6650A9A3F0D3590537A189AFBF80E33CDE5393260FDD5F3EA5A736A066CDCC5FF815
Malicious:	false
Preview:	./*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _IO_H_.#define _IO_H_..#include <_mingw.h>.#include <string.h>..#pragma pack(push,_CRT_PACKING)..#ifndef _POSIX_..#ifdef __cplusplus.extern "C" {.#endif.._CRTIMP char __cdecl _getcwd (char, int);.#ifndef _FSIZE_T_DEFINED. typedef unsigned long _fsize_t;.#define _FSIZE_T_DEFINED.#endif..#ifndef _FINDDATA_T_DEFINED.. struct _finddata32_t {. unsigned attrib;. __time32_t time_create;. __time32_t time_access;. __time32_t time_write;. _fsize_t size;. char name[260];. };../#if _INTEGRAL_MAX_BITS >= 64*/.. struct _finddata32i64_t {. unsigned attrib;. __time32_t time_create;. __time32_t time_access;. __time32_t time_write;. __int64 size;. char name[260];. };.. struct _finddata64i32_t {. unsigned attrib;. __time64_t time_create

C:\Program Files\Cheat Engine 7.5\include\is-MKK0B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	3339
Entropy (8bit):	4.737300914010111
Encrypted:	false
SSDEEP:	48:GzyKQvcpqt7K7PnON+J3esAYUJ0q/nfB2Vt7K7qpdSVNsJ35sAYqJ0q/WaLcC:ayfv0ONgcKqvspkVNyh8q+UcC
MD5:	AFBE32EE6DED8CBAD33D6FE3FBBF077D
SHA1:	A7F0D3EDEE5F49E127575EB25E64E2747108E7C3
SHA-256:	88C1F767FDCD6D51B991EE3234792DA48C8576F5F8816F17A42344F9C8BBB1C1
SHA-512:	F655A40F8C87A0CB43A34AE47612D5CEF2CF7814FD2AE9CE1C8566F97F45E91470364BD87E8C12861CCE44FB8CCA54717546BAACC6CCBDACE51D0D15206304DD
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /./ All the headers include this file. /.#include <_mingw.h>..#ifndef.__STRICT_ANSI__..#ifndef _DIRENT_H_.#define _DIRENT_H_...#pragma pack(push,_CRT_PACKING)..#include <io.h>..#ifndef RC_INVOKED..#ifdef __cplusplus.extern "C" {.#endif.. struct dirent. {. long..d_ino;../ Always zero. /. unsigned short.d_reclen;./ Always zero. /. unsigned short.d_namlen;./ Length of name in d_name. /. char..d_name;../* File name. /. / NOTE: The name in the dirent structure points to the name in the. * finddata_t structure in the DIR. /. };.. /. * This is an internal data structure. Good programmers will not use it. * except as an argument to one of the functions below.. * dd_stat field is now int (was short in older versions).. */. typedef struct. {.

C:\Program Files\Cheat Engine 7.5\include\is-OK78B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	1402
Entropy (8bit):	4.8724440555000506
Encrypted:	false
SSDEEP:	24:d19VSrcs/mbR/4Cm+iOwHCFFfJNn9DAP6V2OCB6E7LuNcWmY/CDGAsC:5VSrH/TCeCFD59DGJUEnhzY/6GA9
MD5:	8B03F5DA84F6175FB1213C1208BB0944
SHA1:	FB7A374705241EE8BA4C59C6BD4829A97B90FA55
SHA-256:	C91FFAAEF5231C6D7E744E0700F1F429C9CFAD88A4112FDD5ABABB701F3B5A4B
SHA-512:	038DA70FFDA4BF66CDF6D0D6792F51B140B0E6EEC8351A286A51D454A81E0571779E16985519DAB47F3B48E6102A54A40101634B86F556C95C2128DC6AED4283
Malicious:	false
Preview:	#ifndef _STDDEF_H.#define _STDDEF_H..typedef __SIZE_TYPE__ size_t;.typedef __PTRDIFF_TYPE__ ssize_t;.typedef __WCHAR_TYPE__ wchar_t;.typedef __PTRDIFF_TYPE__ ptrdiff_t;.typedef __PTRDIFF_TYPE__ intptr_t;.typedef __SIZE_TYPE__ uintptr_t;..#ifndef __int8_t_defined.#define __int8_t_defined.typedef signed char int8_t;.typedef signed short int int16_t;.typedef signed int int32_t;.#ifdef __LP64__.typedef signed long int int64_t;.#else.typedef signed long long int int64_t;.#endif.typedef unsigned char uint8_t;.typedef unsigned short int uint16_t;.typedef unsigned int uint32_t;.#ifdef __LP64__.typedef unsigned long int uint64_t;.#else.typedef unsigned long long int uint64_t;.#endif.#endif..#ifndef NULL.#define NULL ((void)0).#endif..#define offsetof(type, field) ((size_t)&((type )0)->field)..void alloca(size_t size);..#endif../ Older glibc require a wint_t from <stddef.h> (when requested. by __need_wint_t, as otherwise stddef.h isn't allowed to. define this type). Note that this must

C:\Program Files\Cheat Engine 7.5\include\is-PL1GR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	3146
Entropy (8bit):	5.109358717547865
Encrypted:	false
SSDEEP:	48:GjF4XfZlIPU0rBLeGwDO0QZFxI2bMCaZSpEhW8bxv:CivoPU0rBLeRDO0QfxI2YCaZZhNl
MD5:	DEEC7C35F77EC8E22074667641CA8851
SHA1:	8CCE6B663A9A04B3C13AA6621B0798E487A8A88E
SHA-256:	67A827ACF4E09653AFB5D18F2ECAA5FCDFB7471D8A5B8197C2F33D06E8462F84
SHA-512:	8DE2B82B0579E6C37546A26BC1AB5D7603090E815D8CE728474B1405339AB4EF4F0794DF19FF4CC3780AA7259288D4D93FD50B0E9C63D413FF22AD5E72BFCBE5
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _FENV_H_.#define _FENV_H_..#include <_mingw.h>../ FPU status word exception flags /.#define FE_INVALID.0x01.#define FE_DENORMAL.0x02.#define FE_DIVBYZERO.0x04.#define FE_OVERFLOW.0x08.#define FE_UNDERFLOW.0x10.#define FE_INEXACT.0x20.#define FE_ALL_EXCEPT (FE_INVALID \| FE_DENORMAL \| FE_DIVBYZERO \... \| FE_OVERFLOW \| FE_UNDERFLOW \| FE_INEXACT)../ FPU control word rounding flags /.#define FE_TONEAREST.0x0000.#define FE_DOWNWARD.0x0400.#define FE_UPWARD.0x0800.#define FE_TOWARDZERO.0x0c00../ The MXCSR exception flags are the same as the. FE flags. /.#define __MXCSR_EXCEPT_FLAG_SHIFT 0../ How much to shift FE status word exception flags. to get MXCSR rounding flags, /.#define __MXCSR_ROUND_FLAG_SHIFT 3..#ifndef RC_INVOKED./. For now, support only for t

C:\Program Files\Cheat Engine 7.5\include\is-RE8LQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	5.223946000134317
Encrypted:	false
SSDEEP:	24:i2PSh0PDPvH5BolYl9cEPXEDv5JOhS3zDOE/MVuTYE3tmV+Rv4fMBzN80FnPibwB:GWcqvvsDNzD9koS+94fQzN8OPibwDrhT
MD5:	A106C85866BF88A68510029349149B52
SHA1:	989F8BF922CAC5BEB03905A0E35C3C7B4B125C85
SHA-256:	045A031B376733ED7A685BC01709F5281403729FF7C601B913B2ACA2FE1493BB
SHA-512:	205611A36897D5A87EB54DA5C2C193680DAD95DDA01A55DCEF61665ED09EFD322A20F276D9419A64144941CF0B59339FF9D15C1A7A9C86DA60F140364EACFF73
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_SIGNAL.#define _INC_SIGNAL..#include <_mingw.h>..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _SIG_ATOMIC_T_DEFINED.#define _SIG_ATOMIC_T_DEFINED. typedef int sig_atomic_t;.#endif..#define NSIG 23..#define.SIGHUP.1./ hangup /.#define SIGINT 2.#define.SIGQUIT.3./ quit /.#define SIGILL 4.#define.SIGTRAP.5./ trace trap (not reset when caught) /.#define.SIGIOT.6./ IOT instruction /.#define.SIGABRT 6./ used by abort, replace SIGIOT in the future /.#define.SIGEMT.7./ EMT instruction /.#define SIGFPE 8.#define.SIGKILL.9./ kill (cannot be caught or ignored) /.#define.SIGBUS.10./ bus error /.#define SIGSEGV 11.#define.SIGSYS.12./ bad argument to system call /.#define.SIGPIPE.13./ write on a pipe with no one to read it */.#ifdef __USE_MINGW_ALARM.#def

C:\Program Files\Cheat Engine 7.5\include\is-S6USS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	11130
Entropy (8bit):	4.886603456377803
Encrypted:	false
SSDEEP:	192:R9IFnJJzpoJItwJ+Y31t1d1uF8sFX9B17lHLQWq4QcHyQA3sG1:XI4IJ2WzPw
MD5:	6A61E54AD2614BA528414C7B69147CAF
SHA1:	242479133484E15A2AF816D95DDB053835BF4C64
SHA-256:	DE7161F85835D98B38FE6A19EF8973DCAF58EC237B1C91CF05AC535B2FF3845F
SHA-512:	468702A606E20FFA893054F676C56DFE6EB3D28A002BAE143298422AB388A2F2F78E318714F5274BC9EBD243863F5228D5EBEAD5F31D892E96D8742C8E6846A1
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_CONIO.#define _INC_CONIO..#include <_mingw.h>..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP char _cgets(char _Buffer);. _CRTIMP int __cdecl _cprintf(const char _Format,...);. _CRTIMP int __cdecl _cputs(const char _Str);. _CRTIMP int __cdecl _cscanf(const char _Format,...);. _CRTIMP int __cdecl _cscanf_l(const char _Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _getch(void);. _CRTIMP int __cdecl _getche(void);. _CRTIMP int __cdecl _vcprintf(const char _Format,va_list _ArgList);. _CRTIMP int __cdecl _cprintf_p(const char _Format,...);. _CRTIMP int __cdecl _vcprintf_p(const char _Format,va_list _ArgList);. _CRTIMP int __cdecl _cprintf_l(const char _Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _vcprintf_l(const char _Format,_loc

C:\Program Files\Cheat Engine 7.5\include\is-SE4Q2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	3865
Entropy (8bit):	5.239566441223487
Encrypted:	false
SSDEEP:	48:aOgQsLqPQLHbXTN6oYsNhd6vgAwFQCbTprO5BPPTeraG9n0WP/zgSRQh:aOgQO3hdE8KBPPTrGHU5
MD5:	DC2829239704CDD5A5109699666FA573
SHA1:	60C09E102F552444D59ED9ED474E667136C16DC0
SHA-256:	AB4BE7D34E7FA0E722F0948E0C90AD4D95B8A1EC649C2F186DFA387B57BE7833
SHA-512:	F3551AEF2A0FFE42A16F1A8BE26B2C2722E773A59D21B60B2454AB0B68B008402623F378D2AFAA30FEBA87F560475A52D2899E6D062BD7F88E22119B25231F17
Malicious:	false
Preview:	/. _mingw.h. . This file is for TinyCC and not part of the Mingw32 package.. . THIS SOFTWARE IS NOT COPYRIGHTED. . This source code is offered for use in the public domain. You may. * use, modify or distribute it freely.. . This code is distributed in the hope that it will be useful but. * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY. * DISCLAIMED. This includes but is not limited to warranties of. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.. . /..#ifndef __MINGW_H.#define __MINGW_H../* some winapi files define these before including _mingw.h --> /.#undef __cdecl.#undef _X86_.#undef WIN32./ <-- */..#include <stddef.h>.#include <stdarg.h>..#define __int8 char.#define __int16 short.#define __int32 int.#define __int64 long long.#define _HAVE_INT64..#define __cdecl.#define __declspec(x) __attribute__((x)).#define __unaligned __attribute__((packed)).#define __fastcall __attribute__((fastcall))..#define __MSVCRT__ 1.#undef _MSVCRT_

C:\Program Files\Cheat Engine 7.5\include\is-T0LBE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	639
Entropy (8bit):	5.116570644892466
Encrypted:	false
SSDEEP:	12:UJJISFcShcFP+4BWIYKIiSUfwfvarry9rowrrqir3qGr+PFeHqveB7n4y8yvkA4p:i2PSh0PDWWIivavaq98whzlgFeHqve7u
MD5:	540EF403878DDBE2D4682540DA20095F
SHA1:	4E3230DF4B7A906CDC3B6E3E1A5CC768CC79C327
SHA-256:	6DE922C1BD7EEDC33308304785C212945064D763EEDFB373C09CBBB5CB933DDE
SHA-512:	7C27842CB6F3D2B9707A5DF55B45BCC5DD613CDA8C550F0232F0CB9DF8B59013F428EC3FC07FB002DFF80D26BB9941CE76CAADD22BD4B539C9F11EA13FE12EF5
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_SHARE.#define _INC_SHARE..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#define _SH_COMPAT 0x00.#define _SH_DENYRW 0x10.#define _SH_DENYWR 0x20.#define _SH_DENYRD 0x30.#define _SH_DENYNO 0x40.#define _SH_SECURE 0x80..#ifndef.NO_OLDNAMES.#define SH_COMPAT _SH_COMPAT.#define SH_DENYRW _SH_DENYRW.#define SH_DENYWR _SH_DENYWR.#define SH_DENYRD _SH_DENYRD.#define SH_DENYNO _SH_DENYNO.#endif..#endif.

C:\Program Files\Cheat Engine 7.5\include\is-VDPOG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	31364
Entropy (8bit):	4.752286291497649
Encrypted:	false
SSDEEP:	768:ngntwzzdfQQbqvoRFCM/CVwLn4wyQoPUQ:PzdfQQbqvo1UwNoPUQ
MD5:	E237270733EDC1CB97B10870A3D50A69
SHA1:	C2406D465B5E8D94E1CB61C6C3F312BDB018AC80
SHA-256:	7FE5FDE028FF8F69D2BDA910664E2C169E7B92C6E7F2CF7915EB72054A9746FF
SHA-512:	8DF9ADD42AD3C8C378E93AF4BEC69489D59B8088974A40EC04FB91749DC050E3000674C9388FAE9937F87D6ABB60199B13D179BF0A8654370A66DB64CDD2E1B1
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#include <_mingw.h>..#ifndef _INC_TCHAR.#define _INC_TCHAR..#ifdef _STRSAFE_H_INCLUDED_.#error Need to include strsafe.h after tchar.h.#endif..#ifdef __cplusplus.extern "C" {.#endif..#define _ftcscat _tcscat.#define _ftcschr _tcschr.#define _ftcscpy _tcscpy.#define _ftcscspn _tcscspn.#define _ftcslen _tcslen.#define _ftcsncat _tcsncat.#define _ftcsncpy _tcsncpy.#define _ftcspbrk _tcspbrk.#define _ftcsrchr _tcsrchr.#define _ftcsspn _tcsspn.#define _ftcsstr _tcsstr.#define _ftcstok _tcstok..#define _ftcsdup _tcsdup.#define _ftcsnset _tcsnset.#define _ftcsrev _tcsrev.#define _ftcsset _tcsset..#define _ftcscmp _tcscmp.#define _ftcsicmp _tcsicmp.#define _ftcsnccmp _tcsnccmp.#define _ftcsncmp _tcsncmp.#define _ftcsncicmp _tcsncicmp.#define _ftcsnicmp _tcsnicmp..#define _ftcscoll _tc

C:\Program Files\Cheat Engine 7.5\include\limits.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	2686
Entropy (8bit):	5.279528518541247
Encrypted:	false
SSDEEP:	48:GXFLawQcx1ZvUTc/5p3C8QcvAv1p3R0C8+Rve/KQ1i5/o4XqzOvQQHc8/Y:sn91ZgcrCkvQv0C8ksd4na
MD5:	21CE377183014C3535643C9050306A33
SHA1:	41B25206EDD6309884312FD70026096C35A6DBEB
SHA-256:	39C0761F0E43D7B936B9B81C85673DD82896EBFA66E9F1B9A19B45F34E4CD52A
SHA-512:	3B0FA5D6EBB7AC47694C7D04B4835AF6C089344F7F8337DB74B34E3B46A1792295224DC232FAC1FD0DB482FC32C8A6A4BFCAF4F39C35DCCD98600181C314B43D
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#include <_mingw.h>..#ifndef _INC_LIMITS.#define _INC_LIMITS../.* File system limits.. TODO: NAME_MAX and OPEN_MAX are file system limits or not? Are they the.* same as FILENAME_MAX and FOPEN_MAX from stdio.h?.* NOTE: Apparently the actual size of PATH_MAX is 260, but a space is.* required for the NUL. TODO: Test?.*/.#define PATH_MAX.(259)..#define CHAR_BIT 8.#define SCHAR_MIN (-128).#define SCHAR_MAX 127.#define UCHAR_MAX 0xff..#define CHAR_MIN SCHAR_MIN.#define CHAR_MAX SCHAR_MAX..#define MB_LEN_MAX 5.#define SHRT_MIN (-32768).#define SHRT_MAX 32767.#define USHRT_MAX 0xffff.#define INT_MIN (-2147483647 - 1).#define INT_MAX 2147483647.#define UINT_MAX 0xffffffff.#define LONG_MIN (-2147483647L - 1).#define LONG_MAX 2147483647L.#define ULONG_MAX 0xffffffffUL.#def

C:\Program Files\Cheat Engine 7.5\include\locale.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	2135
Entropy (8bit):	5.113182765405398
Encrypted:	false
SSDEEP:	48:GXWM0CJUOsxXX0MLOMMMRgusuLZum+3Pw+8yFGX7Mu1LkuLS91uuHeLWv:35TW/Vf5FS7Mu1IuLium6Wv
MD5:	5F6A3E42F8EB297B888B498D93437C3C
SHA1:	09729D7892A1ED36AFADDEC40674ACEB62B5FA88
SHA-256:	882626FA25DBC1B5903E6FD98CC8516F1E54C4E06945026653F05B38125DFF2C
SHA-512:	587BB7BE57DDA7DB0BF8C454A78DD67D850342D97BC7C99A9804D53FA7929EB42C1194E13456170C0902CA7A15C028A6C635879889F0AF6A9ED833C2E046B9EC
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_LOCALE.#define _INC_LOCALE..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef NULL.#ifdef __cplusplus.#define NULL 0.#else.#define NULL ((void )0).#endif.#endif..#define LC_ALL 0.#define LC_COLLATE 1.#define LC_CTYPE 2.#define LC_MONETARY 3.#define LC_NUMERIC 4.#define LC_TIME 5..#define LC_MIN LC_ALL.#define LC_MAX LC_TIME..#ifndef _LCONV_DEFINED.#define _LCONV_DEFINED. struct lconv {. char decimal_point;. char thousands_sep;. char grouping;. char int_curr_symbol;. char currency_symbol;. char mon_decimal_point;. char mon_thousands_sep;. char mon_grouping;. char positive_sign;. char negative_sign;. char int_frac_digits;. char frac_digits;. char p_cs_precedes;.

C:\Program Files\Cheat Engine 7.5\include\malloc.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	5214
Entropy (8bit):	5.2821319558661655
Encrypted:	false
SSDEEP:	96:y4bSZjA6r8VdQINtNy6XVqB4/mLErYQ015U/dIuvwQRbZBq35jU:9urrSXIzGdIuvwQR9YJo
MD5:	537BC027E86F7252D88B6BF2FE5B2F35
SHA1:	7F3361D220F96AD1B93669254937929F267CC333
SHA-256:	7307FF330B8D7954D548E19E45887ED64DE36DA5BEE1FDA2CC021F0C1C1892BD
SHA-512:	3D7693F46FE1272DECBA8EFB6A01853786419055CF338CC900C9FE3EC1B795BA25E16878A5D53261BF3BC3BAB7525110B6F1844501D5FB6BE45C57B5D277F625
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _MALLOC_H_.#define _MALLOC_H_..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifndef _MM_MALLOC_H_INCLUDED.#define _MM_MALLOC_H_INCLUDED.#endif..#ifdef __cplusplus.extern "C" {.#endif..#ifdef _WIN64.#define _HEAP_MAXREQ 0xFFFFFFFFFFFFFFE0.#else.#define _HEAP_MAXREQ 0xFFFFFFE0.#endif..#ifndef _STATIC_ASSERT.#define _STATIC_ASSERT(expr) extern void __static_assert_t(int [(expr)?1:-1]).#endif../ Return codes for _heapwalk() /.#define _HEAPEMPTY (-1).#define _HEAPOK (-2).#define _HEAPBADBEGIN (-3).#define _HEAPBADNODE (-4).#define _HEAPEND (-5).#define _HEAPBADPTR (-6)../ Values for _heapinfo.useflag /.#define _FREEENTRY 0.#define _USEDENTRY 1..#ifndef _HEAPINFO_DEFINED.#define _HEAPINFO_DEFINED. / The structure used to walk through the heap with _heapwalk.

C:\Program Files\Cheat Engine 7.5\include\math.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	23077
Entropy (8bit):	5.0910424086795425
Encrypted:	false
SSDEEP:	384:lpwI012C9/SKSP4qROW8JuWucZBFRzWhHONMLPik9OeY:lpq2C9/FA4OOJr
MD5:	631F16C4A65CF2F47FA49C9220D9C500
SHA1:	330EADF08FDCB31747BF7C84182F2A5EECFA3FAB
SHA-256:	0BC33882BD2AF1E7D33C38C0160E2A0AE737836815360765750CDC7E98E5DFC5
SHA-512:	92EB690CA7D563269CEAEFFAC1F0FFBA6D010568431843F2DD82DCA7A1ACA0E6634C3335202ED5559FE631B0ED7C585DC1C3F5BB248FE3D571BA754B22B6AD5A
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _MATH_H_.#define _MATH_H_..#if __GNUC__ >= 3.#pragma GCC system_header.#endif..#include <_mingw.h>..struct exception;..#pragma pack(push,_CRT_PACKING)..#define _DOMAIN 1.#define _SING 2.#define _OVERFLOW 3.#define _UNDERFLOW 4.#define _TLOSS 5.#define _PLOSS 6..#ifndef __STRICT_ANSI__.#ifndef.NO_OLDNAMES.#define DOMAIN _DOMAIN.#define SING _SING.#define OVERFLOW _OVERFLOW.#define UNDERFLOW _UNDERFLOW.#define TLOSS _TLOSS.#define PLOSS _PLOSS.#endif.#endif..#ifndef __STRICT_ANSI__.#define M_E 2.71828182845904523536.#define M_LOG2E 1.44269504088896340736.#define M_LOG10E 0.434294481903251827651.#define M_LN2 0.693147180559945309417.#define M_LN10 2.30258509299404568402.#define M_PI 3.14159265358979323846.#define M_PI_2 1.57079632679489661923.#define M_PI_4 0.785398163397

C:\Program Files\Cheat Engine 7.5\include\mem.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	345
Entropy (8bit):	4.819819315483337
Encrypted:	false
SSDEEP:	6:UJg2JESe3SFB+SqicFPoJZVC1r7SFlLClXF1qTVSEDbA1CAAqC:UJJISFcShcFP+4B7SFRClV1qDD8CAAqC
MD5:	534517144E5B9ED662526771BB5D7E13
SHA1:	2D1801E4179E2A6E5914764D944A9C472BF65E99
SHA-256:	43956946AEFEE50E01FDD4D54A6C597418ABCB02251F9D7695ED7039FD7A5FF6
SHA-512:	533F30D3288C2B827D29210C6890D600678DB4F67B9FFAB27046E5CA3931BC119DE4AF93FFA63929DCD9D7C0BABD69A25E7F52E697272F3226ED198C93A9A8CD
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /./. * This file is part of the Mingw32 package.. . mem.h maps to string.h. */.#ifndef.__STRICT_ANSI__.#include <string.h>.#endif.

C:\Program Files\Cheat Engine 7.5\include\memory.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.1075312514305296
Encrypted:	false
SSDEEP:	24:i2PSh0PDYqsS6s1UzFf5wNaCmwN0PK0PQvYaH2l2X:GlS6s1k5wNaRwNt95H2U
MD5:	29F62B1ADD26DC1AED3FAAD03FAC030D
SHA1:	6F605B9A153A987F2939AE6500D6391FDC107332
SHA-256:	B4341E188913A819FA3BF101078A95CA077780219373F424C39AD86C94E04B6F
SHA-512:	3D98E9F039DDA694A660BA7D2F7906FCD60016DC6A8FED78CEB7B191618318A68D34169B9480BA5727730F6BD6357A13FD02E0CDCA5439A45E06D2F0D61DABE0
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_MEMORY.#define _INC_MEMORY..#include <_mingw.h>..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CONST_RETURN.#define _CONST_RETURN.#endif..#define _WConst_return _CONST_RETURN..#ifndef _CRT_MEMORY_DEFINED.#define _CRT_MEMORY_DEFINED. _CRTIMP void __cdecl _memccpy(void _Dst,const void _Src,int _Val,size_t _MaxCount);. _CONST_RETURN void __cdecl memchr(const void _Buf ,int _Val,size_t _MaxCount);. _CRTIMP int __cdecl _memicmp(const void _Buf1,const void _Buf2,size_t _Size);. _CRTIMP int __cdecl _memicmp_l(const void _Buf1,const void _Buf2,size_t _Size,_locale_t _Locale);. int __cdecl memcmp(const void _Buf1,const void _Buf2,size_t _Size);. void __cdecl memcpy(void _Dst,const void _Src,size_t _Size);. void __cdecl memset(void *_Dst,int _Val,si

C:\Program Files\Cheat Engine 7.5\include\process.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	9091
Entropy (8bit):	5.046593382105061
Encrypted:	false
SSDEEP:	192:kVIYQ03tIPjxoNimr4mJ6hIO0XtcsQQ05vQTcsBOdFS3b6dyntql+:kVIYQ03tIPjxoNimr4mJ6hIOmcsQQ05E
MD5:	F06EDAF6AB750607C33C37BFE50B2EB2
SHA1:	CA3AFC7781760D84432B06567AFBDA24587757DD
SHA-256:	6947C954F2AF676E66CC38D64B1A165428734000E2E272F883C2D74A85B82020
SHA-512:	9926B19FBD4B30ECF6682AE5945401E4387D2B5CE02D7643B51C660462B761B08F52A99F2B7DA73B574C7BC6388CD23CA3ED8451A3CF2B3501AD217925A503EB
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_PROCESS.#define _INC_PROCESS..#include <_mingw.h>../ Includes a definition of _pid_t and pid_t /.#include <sys/types.h>..#ifndef _POSIX_.#ifdef __cplusplus.extern "C" {.#endif..#define _P_WAIT 0.#define _P_NOWAIT 1.#define _OLD_P_OVERLAY 2.#define _P_NOWAITO 3.#define _P_DETACH 4.#define _P_OVERLAY 2..#define _WAIT_CHILD 0.#define _WAIT_GRANDCHILD 1.. _CRTIMP uintptr_t __cdecl _beginthread(void (__cdecl _StartAddress) (void ),unsigned _StackSize,void _ArgList);. _CRTIMP void __cdecl _endthread(void);. _CRTIMP uintptr_t __cdecl _beginthreadex(void _Security,unsigned _StackSize,unsigned (__stdcall _StartAddress) (void ),void _ArgList,unsigned _InitFlag,unsigned *_ThrdAddr);. _CRTIMP void __cdecl _endthreadex(unsigned _Retval);..#ifndef _CRT_TERMINATE_DE

C:\Program Files\Cheat Engine 7.5\include\sec_api\conio_s.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	1535
Entropy (8bit):	5.005173947475632
Encrypted:	false
SSDEEP:	24:i2PSh0PDp5BUXLjIT0Cn0jIn0jQsY0eq0DY0PdMR0Mk3Z0ln0ln0fKY0xq0CY0u+:G4X+j41n8In8QsYbqgYKd00x+nknmKY1
MD5:	5BC78AA26AF6CE836F322CD5A432E368
SHA1:	1E99298161F0ADB4F7244EB5A067364DC5B47E91
SHA-256:	F7375E816739491FBAB39531C1D60A77B78FF9A162ABA17F817C773BF75F6508
SHA-512:	F1BFD5EF34A97E72EC474B2A2FECF4AC5FA1931E08845489623A7C699954B549FEDE1E4F93C815C0A9944A7D79601A9ED1342D47694528DAB54ADEAA5BBAB443
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /..#ifndef _INC_CONIO_S.#define _INC_CONIO_S..#include <conio.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP errno_t __cdecl _cgets_s(char _Buffer,size_t _Size,size_t _SizeRead);. _CRTIMP int __cdecl _cprintf_s(const char _Format,...);. _CRTIMP int __cdecl _cscanf_s(const char _Format,...);. _CRTIMP int __cdecl _cscanf_s_l(const char _Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _vcprintf_s(const char _Format,va_list _ArgList);. _CRTIMP int __cdecl _cprintf_s_l(const char _Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _vcprintf_s_l(const char _Format,_locale_t _Locale,va_list _ArgList);..#ifndef _WCONIO_DEFINED_S.#define _WCONIO_DEFINED_S. _CRTIMP errno_t __cdecl _cgetws_s(wchar_t _Buffer,size_t _SizeInWords,

C:\Program Files\Cheat Engine 7.5\include\sec_api\crtdbg_s.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	461
Entropy (8bit):	5.161018019410615
Encrypted:	false
SSDEEP:	12:UJJISFcShcFP+4BtsYzlAEG2UCqAhEGksdAwED:i2PSh0PDtJLUtNjOqD
MD5:	F0C359A5AA08A907A23D2C0C5AA68E5C
SHA1:	B487788EC6AA32458DF18F6D10F67573DE8FA16E
SHA-256:	03630EE83E7C921446A0790853FCADEB5A308553DD3C4ECDDD568CDA3167C0F1
SHA-512:	71BD41E6BD84BFFE34BEB8EF1B49C63358CB5D8E520972D57046D58E9D9FB6DEAE512E4CF5554337DA2510D6F3AFCD6C6D58124A30C4003F9E3A8F60C2FFA896
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */..#ifndef _INC_CRTDBG_S.#define _INC_CRTDBG_S..#include <crtdbg.h>..#if defined(MINGW_HAS_SECURE_API)..#define _dupenv_s_dbg(ps1,size,s2,t,f,l) _dupenv_s(ps1,size,s2).#define _wdupenv_s_dbg(ps1,size,s2,t,f,l) _wdupenv_s(ps1,size,s2)..#endif..#endif.

C:\Program Files\Cheat Engine 7.5\include\sec_api\io_s.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	881
Entropy (8bit):	5.049800224685949
Encrypted:	false
SSDEEP:	24:i2PSh0PD5LNUX/uOL3YnNcYDJYwKGUG7FIU9L3YqM:GUZTOL3kSiJyjoL3lM
MD5:	AAF6330564DC2B4B413908EF435956AF
SHA1:	EA59272194493914F4B0CD1375210053A34CFDC2
SHA-256:	6E02F4AE50D30629AF7DF34785B6C32642B12D94ADDD56606F6FC4AB668250FF
SHA-512:	3FD60615B2DFC257A0CACF1F985AF5AA765583DB7DE6B8E474DE52369219DA5D2276362ADD9875A820F0A424A259FE976EBFA1E18FCD7B70008AB8FF70EBA03F
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_IO_S.#define _INC_IO_S..#include <io.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP errno_t __cdecl _access_s(const char _Filename,int _AccessMode);. _CRTIMP errno_t __cdecl _chsize_s(int _FileHandle,__int64 _Size);. _CRTIMP errno_t __cdecl _mktemp_s(char _TemplateName,size_t _Size);. _CRTIMP errno_t __cdecl _umask_s(int _NewMode,int _OldMode);..#ifndef _WIO_S_DEFINED.#define _WIO_S_DEFINED. _CRTIMP errno_t __cdecl _waccess_s(const wchar_t _Filename,int _AccessMode);. _CRTIMP errno_t __cdecl _wmktemp_s(wchar_t _TemplateName,size_t _SizeInWords);.#endif..#ifdef __cplusplus.}.#endif..#endif.#endif.

C:\Program Files\Cheat Engine 7.5\include\sec_api\is-706F4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	881
Entropy (8bit):	5.049800224685949
Encrypted:	false
SSDEEP:	24:i2PSh0PD5LNUX/uOL3YnNcYDJYwKGUG7FIU9L3YqM:GUZTOL3kSiJyjoL3lM
MD5:	AAF6330564DC2B4B413908EF435956AF
SHA1:	EA59272194493914F4B0CD1375210053A34CFDC2
SHA-256:	6E02F4AE50D30629AF7DF34785B6C32642B12D94ADDD56606F6FC4AB668250FF
SHA-512:	3FD60615B2DFC257A0CACF1F985AF5AA765583DB7DE6B8E474DE52369219DA5D2276362ADD9875A820F0A424A259FE976EBFA1E18FCD7B70008AB8FF70EBA03F
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_IO_S.#define _INC_IO_S..#include <io.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP errno_t __cdecl _access_s(const char _Filename,int _AccessMode);. _CRTIMP errno_t __cdecl _chsize_s(int _FileHandle,__int64 _Size);. _CRTIMP errno_t __cdecl _mktemp_s(char _TemplateName,size_t _Size);. _CRTIMP errno_t __cdecl _umask_s(int _NewMode,int _OldMode);..#ifndef _WIO_S_DEFINED.#define _WIO_S_DEFINED. _CRTIMP errno_t __cdecl _waccess_s(const wchar_t _Filename,int _AccessMode);. _CRTIMP errno_t __cdecl _wmktemp_s(wchar_t _TemplateName,size_t _SizeInWords);.#endif..#ifdef __cplusplus.}.#endif..#endif.#endif.

C:\Program Files\Cheat Engine 7.5\include\sec_api\is-7T9K6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	11508
Entropy (8bit):	4.850439541273333
Encrypted:	false
SSDEEP:	192:nzXsE4vla8LmEtTcbA4MfaEU0zwyp0WEP9fF2V:8
MD5:	3C28755C2186DABAE016938E1308B77F
SHA1:	9437B43CD64ED70638DF695B1B9EAB34C1B04F57
SHA-256:	5107BED740C6274FFC767AD42DED6CE5A8F51CB0C73239D04D5A647D62EDF2F1
SHA-512:	9D89FE5E5B8396998A552E443970F45C8E9F2F04F180D14F1CBBDC56A1FD5AE0F2C9F81B8E25D0DCB20FB1437D9BD178A6DAD68A323AA0E9EAEF31B6B6D40F33
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_STDIO_S.#define _INC_STDIO_S..#include <stdio.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _STDIO_S_DEFINED.#define _STDIO_S_DEFINED. _CRTIMP errno_t __cdecl clearerr_s(FILE _File);. int __cdecl fprintf_s(FILE _File,const char _Format,...);. size_t __cdecl fread_s(void _DstBuf,size_t _DstSize,size_t _ElementSize,size_t _Count,FILE _File);. _CRTIMP int __cdecl _fscanf_s_l(FILE _File,const char _Format,_locale_t _Locale,...);. int __cdecl printf_s(const char _Format,...);. _CRTIMP int __cdecl _scanf_l(const char _Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _scanf_s_l(const char _Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _snprintf_s(char _DstBuf,size_t _DstSize,size_t _MaxCount,const char

C:\Program Files\Cheat Engine 7.5\include\sec_api\is-CKLD9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.23907989533424
Encrypted:	false
SSDEEP:	24:i2PSh0PDbldUsxgi7ZmA10jrL8sxqpCTkTAfEjd2FL0:GENuiZmU0jrIhT9jdKA
MD5:	C46DB571CFDB29EA8F977222B4BDA152
SHA1:	727F853FE74015580AE152B7DA8E1958B19FE22B
SHA-256:	B23F0CF79D5455E232D92792E2B2BE38125A02808BC005049367BAB68DA1300B
SHA-512:	747FEFA9B6DC0B5B1DE13ACFFBECCDBD7542A1241DEE3299F584FD08D65EAE8D1814305C44FC5AD580D865CF73AE9A8072F5AD7FD5E8439DE034EE82FD789CA7
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef __STRALIGN_H_S_.#define __STRALIGN_H_S_..#include <stralign.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif..#if !defined(I_X86_) && defined(_WSTRING_S_DEFINED).#if defined(__cplusplus) && defined(_WConst_Return). static __inline PUWSTR ua_wcscpy_s(PUWSTR Destination,size_t DestinationSize,PCUWSTR Source) {. if(WSTR_ALIGNED(Source) && WSTR_ALIGNED(Destination)) return (wcscpy_s((PWSTR)Destination,DestinationSize,(PCWSTR)Source)==0 ? Destination : NULL);. return uaw_wcscpy((PCUWSTR)String,Character);. }.#endif.#endif..#ifdef __cplusplus.}.#endif.#endif.#endif.

C:\Program Files\Cheat Engine 7.5\include\sec_api\is-EEKRH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	461
Entropy (8bit):	5.161018019410615
Encrypted:	false
SSDEEP:	12:UJJISFcShcFP+4BtsYzlAEG2UCqAhEGksdAwED:i2PSh0PDtJLUtNjOqD
MD5:	F0C359A5AA08A907A23D2C0C5AA68E5C
SHA1:	B487788EC6AA32458DF18F6D10F67573DE8FA16E
SHA-256:	03630EE83E7C921446A0790853FCADEB5A308553DD3C4ECDDD568CDA3167C0F1
SHA-512:	71BD41E6BD84BFFE34BEB8EF1B49C63358CB5D8E520972D57046D58E9D9FB6DEAE512E4CF5554337DA2510D6F3AFCD6C6D58124A30C4003F9E3A8F60C2FFA896
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */..#ifndef _INC_CRTDBG_S.#define _INC_CRTDBG_S..#include <crtdbg.h>..#if defined(MINGW_HAS_SECURE_API)..#define _dupenv_s_dbg(ps1,size,s2,t,f,l) _dupenv_s(ps1,size,s2).#define _wdupenv_s_dbg(ps1,size,s2,t,f,l) _wdupenv_s(ps1,size,s2)..#endif..#endif.

C:\Program Files\Cheat Engine 7.5\include\sec_api\is-MVJR7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	2331
Entropy (8bit):	5.0544392912710165
Encrypted:	false
SSDEEP:	48:GcrXMDj5Rqf/Hj57+jJij5NiTiM7AdKCLUJXbfb7SlE6BQ5Sl625a:HrONRqf/HN7+9iNYm+AdKCLUJXbfYE6S
MD5:	EDC9CC4A2A0B921D3167F19D2D162F0B
SHA1:	424E2246A5B852CC80AC043F681A12F4ED95882B
SHA-256:	9AE9CB7A3164AD0093E3887B0CA09BB67498DA51BB44E9BE500B60E72A385DC0
SHA-512:	3C81D4917E9A47307393EA6AF3C6E945F6F6ACC1BAEFA764E500054F84BBAEDDA83B7CCDBAC3A1EC526E389EC7A095B0A6676AE09CEEA63EF1E95B5DE004B018
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _TIME_H__S.#define _TIME_H__S..#include <time.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP errno_t __cdecl _ctime32_s(char _Buf,size_t _SizeInBytes,const __time32_t _Time);. _CRTIMP errno_t __cdecl _gmtime32_s(struct tm _Tm,const __time32_t _Time);. _CRTIMP errno_t __cdecl _localtime32_s(struct tm _Tm,const __time32_t _Time);. _CRTIMP errno_t __cdecl _strdate_s(char _Buf,size_t _SizeInBytes);. _CRTIMP errno_t __cdecl _strtime_s(char _Buf ,size_t _SizeInBytes);.#if _INTEGRAL_MAX_BITS >= 64. _CRTIMP errno_t __cdecl _ctime64_s(char _Buf,size_t _SizeInBytes,const __time64_t _Time);. _CRTIMP errno_t __cdecl _gmtime64_s(struct tm _Tm,const __time64_t _Time);. _CRTIMP errno_t __cdecl _localtime64_s(struct tm _Tm,

C:\Program Files\Cheat Engine 7.5\include\sec_api\is-P9BF9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	3615
Entropy (8bit):	4.86966174138245
Encrypted:	false
SSDEEP:	96:fo/15F1iM17NNse1NNNie16Nw11NNKe1/NNQe1uNO1Yk1gQ1Cs1s2s+w:wdi69Ah
MD5:	EDEDEEC78FA33C84025495013A88BF1A
SHA1:	7CB95B9B6DF8927222625EA101A72389B8A5318F
SHA-256:	D962AB8070958953F48B24C9EA068B345B158237826FB71B9A76D36CF2E8A32B
SHA-512:	B32E7891109560B4DF8BBBD1B3BB6D2ACEC9158C35743EB97A88F3B1237114979057B00ACD2CBB594CB1DB555E5AF5DDCAA610FE13C141A20494CA47319F65B0
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_MBSTRING_S.#define _INC_MBSTRING_S..#include <mbstring.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _MBSTRING_S_DEFINED.#define _MBSTRING_S_DEFINED. _CRTIMP errno_t __cdecl _mbscat_s(unsigned char _Dst,size_t _DstSizeInBytes,const unsigned char _Src);. _CRTIMP errno_t __cdecl _mbscat_s_l(unsigned char _Dst,size_t _DstSizeInBytes,const unsigned char _Src,_locale_t _Locale);. _CRTIMP errno_t __cdecl _mbscpy_s(unsigned char _Dst,size_t _DstSizeInBytes,const unsigned char _Src);. _CRTIMP errno_t __cdecl _mbscpy_s_l(unsigned char _Dst,size_t _DstSizeInBytes,const unsigned char _Src,_locale_t _Locale);. _CRTIMP errno_t __cdecl _mbslwr_s(unsigned char _Str,size_t _SizeInBytes);. _CRTIMP errno_t __cdecl _mbslwr_s_l(

C:\Program Files\Cheat Engine 7.5\include\sec_api\is-PKD7D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	796
Entropy (8bit):	5.075906205009732
Encrypted:	false
SSDEEP:	12:UJJISFcShcFP+4BUksYTAKG2U1OAb9vw4DRWJKRWFoY2j9vw4DRWJKRW5:i2PSh0PDxjdUpbpw4NWIWFepw4NWIW5
MD5:	E0C3256D4BE1AD2A506755EB847C2D39
SHA1:	236108EEED6AFC8156950DAE94A055B90F8D169E
SHA-256:	96174E09F1C573C7FAEA85A6D568225A1B946E133C6C04A7BD6AA865C58896A2
SHA-512:	501E4C147ABA8CC08D3195BBA9328D3ED6186E8BFE60EF4DE65F09441F708ABDAAC9D7ED4C84CCD4CE21075F45D0C8B60B2BF8A927AD8A449C11EF6B2711032A
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_SEARCH_S.#define _INC_SEARCH_S..#include <search.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP void __cdecl _lfind_s(const void _Key,const void _Base,unsigned int _NumOfElements,size_t _SizeOfElements,int (__cdecl _PtFuncCompare)(void ,const void ,const void ),void _Context);. _CRTIMP void __cdecl _lsearch_s(const void _Key,void _Base,unsigned int _NumOfElements,size_t _SizeOfElements,int (__cdecl _PtFuncCompare)(void ,const void ,const void ),void *_Context);..#ifdef __cplusplus.}.#endif..#endif.#endif.

C:\Program Files\Cheat Engine 7.5\include\sec_api\is-PU1PA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	4113
Entropy (8bit):	5.025747893872523
Encrypted:	false
SSDEEP:	96:1ICzd9hzhSzms1NOsG1/zl1EzQm2pppJptakhplumHNNmeN4mfNaAqk58ikTNBkm:tp9hFS6s1gsiB3fnjhTVS24Y4LN
MD5:	AE13BD6218C4840EACAC71F31C45B2BC
SHA1:	E05D796CE8F5AEAA629CA9F1E3F6D4AC154148A2
SHA-256:	8650E34BE241C7D837433126878EB6A30EE71C0B759C23671FD8F0715C7CDE65
SHA-512:	689808A64C20260F3091E94DCE6EAABF8662BA627B4DE4C43ED685390565186E69FF229CB4755E9D3BD12B5C46E16CCFD848652703572E790DF7BBAB3824FF9A
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_STDLIB_S.#define _INC_STDLIB_S..#include <stdlib.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP errno_t __cdecl _dupenv_s(char _PBuffer,size_t _PBufferSizeInBytes,const char _VarName);. _CRTIMP errno_t __cdecl _itoa_s(int _Value,char _DstBuf,size_t _Size,int _Radix);.#if _INTEGRAL_MAX_BITS >= 64. _CRTIMP errno_t __cdecl _i64toa_s(__int64 _Val,char _DstBuf,size_t _Size,int _Radix);. _CRTIMP errno_t __cdecl _ui64toa_s(unsigned __int64 _Val,char _DstBuf,size_t _Size,int _Radix);.#endif. _CRTIMP errno_t __cdecl _ltoa_s(long _Val,char _DstBuf,size_t _Size,int _Radix);. _CRTIMP errno_t __cdecl mbstowcs_s(size_t _PtNumOfCharConverted,wchar_t _DstBuf,size_t _SizeInWords,const char _SrcBuf,size_t _MaxCount);. _CRTI

C:\Program Files\Cheat Engine 7.5\include\sec_api\is-S8NHP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	7492
Entropy (8bit):	5.001674571619953
Encrypted:	false
SSDEEP:	96:2s3ligWmjN2JcabAOrco1/x+pxJrx8NxDhW21TUSBL/jCh3HzTxpppJptakhplFY:lUEU0zwyx3fnjhTtj7P9AJbfYFa
MD5:	37C52897CBB44A15BD22203CF8882566
SHA1:	27A8F810ADB10BCFD84DB971163C98ED81C3BDF9
SHA-256:	5A470AC358B2D951202182F9EC1F945331C23A8D79629AD4EDB08B7D73CFAEE4
SHA-512:	5217C9246A458EAB5657B219D136CEC221EF0539CB5C5D02BF9E1FE88159A758B247E2D925312636AA8BE4665B9D52641A9D3F2613256C3FF88985ED1D50CA05
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_WCHAR_S.#define _INC_WCHAR_S..#include <wchar.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _WIO_S_DEFINED.#define _WIO_S_DEFINED. _CRTIMP errno_t __cdecl _waccess_s(const wchar_t _Filename,int _AccessMode);. _CRTIMP errno_t __cdecl _wmktemp_s(wchar_t _TemplateName,size_t _SizeInWords);.#endif..#ifndef _WCONIO_S_DEFINED.#define _WCONIO_S_DEFINED. _CRTIMP errno_t __cdecl _cgetws_s(wchar_t _Buffer,size_t _SizeInWords,size_t _SizeRead);. _CRTIMP int __cdecl _cwprintf_s(const wchar_t _Format,...);. _CRTIMP int __cdecl _cwscanf_s(const wchar_t _Format,...);. _CRTIMP int __cdecl _cwscanf_s_l(const wchar_t _Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _vcwprintf_s(const wchar_t *_Format,va_list _ArgList);. _C

C:\Program Files\Cheat Engine 7.5\include\sec_api\is-TSDM9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	1535
Entropy (8bit):	5.005173947475632
Encrypted:	false
SSDEEP:	24:i2PSh0PDp5BUXLjIT0Cn0jIn0jQsY0eq0DY0PdMR0Mk3Z0ln0ln0fKY0xq0CY0u+:G4X+j41n8In8QsYbqgYKd00x+nknmKY1
MD5:	5BC78AA26AF6CE836F322CD5A432E368
SHA1:	1E99298161F0ADB4F7244EB5A067364DC5B47E91
SHA-256:	F7375E816739491FBAB39531C1D60A77B78FF9A162ABA17F817C773BF75F6508
SHA-512:	F1BFD5EF34A97E72EC474B2A2FECF4AC5FA1931E08845489623A7C699954B549FEDE1E4F93C815C0A9944A7D79601A9ED1342D47694528DAB54ADEAA5BBAB443
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /..#ifndef _INC_CONIO_S.#define _INC_CONIO_S..#include <conio.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP errno_t __cdecl _cgets_s(char _Buffer,size_t _Size,size_t _SizeRead);. _CRTIMP int __cdecl _cprintf_s(const char _Format,...);. _CRTIMP int __cdecl _cscanf_s(const char _Format,...);. _CRTIMP int __cdecl _cscanf_s_l(const char _Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _vcprintf_s(const char _Format,va_list _ArgList);. _CRTIMP int __cdecl _cprintf_s_l(const char _Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _vcprintf_s_l(const char _Format,_locale_t _Locale,va_list _ArgList);..#ifndef _WCONIO_DEFINED_S.#define _WCONIO_DEFINED_S. _CRTIMP errno_t __cdecl _cgetws_s(wchar_t _Buffer,size_t _SizeInWords,

C:\Program Files\Cheat Engine 7.5\include\sec_api\is-U65KB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	4.917564903414643
Encrypted:	false
SSDEEP:	48:GdhfZfj5LsD61nVtwNwDmwMRTNU5bTTwNTrbTy7TZe1TGdTt8u:QZZfNLsD61V+NwDmw0hUZgNnbu71e1a9
MD5:	544899F39CA616AE07D97A2FEE8DE3D4
SHA1:	2F95831D27CC918E633E8D711087CCF7C3DA918B
SHA-256:	EEF32FB505B98A3610923E8DDB3DE724C55B44389D25CEF7CF50EE3CD14F5D68
SHA-512:	20DBF6C25FF2270402BB4EB99430B83128F66D577B7C9277CACBF8CDB5438EC58B6B1EA468499D1F48338CF4F2433A1A0E59E242F812B419C6AFC637340C86AB
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_STRING_S.#define _INC_STRING_S..#include <string.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP errno_t __cdecl _strset_s(char _Dst,size_t _DstSize,int _Value);. _CRTIMP errno_t __cdecl _strerror_s(char _Buf,size_t _SizeInBytes,const char _ErrMsg);. _CRTIMP errno_t __cdecl _strlwr_s(char _Str,size_t _Size);. _CRTIMP errno_t __cdecl _strlwr_s_l(char _Str,size_t _Size,_locale_t _Locale);. _CRTIMP errno_t __cdecl _strnset_s(char _Str,size_t _Size,int _Val,size_t _MaxCount);. _CRTIMP errno_t __cdecl _strupr_s(char _Str,size_t _Size);. _CRTIMP errno_t __cdecl _strupr_s_l(char _Str,size_t _Size,_locale_t _Locale);.#ifndef _WSTRING_S_DEFINED.#define _WSTRING_S_DEFINED. _CRTIMP wchar_t __cdecl wcstok_s(wchar_t *_St

C:\Program Files\Cheat Engine 7.5\include\sec_api\is-VB57V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	8328
Entropy (8bit):	4.549418379824187
Encrypted:	false
SSDEEP:	96:bQGkyRvKPf4e80QgHRySdrCcNNXe1FcNNFe1d6O1yv61ycNNue1ccNNYe1e1O1e3:c11WgJ17OBBapWcEqJ
MD5:	1C3243D5951CCF4C4007E89FD366631D
SHA1:	48FE81CEA21230097C39FFC92C9B5BCAB3B4D0B1
SHA-256:	A5318CCEB241962769169C32A3CE5BFB9A075A52EDBAC31AAD33B0D7B897B544
SHA-512:	F6D25B5532745933F4320280AC21DD02CD12872639333B3AD04F4EFBBB42CFE51F5AD828F6CB2134968F5503979029AC38AD208572AD3FD298BDCC97677ECEDD
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_TCHAR_S.#define _INC_TCHAR_S..#include <tchar.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif..#ifdef _UNICODE..#define _tprintf_s wprintf_s.#define _tprintf_s_l _wprintf_s_l.#define _tcprintf_s _cwprintf_s.#define _tcprintf_s_l _cwprintf_s_l.#define _vtcprintf_s _vcwprintf_s.#define _vtcprintf_s_l _vcwprintf_s_l.#define _ftprintf_s fwprintf_s.#define _ftprintf_s_l _fwprintf_s_l.#define _stprintf_s swprintf_s.#define _stprintf_s_l _swprintf_s_l.#define _sntprintf_s _snwprintf_s.#define _sntprintf_s_l _snwprintf_s_l.#define _vtprintf_s vwprintf_s.#define _vtprintf_s_l _vwprintf_s_l.#define _vftprintf_s vfwprintf_s.#define _vftprintf_s_l _vfwprintf_s_l.#define _vstprintf_s vswprintf_s.#define _vstprintf_s_l _vswprintf_s_l.#define _vsntp

C:\Program Files\Cheat Engine 7.5\include\sec_api\mbstring_s.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	3615
Entropy (8bit):	4.86966174138245
Encrypted:	false
SSDEEP:	96:fo/15F1iM17NNse1NNNie16Nw11NNKe1/NNQe1uNO1Yk1gQ1Cs1s2s+w:wdi69Ah
MD5:	EDEDEEC78FA33C84025495013A88BF1A
SHA1:	7CB95B9B6DF8927222625EA101A72389B8A5318F
SHA-256:	D962AB8070958953F48B24C9EA068B345B158237826FB71B9A76D36CF2E8A32B
SHA-512:	B32E7891109560B4DF8BBBD1B3BB6D2ACEC9158C35743EB97A88F3B1237114979057B00ACD2CBB594CB1DB555E5AF5DDCAA610FE13C141A20494CA47319F65B0
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_MBSTRING_S.#define _INC_MBSTRING_S..#include <mbstring.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _MBSTRING_S_DEFINED.#define _MBSTRING_S_DEFINED. _CRTIMP errno_t __cdecl _mbscat_s(unsigned char _Dst,size_t _DstSizeInBytes,const unsigned char _Src);. _CRTIMP errno_t __cdecl _mbscat_s_l(unsigned char _Dst,size_t _DstSizeInBytes,const unsigned char _Src,_locale_t _Locale);. _CRTIMP errno_t __cdecl _mbscpy_s(unsigned char _Dst,size_t _DstSizeInBytes,const unsigned char _Src);. _CRTIMP errno_t __cdecl _mbscpy_s_l(unsigned char _Dst,size_t _DstSizeInBytes,const unsigned char _Src,_locale_t _Locale);. _CRTIMP errno_t __cdecl _mbslwr_s(unsigned char _Str,size_t _SizeInBytes);. _CRTIMP errno_t __cdecl _mbslwr_s_l(

C:\Program Files\Cheat Engine 7.5\include\sec_api\search_s.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	796
Entropy (8bit):	5.075906205009732
Encrypted:	false
SSDEEP:	12:UJJISFcShcFP+4BUksYTAKG2U1OAb9vw4DRWJKRWFoY2j9vw4DRWJKRW5:i2PSh0PDxjdUpbpw4NWIWFepw4NWIW5
MD5:	E0C3256D4BE1AD2A506755EB847C2D39
SHA1:	236108EEED6AFC8156950DAE94A055B90F8D169E
SHA-256:	96174E09F1C573C7FAEA85A6D568225A1B946E133C6C04A7BD6AA865C58896A2
SHA-512:	501E4C147ABA8CC08D3195BBA9328D3ED6186E8BFE60EF4DE65F09441F708ABDAAC9D7ED4C84CCD4CE21075F45D0C8B60B2BF8A927AD8A449C11EF6B2711032A
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_SEARCH_S.#define _INC_SEARCH_S..#include <search.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP void __cdecl _lfind_s(const void _Key,const void _Base,unsigned int _NumOfElements,size_t _SizeOfElements,int (__cdecl _PtFuncCompare)(void ,const void ,const void ),void _Context);. _CRTIMP void __cdecl _lsearch_s(const void _Key,void _Base,unsigned int _NumOfElements,size_t _SizeOfElements,int (__cdecl _PtFuncCompare)(void ,const void ,const void ),void *_Context);..#ifdef __cplusplus.}.#endif..#endif.#endif.

C:\Program Files\Cheat Engine 7.5\include\sec_api\stdio_s.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	11508
Entropy (8bit):	4.850439541273333
Encrypted:	false
SSDEEP:	192:nzXsE4vla8LmEtTcbA4MfaEU0zwyp0WEP9fF2V:8
MD5:	3C28755C2186DABAE016938E1308B77F
SHA1:	9437B43CD64ED70638DF695B1B9EAB34C1B04F57
SHA-256:	5107BED740C6274FFC767AD42DED6CE5A8F51CB0C73239D04D5A647D62EDF2F1
SHA-512:	9D89FE5E5B8396998A552E443970F45C8E9F2F04F180D14F1CBBDC56A1FD5AE0F2C9F81B8E25D0DCB20FB1437D9BD178A6DAD68A323AA0E9EAEF31B6B6D40F33
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_STDIO_S.#define _INC_STDIO_S..#include <stdio.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _STDIO_S_DEFINED.#define _STDIO_S_DEFINED. _CRTIMP errno_t __cdecl clearerr_s(FILE _File);. int __cdecl fprintf_s(FILE _File,const char _Format,...);. size_t __cdecl fread_s(void _DstBuf,size_t _DstSize,size_t _ElementSize,size_t _Count,FILE _File);. _CRTIMP int __cdecl _fscanf_s_l(FILE _File,const char _Format,_locale_t _Locale,...);. int __cdecl printf_s(const char _Format,...);. _CRTIMP int __cdecl _scanf_l(const char _Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _scanf_s_l(const char _Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _snprintf_s(char _DstBuf,size_t _DstSize,size_t _MaxCount,const char

C:\Program Files\Cheat Engine 7.5\include\sec_api\stdlib_s.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	4113
Entropy (8bit):	5.025747893872523
Encrypted:	false
SSDEEP:	96:1ICzd9hzhSzms1NOsG1/zl1EzQm2pppJptakhplumHNNmeN4mfNaAqk58ikTNBkm:tp9hFS6s1gsiB3fnjhTVS24Y4LN
MD5:	AE13BD6218C4840EACAC71F31C45B2BC
SHA1:	E05D796CE8F5AEAA629CA9F1E3F6D4AC154148A2
SHA-256:	8650E34BE241C7D837433126878EB6A30EE71C0B759C23671FD8F0715C7CDE65
SHA-512:	689808A64C20260F3091E94DCE6EAABF8662BA627B4DE4C43ED685390565186E69FF229CB4755E9D3BD12B5C46E16CCFD848652703572E790DF7BBAB3824FF9A
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_STDLIB_S.#define _INC_STDLIB_S..#include <stdlib.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP errno_t __cdecl _dupenv_s(char _PBuffer,size_t _PBufferSizeInBytes,const char _VarName);. _CRTIMP errno_t __cdecl _itoa_s(int _Value,char _DstBuf,size_t _Size,int _Radix);.#if _INTEGRAL_MAX_BITS >= 64. _CRTIMP errno_t __cdecl _i64toa_s(__int64 _Val,char _DstBuf,size_t _Size,int _Radix);. _CRTIMP errno_t __cdecl _ui64toa_s(unsigned __int64 _Val,char _DstBuf,size_t _Size,int _Radix);.#endif. _CRTIMP errno_t __cdecl _ltoa_s(long _Val,char _DstBuf,size_t _Size,int _Radix);. _CRTIMP errno_t __cdecl mbstowcs_s(size_t _PtNumOfCharConverted,wchar_t _DstBuf,size_t _SizeInWords,const char _SrcBuf,size_t _MaxCount);. _CRTI

C:\Program Files\Cheat Engine 7.5\include\sec_api\stralign_s.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	824
Entropy (8bit):	5.23907989533424
Encrypted:	false
SSDEEP:	24:i2PSh0PDbldUsxgi7ZmA10jrL8sxqpCTkTAfEjd2FL0:GENuiZmU0jrIhT9jdKA
MD5:	C46DB571CFDB29EA8F977222B4BDA152
SHA1:	727F853FE74015580AE152B7DA8E1958B19FE22B
SHA-256:	B23F0CF79D5455E232D92792E2B2BE38125A02808BC005049367BAB68DA1300B
SHA-512:	747FEFA9B6DC0B5B1DE13ACFFBECCDBD7542A1241DEE3299F584FD08D65EAE8D1814305C44FC5AD580D865CF73AE9A8072F5AD7FD5E8439DE034EE82FD789CA7
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef __STRALIGN_H_S_.#define __STRALIGN_H_S_..#include <stralign.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif..#if !defined(I_X86_) && defined(_WSTRING_S_DEFINED).#if defined(__cplusplus) && defined(_WConst_Return). static __inline PUWSTR ua_wcscpy_s(PUWSTR Destination,size_t DestinationSize,PCUWSTR Source) {. if(WSTR_ALIGNED(Source) && WSTR_ALIGNED(Destination)) return (wcscpy_s((PWSTR)Destination,DestinationSize,(PCWSTR)Source)==0 ? Destination : NULL);. return uaw_wcscpy((PCUWSTR)String,Character);. }.#endif.#endif..#ifdef __cplusplus.}.#endif.#endif.#endif.

C:\Program Files\Cheat Engine 7.5\include\sec_api\string_s.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	4.917564903414643
Encrypted:	false
SSDEEP:	48:GdhfZfj5LsD61nVtwNwDmwMRTNU5bTTwNTrbTy7TZe1TGdTt8u:QZZfNLsD61V+NwDmw0hUZgNnbu71e1a9
MD5:	544899F39CA616AE07D97A2FEE8DE3D4
SHA1:	2F95831D27CC918E633E8D711087CCF7C3DA918B
SHA-256:	EEF32FB505B98A3610923E8DDB3DE724C55B44389D25CEF7CF50EE3CD14F5D68
SHA-512:	20DBF6C25FF2270402BB4EB99430B83128F66D577B7C9277CACBF8CDB5438EC58B6B1EA468499D1F48338CF4F2433A1A0E59E242F812B419C6AFC637340C86AB
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_STRING_S.#define _INC_STRING_S..#include <string.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP errno_t __cdecl _strset_s(char _Dst,size_t _DstSize,int _Value);. _CRTIMP errno_t __cdecl _strerror_s(char _Buf,size_t _SizeInBytes,const char _ErrMsg);. _CRTIMP errno_t __cdecl _strlwr_s(char _Str,size_t _Size);. _CRTIMP errno_t __cdecl _strlwr_s_l(char _Str,size_t _Size,_locale_t _Locale);. _CRTIMP errno_t __cdecl _strnset_s(char _Str,size_t _Size,int _Val,size_t _MaxCount);. _CRTIMP errno_t __cdecl _strupr_s(char _Str,size_t _Size);. _CRTIMP errno_t __cdecl _strupr_s_l(char _Str,size_t _Size,_locale_t _Locale);.#ifndef _WSTRING_S_DEFINED.#define _WSTRING_S_DEFINED. _CRTIMP wchar_t __cdecl wcstok_s(wchar_t *_St

C:\Program Files\Cheat Engine 7.5\include\sec_api\sys\is-N2NHS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.082827078744625
Encrypted:	false
SSDEEP:	12:UJJISFcShcFP+4BjksvAEfG2U17NrOmRyOmRpILKuhQziQFgu7voLKuhNzia:i2PSh0PDjkcTUhNCQR8RAj
MD5:	001FD701688E91D3781D43714B993275
SHA1:	A1825995271FE96DC766421CEDC606384CD92201
SHA-256:	D153417EC64EB7B1504749BCA6477EFD51B4B22DE670518F4FDC2701080145C0
SHA-512:	F4F4A8D796E74CB0AD2A06DD153EBAF4CD16C431FDC67B7C2FBBDC4466147593421AE0F60A620503B21DC3C05C6480CA483BD077AFB10DACA46529996B4391B6
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /..#ifndef _TIMEB_H_S.#define _TIMEB_H_S..#include <sys/timeb.h>..#ifdef __cplusplus.extern "C" {.#endif..#if defined(MINGW_HAS_SECURE_API)..#ifdef _USE_32BIT_TIME_T.#define _ftime_s _ftime32_s.#else.#define _ftime_s _ftime64_s.#endif.. _CRTIMP errno_t __cdecl _ftime32_s(struct __timeb32 _Time);.#if _INTEGRAL_MAX_BITS >= 64. _CRTIMP errno_t __cdecl _ftime64_s(struct __timeb64 *_Time);.#endif.#endif..#ifdef __cplusplus.}.#endif..#endif.

C:\Program Files\Cheat Engine 7.5\include\sec_api\sys\timeb_s.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.082827078744625
Encrypted:	false
SSDEEP:	12:UJJISFcShcFP+4BjksvAEfG2U17NrOmRyOmRpILKuhQziQFgu7voLKuhNzia:i2PSh0PDjkcTUhNCQR8RAj
MD5:	001FD701688E91D3781D43714B993275
SHA1:	A1825995271FE96DC766421CEDC606384CD92201
SHA-256:	D153417EC64EB7B1504749BCA6477EFD51B4B22DE670518F4FDC2701080145C0
SHA-512:	F4F4A8D796E74CB0AD2A06DD153EBAF4CD16C431FDC67B7C2FBBDC4466147593421AE0F60A620503B21DC3C05C6480CA483BD077AFB10DACA46529996B4391B6
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /..#ifndef _TIMEB_H_S.#define _TIMEB_H_S..#include <sys/timeb.h>..#ifdef __cplusplus.extern "C" {.#endif..#if defined(MINGW_HAS_SECURE_API)..#ifdef _USE_32BIT_TIME_T.#define _ftime_s _ftime32_s.#else.#define _ftime_s _ftime64_s.#endif.. _CRTIMP errno_t __cdecl _ftime32_s(struct __timeb32 _Time);.#if _INTEGRAL_MAX_BITS >= 64. _CRTIMP errno_t __cdecl _ftime64_s(struct __timeb64 *_Time);.#endif.#endif..#ifdef __cplusplus.}.#endif..#endif.

C:\Program Files\Cheat Engine 7.5\include\sec_api\tchar_s.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	8328
Entropy (8bit):	4.549418379824187
Encrypted:	false
SSDEEP:	96:bQGkyRvKPf4e80QgHRySdrCcNNXe1FcNNFe1d6O1yv61ycNNue1ccNNYe1e1O1e3:c11WgJ17OBBapWcEqJ
MD5:	1C3243D5951CCF4C4007E89FD366631D
SHA1:	48FE81CEA21230097C39FFC92C9B5BCAB3B4D0B1
SHA-256:	A5318CCEB241962769169C32A3CE5BFB9A075A52EDBAC31AAD33B0D7B897B544
SHA-512:	F6D25B5532745933F4320280AC21DD02CD12872639333B3AD04F4EFBBB42CFE51F5AD828F6CB2134968F5503979029AC38AD208572AD3FD298BDCC97677ECEDD
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_TCHAR_S.#define _INC_TCHAR_S..#include <tchar.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif..#ifdef _UNICODE..#define _tprintf_s wprintf_s.#define _tprintf_s_l _wprintf_s_l.#define _tcprintf_s _cwprintf_s.#define _tcprintf_s_l _cwprintf_s_l.#define _vtcprintf_s _vcwprintf_s.#define _vtcprintf_s_l _vcwprintf_s_l.#define _ftprintf_s fwprintf_s.#define _ftprintf_s_l _fwprintf_s_l.#define _stprintf_s swprintf_s.#define _stprintf_s_l _swprintf_s_l.#define _sntprintf_s _snwprintf_s.#define _sntprintf_s_l _snwprintf_s_l.#define _vtprintf_s vwprintf_s.#define _vtprintf_s_l _vwprintf_s_l.#define _vftprintf_s vfwprintf_s.#define _vftprintf_s_l _vfwprintf_s_l.#define _vstprintf_s vswprintf_s.#define _vstprintf_s_l _vswprintf_s_l.#define _vsntp

C:\Program Files\Cheat Engine 7.5\include\sec_api\time_s.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	2331
Entropy (8bit):	5.0544392912710165
Encrypted:	false
SSDEEP:	48:GcrXMDj5Rqf/Hj57+jJij5NiTiM7AdKCLUJXbfb7SlE6BQ5Sl625a:HrONRqf/HN7+9iNYm+AdKCLUJXbfYE6S
MD5:	EDC9CC4A2A0B921D3167F19D2D162F0B
SHA1:	424E2246A5B852CC80AC043F681A12F4ED95882B
SHA-256:	9AE9CB7A3164AD0093E3887B0CA09BB67498DA51BB44E9BE500B60E72A385DC0
SHA-512:	3C81D4917E9A47307393EA6AF3C6E945F6F6ACC1BAEFA764E500054F84BBAEDDA83B7CCDBAC3A1EC526E389EC7A095B0A6676AE09CEEA63EF1E95B5DE004B018
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _TIME_H__S.#define _TIME_H__S..#include <time.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif.. _CRTIMP errno_t __cdecl _ctime32_s(char _Buf,size_t _SizeInBytes,const __time32_t _Time);. _CRTIMP errno_t __cdecl _gmtime32_s(struct tm _Tm,const __time32_t _Time);. _CRTIMP errno_t __cdecl _localtime32_s(struct tm _Tm,const __time32_t _Time);. _CRTIMP errno_t __cdecl _strdate_s(char _Buf,size_t _SizeInBytes);. _CRTIMP errno_t __cdecl _strtime_s(char _Buf ,size_t _SizeInBytes);.#if _INTEGRAL_MAX_BITS >= 64. _CRTIMP errno_t __cdecl _ctime64_s(char _Buf,size_t _SizeInBytes,const __time64_t _Time);. _CRTIMP errno_t __cdecl _gmtime64_s(struct tm _Tm,const __time64_t _Time);. _CRTIMP errno_t __cdecl _localtime64_s(struct tm _Tm,

C:\Program Files\Cheat Engine 7.5\include\sec_api\wchar_s.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	7492
Entropy (8bit):	5.001674571619953
Encrypted:	false
SSDEEP:	96:2s3ligWmjN2JcabAOrco1/x+pxJrx8NxDhW21TUSBL/jCh3HzTxpppJptakhplFY:lUEU0zwyx3fnjhTtj7P9AJbfYFa
MD5:	37C52897CBB44A15BD22203CF8882566
SHA1:	27A8F810ADB10BCFD84DB971163C98ED81C3BDF9
SHA-256:	5A470AC358B2D951202182F9EC1F945331C23A8D79629AD4EDB08B7D73CFAEE4
SHA-512:	5217C9246A458EAB5657B219D136CEC221EF0539CB5C5D02BF9E1FE88159A758B247E2D925312636AA8BE4665B9D52641A9D3F2613256C3FF88985ED1D50CA05
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_WCHAR_S.#define _INC_WCHAR_S..#include <wchar.h>..#if defined(MINGW_HAS_SECURE_API)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _WIO_S_DEFINED.#define _WIO_S_DEFINED. _CRTIMP errno_t __cdecl _waccess_s(const wchar_t _Filename,int _AccessMode);. _CRTIMP errno_t __cdecl _wmktemp_s(wchar_t _TemplateName,size_t _SizeInWords);.#endif..#ifndef _WCONIO_S_DEFINED.#define _WCONIO_S_DEFINED. _CRTIMP errno_t __cdecl _cgetws_s(wchar_t _Buffer,size_t _SizeInWords,size_t _SizeRead);. _CRTIMP int __cdecl _cwprintf_s(const wchar_t _Format,...);. _CRTIMP int __cdecl _cwscanf_s(const wchar_t _Format,...);. _CRTIMP int __cdecl _cwscanf_s_l(const wchar_t _Format,_locale_t _Locale,...);. _CRTIMP int __cdecl _vcwprintf_s(const wchar_t *_Format,va_list _ArgList);. _C

C:\Program Files\Cheat Engine 7.5\include\setjmp.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	3867
Entropy (8bit):	5.235190435579294
Encrypted:	false
SSDEEP:	96:hINzkdpqiPK62I7m503BDSX92h1Mjw9dQZOpxrW7qcvshO+RgA2CRu/PXOE:hINzkdpqiPKdI7m503FSXUhOjw9Fpxrs
MD5:	8BF97DC43B347CBCF622768EF43090EF
SHA1:	E6BE2C1B1FE50C19BCD2814E3827C7D94680E51B
SHA-256:	B6164EB7FAE4A12163251492F7F4E56CC50D146EC7A2F5640D86ECA4D095046F
SHA-512:	F2F1A16A1D719B10A20B8BE8B5046E151C50792D8D07A2E7F6BC8EB0D53FFCE7E66E53934E688FD1C3FDFE00545BF203267FB59CBD289AD92F3786E473F8198F
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_SETJMP.#define _INC_SETJMP..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#if (defined(_X86_) && !defined(__x86_64))..#define _JBLEN 16.#define _JBTYPE int.. typedef struct __JUMP_BUFFER {. unsigned long Ebp;. unsigned long Ebx;. unsigned long Edi;. unsigned long Esi;. unsigned long Esp;. unsigned long Eip;. unsigned long Registration;. unsigned long TryLevel;. unsigned long Cookie;. unsigned long UnwindFunc;. unsigned long UnwindData[6];. } _JUMP_BUFFER;.#elif defined(__ia64__). typedef _CRT_ALIGN(16) struct _SETJMP_FLOAT128 {. __int64 LowPart;. __int64 HighPart;. } SETJMP_FLOAT128;..#define _JBLEN 33. typedef SETJMP_FLOAT128 _JBTYPE;.. typedef struct __JUMP_BUFFER {..

C:\Program Files\Cheat Engine 7.5\include\share.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	639
Entropy (8bit):	5.116570644892466
Encrypted:	false
SSDEEP:	12:UJJISFcShcFP+4BWIYKIiSUfwfvarry9rowrrqir3qGr+PFeHqveB7n4y8yvkA4p:i2PSh0PDWWIivavaq98whzlgFeHqve7u
MD5:	540EF403878DDBE2D4682540DA20095F
SHA1:	4E3230DF4B7A906CDC3B6E3E1A5CC768CC79C327
SHA-256:	6DE922C1BD7EEDC33308304785C212945064D763EEDFB373C09CBBB5CB933DDE
SHA-512:	7C27842CB6F3D2B9707A5DF55B45BCC5DD613CDA8C550F0232F0CB9DF8B59013F428EC3FC07FB002DFF80D26BB9941CE76CAADD22BD4B539C9F11EA13FE12EF5
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_SHARE.#define _INC_SHARE..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#define _SH_COMPAT 0x00.#define _SH_DENYRW 0x10.#define _SH_DENYWR 0x20.#define _SH_DENYRD 0x30.#define _SH_DENYNO 0x40.#define _SH_SECURE 0x80..#ifndef.NO_OLDNAMES.#define SH_COMPAT _SH_COMPAT.#define SH_DENYRW _SH_DENYRW.#define SH_DENYWR _SH_DENYWR.#define SH_DENYRD _SH_DENYRD.#define SH_DENYNO _SH_DENYNO.#endif..#endif.

C:\Program Files\Cheat Engine 7.5\include\signal.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	5.223946000134317
Encrypted:	false
SSDEEP:	24:i2PSh0PDPvH5BolYl9cEPXEDv5JOhS3zDOE/MVuTYE3tmV+Rv4fMBzN80FnPibwB:GWcqvvsDNzD9koS+94fQzN8OPibwDrhT
MD5:	A106C85866BF88A68510029349149B52
SHA1:	989F8BF922CAC5BEB03905A0E35C3C7B4B125C85
SHA-256:	045A031B376733ED7A685BC01709F5281403729FF7C601B913B2ACA2FE1493BB
SHA-512:	205611A36897D5A87EB54DA5C2C193680DAD95DDA01A55DCEF61665ED09EFD322A20F276D9419A64144941CF0B59339FF9D15C1A7A9C86DA60F140364EACFF73
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_SIGNAL.#define _INC_SIGNAL..#include <_mingw.h>..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _SIG_ATOMIC_T_DEFINED.#define _SIG_ATOMIC_T_DEFINED. typedef int sig_atomic_t;.#endif..#define NSIG 23..#define.SIGHUP.1./ hangup /.#define SIGINT 2.#define.SIGQUIT.3./ quit /.#define SIGILL 4.#define.SIGTRAP.5./ trace trap (not reset when caught) /.#define.SIGIOT.6./ IOT instruction /.#define.SIGABRT 6./ used by abort, replace SIGIOT in the future /.#define.SIGEMT.7./ EMT instruction /.#define SIGFPE 8.#define.SIGKILL.9./ kill (cannot be caught or ignored) /.#define.SIGBUS.10./ bus error /.#define SIGSEGV 11.#define.SIGSYS.12./ bad argument to system call /.#define.SIGPIPE.13./ write on a pipe with no one to read it */.#ifdef __USE_MINGW_ALARM.#def

C:\Program Files\Cheat Engine 7.5\include\stdarg.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	2494
Entropy (8bit):	4.862990168468474
Encrypted:	false
SSDEEP:	48:QAs3d3qmP8lV0TTPWuj/ATVhpIOFf6yrsEgTvVOFobil:QAGdafP0P/IiA
MD5:	4FE6BA37DEC896AB822646118B5343CE
SHA1:	EA68660748139159643AB495AA1EC9287A5E20FF
SHA-256:	116504A7C3FEABBC4551E9DB0BEC957170647EF2067EB46A4304BCBFDDCE5A30
SHA-512:	6B3304630293A2A5C1D4870B088A7FA2681354A4D28D6DFD97CDA16E102D6E97A19CB5C9A840C8587479E4A559AB3EE781F1E9001F1336C9318988B1F2F22CC7
Malicious:	false
Preview:	#ifndef _STDARG_H.#define _STDARG_H..#ifdef __x86_64__.#ifndef _WIN64..//This should be in sync with the declaration on our lib/libtcc1.c./* GCC compatible definition of va_list. /.typedef struct {. unsigned int gp_offset;. unsigned int fp_offset;. union {. unsigned int overflow_offset;. char overflow_arg_area;. };. char reg_save_area;.} __va_list_struct;..typedef __va_list_struct va_list[1];..void __va_start(__va_list_struct ap, void fp);.void __va_arg(__va_list_struct ap, int arg_type, int size, int align);..#define va_start(ap, last) __va_start(ap, __builtin_frame_address(0)).#define va_arg(ap, type) \. ((type )(__va_arg(ap, __builtin_va_arg_types(type), sizeof(type), __alignof__(type)))).#define va_copy(dest, src) ((dest) = (src)).#define va_end(ap)../ avoid conflicting definition for va_list on Macs. /.#define _VA_LIST_T..#else / _WIN64 /.typedef char va_list;.#define va_start(ap,last) _

C:\Program Files\Cheat Engine 7.5\include\stdbool.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	176
Entropy (8bit):	4.607652660491414
Encrypted:	false
SSDEEP:	3:YDC60AhCWNRSh4Hf9OKhW70rAcM05eB70AUrEtvQ7DM0zU2kx4Cv:mp0AnRoCkKu0McM0sF0AUn7f4Tv
MD5:	7D294F4EC2C9640974803A61153EF3DD
SHA1:	3BC244518F863B754A97CA1B756580974C0D4356
SHA-256:	5252824225DDC486B0460677F765E4157AF5D3ED7ACD65B310A4045EAFB56AF7
SHA-512:	FF09177DCD695A185D66AFA8405EB7BF0883D4C1E6507F00A12CD958562E2F0444867F6DABDEE6E50CD5977897E4D878F31CB51888BA6878829C96CBF80FB283
Malicious:	false
Preview:	#ifndef _STDBOOL_H.#define _STDBOOL_H../* ISOC99 boolean /..#define bool._Bool.#define true.1.#define false.0.#define __bool_true_false_are_defined 1..#endif / _STDBOOL_H */.

C:\Program Files\Cheat Engine 7.5\include\stddef.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	1402
Entropy (8bit):	4.8724440555000506
Encrypted:	false
SSDEEP:	24:d19VSrcs/mbR/4Cm+iOwHCFFfJNn9DAP6V2OCB6E7LuNcWmY/CDGAsC:5VSrH/TCeCFD59DGJUEnhzY/6GA9
MD5:	8B03F5DA84F6175FB1213C1208BB0944
SHA1:	FB7A374705241EE8BA4C59C6BD4829A97B90FA55
SHA-256:	C91FFAAEF5231C6D7E744E0700F1F429C9CFAD88A4112FDD5ABABB701F3B5A4B
SHA-512:	038DA70FFDA4BF66CDF6D0D6792F51B140B0E6EEC8351A286A51D454A81E0571779E16985519DAB47F3B48E6102A54A40101634B86F556C95C2128DC6AED4283
Malicious:	false
Preview:	#ifndef _STDDEF_H.#define _STDDEF_H..typedef __SIZE_TYPE__ size_t;.typedef __PTRDIFF_TYPE__ ssize_t;.typedef __WCHAR_TYPE__ wchar_t;.typedef __PTRDIFF_TYPE__ ptrdiff_t;.typedef __PTRDIFF_TYPE__ intptr_t;.typedef __SIZE_TYPE__ uintptr_t;..#ifndef __int8_t_defined.#define __int8_t_defined.typedef signed char int8_t;.typedef signed short int int16_t;.typedef signed int int32_t;.#ifdef __LP64__.typedef signed long int int64_t;.#else.typedef signed long long int int64_t;.#endif.typedef unsigned char uint8_t;.typedef unsigned short int uint16_t;.typedef unsigned int uint32_t;.#ifdef __LP64__.typedef unsigned long int uint64_t;.#else.typedef unsigned long long int uint64_t;.#endif.#endif..#ifndef NULL.#define NULL ((void)0).#endif..#define offsetof(type, field) ((size_t)&((type )0)->field)..void alloca(size_t size);..#endif../ Older glibc require a wint_t from <stddef.h> (when requested. by __need_wint_t, as otherwise stddef.h isn't allowed to. define this type). Note that this must

C:\Program Files\Cheat Engine 7.5\include\stdint.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	6333
Entropy (8bit):	5.377774221268906
Encrypted:	false
SSDEEP:	96:Od4Q69/YQhMgPRVQzD+5VO7wRUNsNwxzMD2eT:Ou/f3Riz65VO7wRUNsNwxG
MD5:	90C1945AFA014FC0F8D17078C51502CA
SHA1:	F3A15DC3E32ED97B8CC34C1AFA2C66ECBA3B3BE4
SHA-256:	33C6C8DA7D564B5702AF8C6FF45C00A16842BA3FFE3F95F7F6232752F63C5AFD
SHA-512:	BE8557BDA158662ACC18CBD4445D4D2E6787FB5C78A67F0D0E4A62FFC9D2B1173C30C66CA5C6A247DA8FE7C38B7C57AFF050BD4A35B0120BD95400CFB4C2C2B6
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /./ ISO C9x 7.18 Integer types <stdint.h>. * Based on ISO/IEC SC22/WG14 9899 Committee draft (SC22 N2794). . THIS SOFTWARE IS NOT COPYRIGHTED. . Contributor: Danny Smith <danny_r_smith_2001@yahoo.co.nz>. . This source code is offered for use in the public domain. You may. * use, modify or distribute it freely.. . This code is distributed in the hope that it will be useful but. * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY. * DISCLAIMED. This includes but is not limited to warranties of. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.. . Date: 2000-12-02. */...#ifndef _STDINT_H.#define _STDINT_H..#include <_mingw.h>..#define __need_wint_t.#define __need_wchar_t.#include "stddef.h"..#ifndef __int8_t_defined.#define __int8_t

C:\Program Files\Cheat Engine 7.5\include\stdio.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	14903
Entropy (8bit):	5.137879509844942
Encrypted:	false
SSDEEP:	192:VgGovkt8YzcfdLDQgPVj85xhpp0DghdWRUeuzIDcDW40aMsGQLZX9QLbiR:KGr8ocfdL0w5shpwf40lsGQ6biR
MD5:	F4948ADEA7D9F60748DE8B427AB85684
SHA1:	101AD5424E182236EB7F537F17CE846C917CED27
SHA-256:	749059834143BCD5BDCEA13FC863C8B6587A89D6DFC84CD5017A98DF190DEFBD
SHA-512:	49847CA1A78BC100739B3AFC8A0D607AC37E340CEBBB0C04B2C067CDBDD6ED33AC5557214282699A89E39F4B8BB3A8B6383FC0A25C19265089E09B08765EA693
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_STDIO.#define _INC_STDIO..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#define BUFSIZ 512.#define _NFILE _NSTREAM_.#define _NSTREAM_ 512.#define _IOB_ENTRIES 20.#define EOF (-1)..#ifndef _FILE_DEFINED. struct _iobuf {. char _ptr;. int _cnt;. char _base;. int _flag;. int _file;. int _charbuf;. int _bufsiz;. char _tmpfname;. };. typedef struct _iobuf FILE;.#define _FILE_DEFINED.#endif..#ifdef _POSIX_.#define _P_tmpdir "/".#define _wP_tmpdir L"/".#else.#define _P_tmpdir "\\".#define _wP_tmpdir L"\\".#endif..#define L_tmpnam (sizeof(_P_tmpdir) + 12)..#ifdef _POSIX_.#define L_ctermid 9.#define L_cuserid 32.#endif..#define SEEK_CUR 1.#define SEEK_END 2.#define SEEK_SET 0..#define STDIN_FILENO

C:\Program Files\Cheat Engine 7.5\include\stdlib.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	20426
Entropy (8bit):	5.091356495974476
Encrypted:	false
SSDEEP:	384:X5I7a44IVaadf7trkr6vrRcbCGX8XnaTjWb5:Uvf7trkr6vrRHaTjWb5
MD5:	53D74BF044942015FEC4AFD293D2F9A8
SHA1:	010AB014E3B81B3A7E2D1D87FF0281A8736A4ABC
SHA-256:	5BBA095A2D22A6BC0670F73BFEBBA63CFEC65F8B7C248E84E36B3D7EDE0A4F3C
SHA-512:	64B66F0D610D37E6F55702130FAD39F39D30F44D33221C6A985CD03948968D4C4CAFB7676402A9A4A029C8539EFBFA5801C0D1BCBF667B876F3E7BB08F9BF89F
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_STDLIB.#define _INC_STDLIB..#include <_mingw.h>.#include <limits.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef NULL.#ifdef __cplusplus.#define NULL 0.#else.#define NULL ((void )0).#endif.#endif..#define EXIT_SUCCESS 0.#define EXIT_FAILURE 1..#ifndef _ONEXIT_T_DEFINED.#define _ONEXIT_T_DEFINED.. typedef int (__cdecl *_onexit_t)(void);..#ifndef NO_OLDNAMES.#define onexit_t _onexit_t.#endif.#endif..#ifndef _DIV_T_DEFINED.#define _DIV_T_DEFINED.. typedef struct _div_t {. int quot;. int rem;. } div_t;.. typedef struct _ldiv_t {. long quot;. long rem;. } ldiv_t;.#endif..#ifndef _CRT_DOUBLE_DEC.#define _CRT_DOUBLE_DEC..#pragma pack(4). typedef struct {. unsigned char ld[10];. } _LDOUBLE;.#pragma pack()..#defin

C:\Program Files\Cheat Engine 7.5\include\string.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	8590
Entropy (8bit):	4.845158903423087
Encrypted:	false
SSDEEP:	192:9SahrQ/tJUaRaV/f7WtxfeiZDHy6U4diocGLIvHKLhfyW7Ja0+8:9sJlS6H
MD5:	7E3AC3220BF883DA2DB8CDC7B8100D0B
SHA1:	666E6F91306EF6412AE912FA386B3DECC6332AD5
SHA-256:	D5C02C22653784792EEFF04CC453467BA22C214D9ACE876127EAB5FCCCBCA762
SHA-512:	1E27E9E73C5D3FBEC7CE41CB3B5FD6615BACC416991321BCE22B599150902352CF60078CD447BBBBD49F3106254C5E88E3FB01CA7DE62DA9A4DEDB6FD60F9B7A
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_STRING.#define _INC_STRING..#include <_mingw.h>..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _NLSCMP_DEFINED.#define _NLSCMP_DEFINED.#define _NLSCMPERROR 2147483647.#endif..#ifndef NULL.#ifdef __cplusplus.#define NULL 0.#else.#define NULL ((void )0).#endif.#endif..#define _WConst_return _CONST_RETURN..#ifndef _CRT_MEMORY_DEFINED.#define _CRT_MEMORY_DEFINED. _CRTIMP void __cdecl _memccpy(void _Dst,const void _Src,int _Val,size_t _MaxCount);. _CONST_RETURN void __cdecl memchr(const void _Buf ,int _Val,size_t _MaxCount);. _CRTIMP int __cdecl _memicmp(const void _Buf1,const void _Buf2,size_t _Size);. _CRTIMP int __cdecl _memicmp_l(const void _Buf1,const void _Buf2,size_t _Size,_locale_t _Locale);. int __cdecl memcmp(const void _Buf1,const void *_Bu

C:\Program Files\Cheat Engine 7.5\include\sys\fcntl.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	359
Entropy (8bit):	4.783912410510983
Encrypted:	false
SSDEEP:	6:UJg2JESe3SFB+SqicFPoJZVC1r7SFlLClXF1nDA4bf1CAA9:UJJISFcShcFP+4B7SFRClV1ns4xCAA9
MD5:	26DAC89B148799164D02AC701AA67E91
SHA1:	018DB361295E5C140DE8131BB148A09ABA0E3532
SHA-256:	2B4F660FFD8994AFA0387407051E3CA7ECC8FE44BEB2ADD2D431CD52CE8AD9C4
SHA-512:	94BCF1A20D11ADF422B9A83521A5D6950ECA35144CDD719C9CBB483BFB9FC0E57D1BA02D29347A9006B25B1DAC746FDEE952BFDED1E55139586BB9D50386B8B3
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /./. * This file is part of the Mingw32 package.. . This fcntl.h maps to the root fcntl.h. */.#ifndef __STRICT_ANSI__.#include <fcntl.h>.#endif.

C:\Program Files\Cheat Engine 7.5\include\sys\file.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	367
Entropy (8bit):	4.814423977077851
Encrypted:	false
SSDEEP:	6:UJg2JESe3SFB+SqicFPoJZVC1r7SFlLClXF1n6LACqMMf1CAA9:UJJISFcShcFP+4B7SFRClV1n/pHCAA9
MD5:	DA489932C3143982E94284F464F835CD
SHA1:	78FC0CCE2B7B047712B753AF6DF40258623D2620
SHA-256:	B6E779C53140C117BC36BD335C64BFCB13AE4C2C486B94783B32149A6EB2D320
SHA-512:	02ECE23C55D9C425F2B53C4D3AAFB7CE12B15995AB276CEFA9254C37499B0735FAF43EE32B67BF6A542EEC5147294BD5C16DFE51CAEFEC6C5B1C7807A4FD5858
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /./. * This file is part of the Mingw32 package.. . This file.h maps to the root fcntl.h. * TODO?. */.#ifndef __STRICT_ANSI__.#include <fcntl.h>.#endif.

C:\Program Files\Cheat Engine 7.5\include\sys\is-0I53U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	1717
Entropy (8bit):	5.134085097588011
Encrypted:	false
SSDEEP:	48:GIN024uIvNjYW0Q3VE9/6MLE0Rfn0AzMb:/02E18W0Q3+IclRf0nb
MD5:	D8BDDDB8A0B2E59371CE79EF056873C5
SHA1:	25F481B63F4343DCD56D2F15FE205F16BF008CB1
SHA-256:	518741F286545434DF676572E53BF8553B0496A7138942DC6B20FF252B4293E4
SHA-512:	4E009938EB6499F59022D1C2227A7E10FDE44C1CC4A38DE415B9E2C4E932E302C25845D68C6B2107CC037AB8053FE43350B2312A70130880004881E53EDB8F16
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /..#ifndef _SYS_TIME_H_.#define _SYS_TIME_H_..#include <time.h>..#ifdef __cplusplus.extern "C" {.#endif..#ifndef __STRICT_ANSI__.#ifndef _TIMEVAL_DEFINED / also in winsock[2].h /.#define _TIMEVAL_DEFINED.struct timeval {. long tv_sec;. long tv_usec;.};.#define timerisset(tvp). ((tvp)->tv_sec \|\| (tvp)->tv_usec).#define timercmp(tvp, uvp, cmp) \. (((tvp)->tv_sec != (uvp)->tv_sec) ? \. ((tvp)->tv_sec cmp (uvp)->tv_sec) : \. ((tvp)->tv_usec cmp (uvp)->tv_usec)).#define timerclear(tvp). (tvp)->tv_sec = (tvp)->tv_usec = 0.#endif / _TIMEVAL_DEFINED /..#ifndef _TIMEZONE_DEFINED / also in sys/time.h /.#define _TIMEZONE_DEFINED./ Provided for compatibility with code that assumes that. the presence of gettimeofday function implies a definition. of struct timezone. */.struc

C:\Program Files\Cheat Engine 7.5\include\sys\is-4DSRI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	367
Entropy (8bit):	4.814423977077851
Encrypted:	false
SSDEEP:	6:UJg2JESe3SFB+SqicFPoJZVC1r7SFlLClXF1n6LACqMMf1CAA9:UJJISFcShcFP+4B7SFRClV1n/pHCAA9
MD5:	DA489932C3143982E94284F464F835CD
SHA1:	78FC0CCE2B7B047712B753AF6DF40258623D2620
SHA-256:	B6E779C53140C117BC36BD335C64BFCB13AE4C2C486B94783B32149A6EB2D320
SHA-512:	02ECE23C55D9C425F2B53C4D3AAFB7CE12B15995AB276CEFA9254C37499B0735FAF43EE32B67BF6A542EEC5147294BD5C16DFE51CAEFEC6C5B1C7807A4FD5858
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /./. * This file is part of the Mingw32 package.. . This file.h maps to the root fcntl.h. * TODO?. */.#ifndef __STRICT_ANSI__.#include <fcntl.h>.#endif.

C:\Program Files\Cheat Engine 7.5\include\sys\is-74NLM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	351
Entropy (8bit):	4.8356374612162245
Encrypted:	false
SSDEEP:	6:UJg2JESe3SFB+SqicFPoJZVC1r7SFlLClXF1y19q/MqL9FPKvbf1CAARc:UJJISFcShcFP+4B7SFRClV1yoxFyvxCU
MD5:	244C135562D0B700D037299E0052A855
SHA1:	59F8A3B33C5CC8BBF95E4B57300628E7599DF682
SHA-256:	1F595A85CAEEEF7385A0BDA94AF51896B214EE26056484AF50353E9393DE1929
SHA-512:	1F5DEF177331B0E4DD86B5FC38FC9CF4F679BCA644C26C993D2A911DCF39DB452D084BF29D76430F5704E218CBCCD86D68F11D38C07B93A818EE446BA249EB53
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /./. * This file is part of the Mingw32 package.. . unistd.h maps (roughly) to io.h. */.#ifndef __STRICT_ANSI__.#include <io.h>.#endif..

C:\Program Files\Cheat Engine 7.5\include\sys\is-FQ2UK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	359
Entropy (8bit):	4.783912410510983
Encrypted:	false
SSDEEP:	6:UJg2JESe3SFB+SqicFPoJZVC1r7SFlLClXF1nDA4bf1CAA9:UJJISFcShcFP+4B7SFRClV1ns4xCAA9
MD5:	26DAC89B148799164D02AC701AA67E91
SHA1:	018DB361295E5C140DE8131BB148A09ABA0E3532
SHA-256:	2B4F660FFD8994AFA0387407051E3CA7ECC8FE44BEB2ADD2D431CD52CE8AD9C4
SHA-512:	94BCF1A20D11ADF422B9A83521A5D6950ECA35144CDD719C9CBB483BFB9FC0E57D1BA02D29347A9006B25B1DAC746FDEE952BFDED1E55139586BB9D50386B8B3
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /./. * This file is part of the Mingw32 package.. . This fcntl.h maps to the root fcntl.h. */.#ifndef __STRICT_ANSI__.#include <fcntl.h>.#endif.

C:\Program Files\Cheat Engine 7.5\include\sys\is-GL0L4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	2445
Entropy (8bit):	5.105161608995923
Encrypted:	false
SSDEEP:	48:GicuvBGmZ86+8nEGLEGzhlEG5/+Okvk4QEa2Mqh6CJ:srmZca/L/zf/5/AvkpExMqh6CJ
MD5:	19E8A20458A7627517AD83C0BE798773
SHA1:	FB12989D8B6B899F89F10E39559A46D79ADDEC65
SHA-256:	EF43F9F51660AB8282707F7169CC3D977878E623743D23EC565663FE2B4E9782
SHA-512:	4C21638910D0C87097E2FFC7B28B1011601E7B187297F9B9C2C3DB52596F84A0CFE089EF172A0DCDA0DCBE0B5B5DC94F36401A233CF7B903520C98B826A769DD
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _TIMEB_H_.#define _TIMEB_H_..#include <_mingw.h>..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CRTIMP.#define _CRTIMP __declspec(dllimport).#endif..#ifndef __TINYC__ / gr */.#ifdef _USE_32BIT_TIME_T.#ifdef _WIN64.#undef _USE_32BIT_TIME_T.#endif.#else.#if _INTEGRAL_MAX_BITS < 64.#define _USE_32BIT_TIME_T.#endif.#endif.#endif..#ifndef _TIME32_T_DEFINED. typedef long __time32_t;.#define _TIME32_T_DEFINED.#endif..#ifndef _TIME64_T_DEFINED.#if _INTEGRAL_MAX_BITS >= 64. typedef __int64 __time64_t;.#endif.#define _TIME64_T_DEFINED.#endif..#ifndef _TIME_T_DEFINED.#ifdef _USE_32BIT_TIME_T. typedef __time32_t time_t;.#else. typedef __time64_t time_t;.#endif.#define _TIME_T_DEF

C:\Program Files\Cheat Engine 7.5\include\sys\is-MUO8O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	6881
Entropy (8bit):	5.0578662257513605
Encrypted:	false
SSDEEP:	192:1Roa8xTSS9V89V0B9V69VP9VCJQI99wMupDGi+dpq+p:UdTSE44GPkfyDGi+Lq+p
MD5:	C03D618D6697B5E3992FEEA86A9C4CB8
SHA1:	4536CCD81AAEF11CF7480649B8B99836C8B32291
SHA-256:	4DC126AB4B3177DA85E40ED56A7D4516105E436A4624272992816B23E03915B5
SHA-512:	236235AA9B16B4CEB82C05BF526ECA702CB7D8C542F88D0BDB2416AC3BE8214688E6BA47BD253AAA877E173197035FD1EA7BF88AAE6C72C907E898182A5593C0
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_STAT.#define _INC_STAT..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#include <_mingw.h>.#include <io.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CRTIMP.#define _CRTIMP __declspec(dllimport).#endif..#include <sys/types.h>..#ifndef __TINYC__ / gr */.#ifdef _USE_32BIT_TIME_T.#ifdef _WIN64.#undef _USE_32BIT_TIME_T.#endif.#else.#if _INTEGRAL_MAX_BITS < 64.#define _USE_32BIT_TIME_T.#endif.#endif.#endif..#ifndef _TIME32_T_DEFINED. typedef long __time32_t;.#define _TIME32_T_DEFINED.#endif..#ifndef _TIME64_T_DEFINED.#if _INTEGRAL_MAX_BITS >= 64. typedef __int64 __time64_t;.#endif.#define _TIME64_T_DEFINED.#endif..#ifndef _TIME_T_DEFINED.#ifdef _USE_32BIT_TIME_T. typedef __time32_t time_t;.#else. typedef __tim

C:\Program Files\Cheat Engine 7.5\include\sys\is-OSJ7L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	3429
Entropy (8bit):	5.0927661539295
Encrypted:	false
SSDEEP:	96:0AqQeDbkF8080FQrkLt17kciYcTh6Wkcakc/Dk3Ih67k3R:0AVebbrShi1THhahrIIYIR
MD5:	0FD455848E3B07648883FF0C890BA3B6
SHA1:	22430C3CA7A2FABF95297BA72CA5FB175E37E996
SHA-256:	524312E3E8A325F7D5AFC21DDB8FCBCEB85D451175E07EF1BEADB7F82FA368B3
SHA-512:	53ADBB9316B7AD49BEF5018E3C32C10272A2D4A5CCF9A91D818D48C94C4DC4650ACC2AD462C2154E010E666B762B0B7F57BAD1A471830A0C5BB7422AFC62F840
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_UTIME.#define _INC_UTIME..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CRTIMP.#define _CRTIMP __declspec(dllimport).#endif..#ifndef _WCHAR_T_DEFINED. typedef unsigned short wchar_t;.#define _WCHAR_T_DEFINED.#endif..#ifndef __TINYC__ / gr */.#ifdef _USE_32BIT_TIME_T.#ifdef _WIN64.#undef _USE_32BIT_TIME_T.#endif.#else.#if _INTEGRAL_MAX_BITS < 64.#define _USE_32BIT_TIME_T.#endif.#endif.#endif..#ifndef _TIME32_T_DEFINED.#define _TIME32_T_DEFINED. typedef long __time32_t;.#endif..#ifndef _TIME64_T_DEFINED.#define _TIME64_T_DEFINED.#if _INTEGRAL_MAX_BITS >= 64. typedef __int64 __time64_t;.#endif.#endif..#ifndef _TIME_T_DEFINED.#define _TIME_T_DEFIN

C:\Program Files\Cheat Engine 7.5\include\sys\is-PTQPB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	2128
Entropy (8bit):	5.025170221794001
Encrypted:	false
SSDEEP:	48:G/uvbKQUIpV0OC1I/bFHb3wHbdyOkvk4QEa2K:WMKQ7V0/SFHDwHxkvkpExK
MD5:	C8F3B2F1FCF386398B5F130F0599A72E
SHA1:	242163A76E04F20CE4B3D5D0A959D66B978F43AD
SHA-256:	F1C3F9E5C811A63BEBAE5229042C09CB5E057F4117FD31B45AACBB4C3A626DF8
SHA-512:	3239360E2F810EBBB853581E01657A69BA9A56F6BBB29288011D6F842CE2C405D27A7D818C5E4809AE053481723DFA7DC37E4778EDFE6B6392884EB32804AA03
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_TYPES.#define _INC_TYPES..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#include <_mingw.h>..#ifndef __TINYC__ / gr */.#ifdef _USE_32BIT_TIME_T.#ifdef _WIN64.#undef _USE_32BIT_TIME_T.#endif.#else.#if _INTEGRAL_MAX_BITS < 64.#define _USE_32BIT_TIME_T.#endif.#endif.#endif..#ifndef _TIME32_T_DEFINED.#define _TIME32_T_DEFINED.typedef long __time32_t;.#endif..#ifndef _TIME64_T_DEFINED.#define _TIME64_T_DEFINED.#if _INTEGRAL_MAX_BITS >= 64.typedef __int64 __time64_t;.#endif.#endif..#ifndef _TIME_T_DEFINED.#define _TIME_T_DEFINED.#ifdef _USE_32BIT_TIME_T.typedef __time32_t time_t;.#else.typedef __time64_t time_t;.#endif.#endif..#ifndef _INO_T_DEFINED.#define _INO_T_DEFINED.typedef unsigned short _ino_t;.#ifndef.NO_OLDNAMES.typedef unsigned short ino_t;.#

C:\Program Files\Cheat Engine 7.5\include\sys\is-QHAUI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	648
Entropy (8bit):	4.971114123290285
Encrypted:	false
SSDEEP:	12:UJJISFcShcFP+4BFYLiSUfmMLGe2wAdcQr+VDRwrf7AIDjBArvjUOpy:i2PSh0PD+ivmMy4CVEABYjUOpy
MD5:	28BD6385B1C6AF18F7B2B2FA7F66827A
SHA1:	AD01251C9D742578F2962D71A17969DA842C5A2A
SHA-256:	29786145E9AF34A1F96E7368855B19E8879FC80D35A172D9BA97D3C7FC2F6311
SHA-512:	04DF92A3257B4A87FC1A00C65F700C6A9F4897FF3E258FBD27A3B3AD5426A35FAA7371735F829F4DA40E622E75A8259D4022F0F54BF8F52CA5ACFD234ED75CBE
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_LOCKING.#define _INC_LOCKING..#ifndef _WIN32.#error Only Win32 target is supported!.#endif../ All the headers include this file. */.#include <_mingw.h>..#define _LK_UNLCK 0.#define _LK_LOCK 1.#define _LK_NBLCK 2.#define _LK_RLCK 3.#define _LK_NBRLCK 4..#ifndef.NO_OLDNAMES.#define LK_UNLCK _LK_UNLCK.#define LK_LOCK _LK_LOCK.#define LK_NBLCK _LK_NBLCK.#define LK_RLCK _LK_RLCK.#define LK_NBRLCK _LK_NBRLCK.#endif..#endif.

C:\Program Files\Cheat Engine 7.5\include\sys\locking.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	648
Entropy (8bit):	4.971114123290285
Encrypted:	false
SSDEEP:	12:UJJISFcShcFP+4BFYLiSUfmMLGe2wAdcQr+VDRwrf7AIDjBArvjUOpy:i2PSh0PD+ivmMy4CVEABYjUOpy
MD5:	28BD6385B1C6AF18F7B2B2FA7F66827A
SHA1:	AD01251C9D742578F2962D71A17969DA842C5A2A
SHA-256:	29786145E9AF34A1F96E7368855B19E8879FC80D35A172D9BA97D3C7FC2F6311
SHA-512:	04DF92A3257B4A87FC1A00C65F700C6A9F4897FF3E258FBD27A3B3AD5426A35FAA7371735F829F4DA40E622E75A8259D4022F0F54BF8F52CA5ACFD234ED75CBE
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_LOCKING.#define _INC_LOCKING..#ifndef _WIN32.#error Only Win32 target is supported!.#endif../ All the headers include this file. */.#include <_mingw.h>..#define _LK_UNLCK 0.#define _LK_LOCK 1.#define _LK_NBLCK 2.#define _LK_RLCK 3.#define _LK_NBRLCK 4..#ifndef.NO_OLDNAMES.#define LK_UNLCK _LK_UNLCK.#define LK_LOCK _LK_LOCK.#define LK_NBLCK _LK_NBLCK.#define LK_RLCK _LK_RLCK.#define LK_NBRLCK _LK_NBRLCK.#endif..#endif.

C:\Program Files\Cheat Engine 7.5\include\sys\stat.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	6881
Entropy (8bit):	5.0578662257513605
Encrypted:	false
SSDEEP:	192:1Roa8xTSS9V89V0B9V69VP9VCJQI99wMupDGi+dpq+p:UdTSE44GPkfyDGi+Lq+p
MD5:	C03D618D6697B5E3992FEEA86A9C4CB8
SHA1:	4536CCD81AAEF11CF7480649B8B99836C8B32291
SHA-256:	4DC126AB4B3177DA85E40ED56A7D4516105E436A4624272992816B23E03915B5
SHA-512:	236235AA9B16B4CEB82C05BF526ECA702CB7D8C542F88D0BDB2416AC3BE8214688E6BA47BD253AAA877E173197035FD1EA7BF88AAE6C72C907E898182A5593C0
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_STAT.#define _INC_STAT..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#include <_mingw.h>.#include <io.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CRTIMP.#define _CRTIMP __declspec(dllimport).#endif..#include <sys/types.h>..#ifndef __TINYC__ / gr */.#ifdef _USE_32BIT_TIME_T.#ifdef _WIN64.#undef _USE_32BIT_TIME_T.#endif.#else.#if _INTEGRAL_MAX_BITS < 64.#define _USE_32BIT_TIME_T.#endif.#endif.#endif..#ifndef _TIME32_T_DEFINED. typedef long __time32_t;.#define _TIME32_T_DEFINED.#endif..#ifndef _TIME64_T_DEFINED.#if _INTEGRAL_MAX_BITS >= 64. typedef __int64 __time64_t;.#endif.#define _TIME64_T_DEFINED.#endif..#ifndef _TIME_T_DEFINED.#ifdef _USE_32BIT_TIME_T. typedef __time32_t time_t;.#else. typedef __tim

C:\Program Files\Cheat Engine 7.5\include\sys\time.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	1717
Entropy (8bit):	5.134085097588011
Encrypted:	false
SSDEEP:	48:GIN024uIvNjYW0Q3VE9/6MLE0Rfn0AzMb:/02E18W0Q3+IclRf0nb
MD5:	D8BDDDB8A0B2E59371CE79EF056873C5
SHA1:	25F481B63F4343DCD56D2F15FE205F16BF008CB1
SHA-256:	518741F286545434DF676572E53BF8553B0496A7138942DC6B20FF252B4293E4
SHA-512:	4E009938EB6499F59022D1C2227A7E10FDE44C1CC4A38DE415B9E2C4E932E302C25845D68C6B2107CC037AB8053FE43350B2312A70130880004881E53EDB8F16
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /..#ifndef _SYS_TIME_H_.#define _SYS_TIME_H_..#include <time.h>..#ifdef __cplusplus.extern "C" {.#endif..#ifndef __STRICT_ANSI__.#ifndef _TIMEVAL_DEFINED / also in winsock[2].h /.#define _TIMEVAL_DEFINED.struct timeval {. long tv_sec;. long tv_usec;.};.#define timerisset(tvp). ((tvp)->tv_sec \|\| (tvp)->tv_usec).#define timercmp(tvp, uvp, cmp) \. (((tvp)->tv_sec != (uvp)->tv_sec) ? \. ((tvp)->tv_sec cmp (uvp)->tv_sec) : \. ((tvp)->tv_usec cmp (uvp)->tv_usec)).#define timerclear(tvp). (tvp)->tv_sec = (tvp)->tv_usec = 0.#endif / _TIMEVAL_DEFINED /..#ifndef _TIMEZONE_DEFINED / also in sys/time.h /.#define _TIMEZONE_DEFINED./ Provided for compatibility with code that assumes that. the presence of gettimeofday function implies a definition. of struct timezone. */.struc

C:\Program Files\Cheat Engine 7.5\include\sys\timeb.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	2445
Entropy (8bit):	5.105161608995923
Encrypted:	false
SSDEEP:	48:GicuvBGmZ86+8nEGLEGzhlEG5/+Okvk4QEa2Mqh6CJ:srmZca/L/zf/5/AvkpExMqh6CJ
MD5:	19E8A20458A7627517AD83C0BE798773
SHA1:	FB12989D8B6B899F89F10E39559A46D79ADDEC65
SHA-256:	EF43F9F51660AB8282707F7169CC3D977878E623743D23EC565663FE2B4E9782
SHA-512:	4C21638910D0C87097E2FFC7B28B1011601E7B187297F9B9C2C3DB52596F84A0CFE089EF172A0DCDA0DCBE0B5B5DC94F36401A233CF7B903520C98B826A769DD
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _TIMEB_H_.#define _TIMEB_H_..#include <_mingw.h>..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CRTIMP.#define _CRTIMP __declspec(dllimport).#endif..#ifndef __TINYC__ / gr */.#ifdef _USE_32BIT_TIME_T.#ifdef _WIN64.#undef _USE_32BIT_TIME_T.#endif.#else.#if _INTEGRAL_MAX_BITS < 64.#define _USE_32BIT_TIME_T.#endif.#endif.#endif..#ifndef _TIME32_T_DEFINED. typedef long __time32_t;.#define _TIME32_T_DEFINED.#endif..#ifndef _TIME64_T_DEFINED.#if _INTEGRAL_MAX_BITS >= 64. typedef __int64 __time64_t;.#endif.#define _TIME64_T_DEFINED.#endif..#ifndef _TIME_T_DEFINED.#ifdef _USE_32BIT_TIME_T. typedef __time32_t time_t;.#else. typedef __time64_t time_t;.#endif.#define _TIME_T_DEF

C:\Program Files\Cheat Engine 7.5\include\sys\types.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	2128
Entropy (8bit):	5.025170221794001
Encrypted:	false
SSDEEP:	48:G/uvbKQUIpV0OC1I/bFHb3wHbdyOkvk4QEa2K:WMKQ7V0/SFHDwHxkvkpExK
MD5:	C8F3B2F1FCF386398B5F130F0599A72E
SHA1:	242163A76E04F20CE4B3D5D0A959D66B978F43AD
SHA-256:	F1C3F9E5C811A63BEBAE5229042C09CB5E057F4117FD31B45AACBB4C3A626DF8
SHA-512:	3239360E2F810EBBB853581E01657A69BA9A56F6BBB29288011D6F842CE2C405D27A7D818C5E4809AE053481723DFA7DC37E4778EDFE6B6392884EB32804AA03
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_TYPES.#define _INC_TYPES..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#include <_mingw.h>..#ifndef __TINYC__ / gr */.#ifdef _USE_32BIT_TIME_T.#ifdef _WIN64.#undef _USE_32BIT_TIME_T.#endif.#else.#if _INTEGRAL_MAX_BITS < 64.#define _USE_32BIT_TIME_T.#endif.#endif.#endif..#ifndef _TIME32_T_DEFINED.#define _TIME32_T_DEFINED.typedef long __time32_t;.#endif..#ifndef _TIME64_T_DEFINED.#define _TIME64_T_DEFINED.#if _INTEGRAL_MAX_BITS >= 64.typedef __int64 __time64_t;.#endif.#endif..#ifndef _TIME_T_DEFINED.#define _TIME_T_DEFINED.#ifdef _USE_32BIT_TIME_T.typedef __time32_t time_t;.#else.typedef __time64_t time_t;.#endif.#endif..#ifndef _INO_T_DEFINED.#define _INO_T_DEFINED.typedef unsigned short _ino_t;.#ifndef.NO_OLDNAMES.typedef unsigned short ino_t;.#

C:\Program Files\Cheat Engine 7.5\include\sys\unistd.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	351
Entropy (8bit):	4.8356374612162245
Encrypted:	false
SSDEEP:	6:UJg2JESe3SFB+SqicFPoJZVC1r7SFlLClXF1y19q/MqL9FPKvbf1CAARc:UJJISFcShcFP+4B7SFRClV1yoxFyvxCU
MD5:	244C135562D0B700D037299E0052A855
SHA1:	59F8A3B33C5CC8BBF95E4B57300628E7599DF682
SHA-256:	1F595A85CAEEEF7385A0BDA94AF51896B214EE26056484AF50353E9393DE1929
SHA-512:	1F5DEF177331B0E4DD86B5FC38FC9CF4F679BCA644C26C993D2A911DCF39DB452D084BF29D76430F5704E218CBCCD86D68F11D38C07B93A818EE446BA249EB53
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /./. * This file is part of the Mingw32 package.. . unistd.h maps (roughly) to io.h. */.#ifndef __STRICT_ANSI__.#include <io.h>.#endif..

C:\Program Files\Cheat Engine 7.5\include\sys\utime.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	3429
Entropy (8bit):	5.0927661539295
Encrypted:	false
SSDEEP:	96:0AqQeDbkF8080FQrkLt17kciYcTh6Wkcakc/Dk3Ih67k3R:0AVebbrShi1THhahrIIYIR
MD5:	0FD455848E3B07648883FF0C890BA3B6
SHA1:	22430C3CA7A2FABF95297BA72CA5FB175E37E996
SHA-256:	524312E3E8A325F7D5AFC21DDB8FCBCEB85D451175E07EF1BEADB7F82FA368B3
SHA-512:	53ADBB9316B7AD49BEF5018E3C32C10272A2D4A5CCF9A91D818D48C94C4DC4650ACC2AD462C2154E010E666B762B0B7F57BAD1A471830A0C5BB7422AFC62F840
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_UTIME.#define _INC_UTIME..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CRTIMP.#define _CRTIMP __declspec(dllimport).#endif..#ifndef _WCHAR_T_DEFINED. typedef unsigned short wchar_t;.#define _WCHAR_T_DEFINED.#endif..#ifndef __TINYC__ / gr */.#ifdef _USE_32BIT_TIME_T.#ifdef _WIN64.#undef _USE_32BIT_TIME_T.#endif.#else.#if _INTEGRAL_MAX_BITS < 64.#define _USE_32BIT_TIME_T.#endif.#endif.#endif..#ifndef _TIME32_T_DEFINED.#define _TIME32_T_DEFINED. typedef long __time32_t;.#endif..#ifndef _TIME64_T_DEFINED.#define _TIME64_T_DEFINED.#if _INTEGRAL_MAX_BITS >= 64. typedef __int64 __time64_t;.#endif.#endif..#ifndef _TIME_T_DEFINED.#define _TIME_T_DEFIN

C:\Program Files\Cheat Engine 7.5\include\tcc\is-JASML.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	5780
Entropy (8bit):	5.046971371476785
Encrypted:	false
SSDEEP:	96:jlnbfJdTPPut0CQHXOiNZIZvYx6G5Pcz3mZqZ9VZ59uxS34n3C3:NfJdSbQHXVNiVYx6G5Y3UO9VFuxS34A
MD5:	7166D4B47303E4DC38EBEAE8B204075F
SHA1:	FA0341B00479D682C8A398E8EC1C6D4D7FC2D05A
SHA-256:	758E0585EDFBCE44BF27E0BB44D9B22AF53B86C9C265E4303DF9B270194ED4FF
SHA-512:	4A4DF260266B6F17DA29E71254969DBE377CC11BADE3513BAB1F3B767CE049C9BBE1B0656263763BFB5D10C9D325B425364F000BAA4342572556716B857E796D
Malicious:	false
Preview:	#ifndef _TCC_LIBM_H_.#define _TCC_LIBM_H_..#include "../math.h"../* TCC uses 8 bytes for double and long double, so effectively the l variants. * are never used. For now, they just run the normal (double) variant.. /../. * most of the code in this file is taken from MUSL rs-1.0 (MIT license). * - musl-libc: http://git.musl-libc.org/cgit/musl/tree/src/math?h=rs-1.0. * - License: http://git.musl-libc.org/cgit/musl/tree/COPYRIGHT?h=rs-1.0. /../****************************************************************************. Start of code based on MUSL.****************************************************************************/./.musl as a whole is licensed under the following standard MIT license:..----------------------------------------------------------------------.Copyright . 2005-2014 Rich Felker, et al...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software

C:\Program Files\Cheat Engine 7.5\include\tcc\tcc_libm.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	5780
Entropy (8bit):	5.046971371476785
Encrypted:	false
SSDEEP:	96:jlnbfJdTPPut0CQHXOiNZIZvYx6G5Pcz3mZqZ9VZ59uxS34n3C3:NfJdSbQHXVNiVYx6G5Y3UO9VFuxS34A
MD5:	7166D4B47303E4DC38EBEAE8B204075F
SHA1:	FA0341B00479D682C8A398E8EC1C6D4D7FC2D05A
SHA-256:	758E0585EDFBCE44BF27E0BB44D9B22AF53B86C9C265E4303DF9B270194ED4FF
SHA-512:	4A4DF260266B6F17DA29E71254969DBE377CC11BADE3513BAB1F3B767CE049C9BBE1B0656263763BFB5D10C9D325B425364F000BAA4342572556716B857E796D
Malicious:	false
Preview:	#ifndef _TCC_LIBM_H_.#define _TCC_LIBM_H_..#include "../math.h"../* TCC uses 8 bytes for double and long double, so effectively the l variants. * are never used. For now, they just run the normal (double) variant.. /../. * most of the code in this file is taken from MUSL rs-1.0 (MIT license). * - musl-libc: http://git.musl-libc.org/cgit/musl/tree/src/math?h=rs-1.0. * - License: http://git.musl-libc.org/cgit/musl/tree/COPYRIGHT?h=rs-1.0. /../****************************************************************************. Start of code based on MUSL.****************************************************************************/./.musl as a whole is licensed under the following standard MIT license:..----------------------------------------------------------------------.Copyright . 2005-2014 Rich Felker, et al...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software

C:\Program Files\Cheat Engine 7.5\include\tccdefs.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	10222
Entropy (8bit):	5.118611530215232
Encrypted:	false
SSDEEP:	96:cwxjJoLCBGnjq/Kn4aq3qvsbLJKr7nnJik1gngZxl9e7PpTGO+HT7R8AitqazIh5:cwzbLJyLnJ6O8PpTGOEiNzIhIbIXP3JF
MD5:	ACE688BCE0201B3B8BC3B7AF3CEC1BA7
SHA1:	7B967DE03772076207537292C4163994D4EAD095
SHA-256:	FACA8509C87FAE987A5E98CDC95171E036895037427D12930E2A83092D23FBB5
SHA-512:	A83753F6A1B82BCDFCF0B948C93F2E09A0A13105A112C161ABAD6DE84162DA67600CF5458FF51264DDC462077033DE3C8496E7B2251831871005D747AE58A24A
Malicious:	false
Preview:	/* tccdefs.h.... Nothing is defined before this file except target machine, target os.. and the few things related to option settings in tccpp.c:tcc_predefs()..... This file is either included at runtime as is, or converted and.. included as C-strings at compile-time (depending on CONFIG_TCC_PREDEFS)..... Note that line indent matters:.... - in lines starting at column 1, platform macros are replaced by.. corresponding TCC target compile-time macros. See conftest.c for.. the list of platform macros supported in lines starting at column 1..... - only lines indented >= 4 are actually included into the executable,.. check tccdefs_.h.../....#if __SIZEOF_POINTER__ == 4.. / 32bit systems. */..#if defined TARGETOS_OpenBSD.. #define __SIZE_TYPE__ unsigned long.. #define __PTRDIFF_TYPE__ long..#else.. #define __SIZE_TYPE__ unsigned int.. #define __PTRDIFF_TYPE__ int..#endif.. #define __ILP32__ 1.. #define __INT64_TYPE__ long long..#el

C:\Program Files\Cheat Engine 7.5\include\tchar.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	31364
Entropy (8bit):	4.752286291497649
Encrypted:	false
SSDEEP:	768:ngntwzzdfQQbqvoRFCM/CVwLn4wyQoPUQ:PzdfQQbqvo1UwNoPUQ
MD5:	E237270733EDC1CB97B10870A3D50A69
SHA1:	C2406D465B5E8D94E1CB61C6C3F312BDB018AC80
SHA-256:	7FE5FDE028FF8F69D2BDA910664E2C169E7B92C6E7F2CF7915EB72054A9746FF
SHA-512:	8DF9ADD42AD3C8C378E93AF4BEC69489D59B8088974A40EC04FB91749DC050E3000674C9388FAE9937F87D6ABB60199B13D179BF0A8654370A66DB64CDD2E1B1
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#include <_mingw.h>..#ifndef _INC_TCHAR.#define _INC_TCHAR..#ifdef _STRSAFE_H_INCLUDED_.#error Need to include strsafe.h after tchar.h.#endif..#ifdef __cplusplus.extern "C" {.#endif..#define _ftcscat _tcscat.#define _ftcschr _tcschr.#define _ftcscpy _tcscpy.#define _ftcscspn _tcscspn.#define _ftcslen _tcslen.#define _ftcsncat _tcsncat.#define _ftcsncpy _tcsncpy.#define _ftcspbrk _tcspbrk.#define _ftcsrchr _tcsrchr.#define _ftcsspn _tcsspn.#define _ftcsstr _tcsstr.#define _ftcstok _tcstok..#define _ftcsdup _tcsdup.#define _ftcsnset _tcsnset.#define _ftcsrev _tcsrev.#define _ftcsset _tcsset..#define _ftcscmp _tcscmp.#define _ftcsicmp _tcsicmp.#define _ftcsnccmp _tcsnccmp.#define _ftcsncmp _tcsncmp.#define _ftcsncicmp _tcsncicmp.#define _ftcsnicmp _tcsnicmp..#define _ftcscoll _tc

C:\Program Files\Cheat Engine 7.5\include\time.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	8405
Entropy (8bit):	5.100723832842219
Encrypted:	false
SSDEEP:	192:0ih8Bf8Bx8B6qwyKg758H898Bc8BQGDL2XMR6fm4RFeU6sxhE2JFE:0G8Bf8Bx8Bxwyz58O8Bc8Bv208m4RFeD
MD5:	698EA0C0196BA07E9B949406DBB9FFD7
SHA1:	7296CFE82FAB54F08D44CE9CBAB92BEF7D96C96E
SHA-256:	453793A2D6C6FC772D1CDD60E701FB3D393D752937C1D6B2CA64D5F1CEC9FD36
SHA-512:	49984DDD4866060D8E310CA6A2BD53DEA87ABA70778202C5EFED126C35B244DF90C42D61477775F327B30597138A73FB2B2EE2E1050DC6732FAEB766E870C146
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _TIME_H_.#define _TIME_H_..#include <_mingw.h>..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CRTIMP.#define _CRTIMP __declspec(dllimport).#endif..#ifndef _WCHAR_T_DEFINED.#define _WCHAR_T_DEFINED. typedef unsigned short wchar_t;.#endif..#ifndef _TIME32_T_DEFINED.#define _TIME32_T_DEFINED. typedef long __time32_t;.#endif..#ifndef _TIME64_T_DEFINED.#define _TIME64_T_DEFINED.#if _INTEGRAL_MAX_BITS >= 64.#if defined(__GNUC__) && defined(__STRICT_ANSI__). typedef int _time64_t __attribute__ ((mode (DI)));.#else. typedef __int64 __time64_t;.#endif.#endif.#endif..#ifndef _TIME_T_DEFINED.#define _TIME_T_DEFINED.#ifdef _USE_32BIT_TIME_T. typedef __time32_t time_t;.#else. typ

C:\Program Files\Cheat Engine 7.5\include\vadefs.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	304
Entropy (8bit):	4.976431807239841
Encrypted:	false
SSDEEP:	6:UJg2JESe3SFB+SqicFPoJZVC1r2n2ADbA96Iy/KTMk:UJJISFcShcFP+4BbHYPSN
MD5:	DDA4463DA15121ED7AD4F091FBF61DFF
SHA1:	84B4C4973306EF725C3F61446AB891CAC6AA66A4
SHA-256:	2E6AB359559319A11A80F8F52AA0472CD0B141137F3A1EAA18C40D8827DC51D4
SHA-512:	D3417CF7702A17F0F327CBAF8D167D7830A2955C19D553893329696CDF2312707595CF0F6DDAA36EA18D0CEA41F24E6FA9C15AC14D5BC567BC25A1CC81B733FE
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _INC_VADEFS.#define _INC_VADEFS..//!__TINYC__: GNUC specific stuff removed..#endif.

C:\Program Files\Cheat Engine 7.5\include\values.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	126
Entropy (8bit):	4.580595223579644
Encrypted:	false
SSDEEP:	3:UwqZKUaAJAtMLnKEwOEtLDLaF9rL4AsNXIC:Uwq1LJvnKEcXaF94FNXIC
MD5:	621045AE9CA57FE30C8A99DD52AC5703
SHA1:	39B1E30A678EAC4DF1B78C0EF9D315A18DF4F156
SHA-256:	FA3758847B33F59ABE99B023BE00D8A027C391ECD0580A1FE755497C11E0C723
SHA-512:	AADE260048487D82F129A9A51FBDEA949793465C33DC147B31943D22523FB1A63C48F80FCA370D5929BCCA76B89CD15D9786C439A65C396BB4A5416D387E3F3A
Malicious:	false
Preview:	/. TODO: Nothing here yet. Should provide UNIX compatibility constants. * comparable to those in limits.h and float.h.. */.

C:\Program Files\Cheat Engine 7.5\include\varargs.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	355
Entropy (8bit):	4.9174278150037285
Encrypted:	false
SSDEEP:	6:UJg2JESe3SFB+SqicFPoJZVC1r2Ti2F0A/ivi+M8WjTffBX5FoKtn+cs:UJJISFcShcFP+4B6Xr/qi+MHjjfBcKta
MD5:	8C659FCB5BA111C2A40716A84A2540D8
SHA1:	20069AF3A3805CF4CB05339F7A7A860F04A1E4B9
SHA-256:	07858857F4EED0A61DF94BEB1A9D678B53FC3D67A0B0E8936155F85DDBCD1DCC
SHA-512:	D1B19DEC523C79320BB3380F29981A49EFB178F06C0538BCE0A5B36AFEABEC9BE0F2A9D02436EDF2AC0970CB14B175B3387BBB14A1E5F62EEC9971C0C7648A99
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _VARARGS_H.#define _VARARGS_H..#error "TinyCC no longer implements <varargs.h>.".#error "Revise your code to use <stdarg.h>."..#endif.

C:\Program Files\Cheat Engine 7.5\include\wchar.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	34132
Entropy (8bit):	5.065285191271868
Encrypted:	false
SSDEEP:	384:2186Orc7LIJ8SNgVx6eG17k8MGOHlE4eGP0+aILsGQ86jWIwF2iiEYbS:2IcE8SNgVx61JC6jry2E
MD5:	D6B25F8E3068967751493431B36C4248
SHA1:	3145ED71F286525D1FF492AE920B30694123259E
SHA-256:	C9BF12E02A2AB0783ED1C66DFE43DE43C402B33906CADA9B1157502A82C7C3E4
SHA-512:	02A480389CECC909978130585609F57D03728726E72E5FEE89874ACCA4122D971D74FC615949F8675513EDCFE3198201AD0118F795B147C6FCA10D28E8856645
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_WCHAR.#define _INC_WCHAR..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef WCHAR_MIN / also at stdint.h /.#define WCHAR_MIN 0.#define WCHAR_MAX ((wchar_t) -1) / UINT16_MAX /.#endif..#ifndef __GNUC_VA_LIST.#define __GNUC_VA_LIST. typedef __builtin_va_list __gnuc_va_list;.#endif..#ifndef _VA_LIST_DEFINED.#define _VA_LIST_DEFINED. typedef __gnuc_va_list va_list;.#endif..#ifndef WEOF.#define WEOF (wint_t)(0xFFFF).#endif..#ifndef _FILE_DEFINED. struct _iobuf {. char _ptr;. int _cnt;. char _base;. int _flag;. int _file;. int _charbuf;. int _bufsiz;. char _tmpfname;. };. typedef struct _iobuf FILE;.#define _FILE_DEFINED.#endif..#ifndef _STDIO_DEFINED.#ifdef _WIN64. _CRTIMP FILE *__

C:\Program Files\Cheat Engine 7.5\include\wctype.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	4782
Entropy (8bit):	5.146949090032166
Encrypted:	false
SSDEEP:	96:4+KnaNsLsNwnSTOXNXgXXXVX+1XPXmXIX6QXJX9XZXdwUSv:4+KA6O6XNXgXXXVXkXPXmXIXfXJX9XZK
MD5:	C238CFA11A44926BECD364AB35BFC821
SHA1:	54D68B8EF71D277BD5173E0AAC794D6EBDB00360
SHA-256:	E12D9C5BCBE4DFB96EA6C75410EA287917B3C24BFF9CD2E716D35E00C1D4906C
SHA-512:	C64F6A3B18D84C8498A2270E7152C4001D6D7EE1ACD04169F616A7808A05A02F34E2876BA0CB8D979AE75752109B50A65A66207C86FE936402BDA39AC93833C0
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _INC_WCTYPE.#define _INC_WCTYPE..#ifndef _WIN32.#error Only Win32 target is supported!.#endif..#include <_mingw.h>..#pragma pack(push,_CRT_PACKING)..#ifdef __cplusplus.extern "C" {.#endif..#ifndef _CRTIMP.#define _CRTIMP __declspec(dllimport).#endif..#ifndef _WCHAR_T_DEFINED. typedef unsigned short wchar_t;.#define _WCHAR_T_DEFINED.#endif..#ifndef _WCTYPE_T_DEFINED. typedef unsigned short wint_t;. typedef unsigned short wctype_t;.#define _WCTYPE_T_DEFINED.#endif..#ifndef WEOF.#define WEOF (wint_t)(0xFFFF).#endif..#ifndef _CRT_CTYPEDATA_DEFINED.#define _CRT_CTYPEDATA_DEFINED.#ifndef _CTYPE_DISABLE_MACROS..#ifndef __PCTYPE_FUNC.#define __PCTYPE_FUNC __pctype_func().#ifdef _MSVCRT_.#define __pctype_func() (_pctype).#else.#define __pctype_func() (_imp___pctype).#endif.

C:\Program Files\Cheat Engine 7.5\include\winapi\basetsd.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	5614
Entropy (8bit):	5.234194137175846
Encrypted:	false
SSDEEP:	96:xOYJhN+GRWlYdGmc0/5ZLURGFVwae+NmZLaVkGMGMRRMhHmdd7sAKGU1LRlw+4i7:xO8hIGRWl6Gmc0hw8Vre+NmcVk5rSHIQ
MD5:	4BF8483CA6A55237B88B3FB04917C9B4
SHA1:	1D5A57A8AF15FF88521335970F6C547EB2BDA403
SHA-256:	5C9CBAA16ABF57400ED31B49AAB7EE015788DBE7D3B58F3D53C86DB3807DD6F0
SHA-512:	7C4E012EF32A9529A0FA648320796D2ABB287C3C37F22D2CFEFE62FD0851CF68B5D373316AD70B51D09F0D0F1F48843A5D6E430C12367B5363648EEFF1160466
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _BASETSD_H_.#define _BASETSD_H_..#if (defined(__x86_64) \|\| defined(__ia64__)) && !defined(RC_INVOKED).typedef unsigned __int64 POINTER_64_INT;.#else.typedef unsigned long POINTER_64_INT;.#endif..#define POINTER_32.#define POINTER_64.#define FIRMWARE_PTR..#ifdef __cplusplus.extern "C" {.#endif.. typedef signed char INT8,PINT8;. typedef signed short INT16,PINT16;. typedef signed int INT32,PINT32;. typedef signed __int64 INT64,PINT64;. typedef unsigned char UINT8,PUINT8;. typedef unsigned short UINT16,PUINT16;. typedef unsigned int UINT32,PUINT32;. typedef unsigned __int64 UINT64,PUINT64;. typedef signed int LONG32,PLONG32;. typedef unsigned int ULONG32,PULONG32;. typedef unsigned int DWORD32,PDWORD32;..#ifndef _W64.#define _W64.#endif..#ifdef _WIN64

C:\Program Files\Cheat Engine 7.5\include\winapi\basetyps.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	2413
Entropy (8bit):	5.267985342570529
Encrypted:	false
SSDEEP:	48:G+qAaBjES2EZs96PiYkAahW4h+gt/04hOgldUOkke:TqAuEThH3Vy
MD5:	09DFC50C697476FDC240969717C514CE
SHA1:	C9D444C897A96A4B475379C7C6B826FDF2DFF2E5
SHA-256:	34842EE3389CB13A72A2B87EC930AADBFFCE8906EB31480180CFF541C7F44134
SHA-512:	DE3E258D4DF8E046A131110FADAC12572CA14A7359F1C44C41DEBC7E8F1424A93BEC6300E3CA21BEEB55FF4B3AB572F0B3059D9399C89CFF27D154DCC90238F7
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#if !defined(_BASETYPS_H_).#define _BASETYPS_H_..#ifdef __cplusplus.#define EXTERN_C extern "C".#else.#define EXTERN_C extern.#endif..#define STDMETHODCALLTYPE WINAPI.#define STDMETHODVCALLTYPE __cdecl..#define STDAPICALLTYPE WINAPI.#define STDAPIVCALLTYPE __cdecl..#define STDAPI EXTERN_C HRESULT WINAPI.#define STDAPI_(type) EXTERN_C type WINAPI..#define STDMETHODIMP HRESULT WINAPI.#define STDMETHODIMP_(type) type WINAPI..#define STDAPIV EXTERN_C HRESULT STDAPIVCALLTYPE.#define STDAPIV_(type) EXTERN_C type STDAPIVCALLTYPE..#define STDMETHODIMPV HRESULT STDMETHODVCALLTYPE.#define STDMETHODIMPV_(type) type STDMETHODVCALLTYPE..#if defined(__cplusplus) && !defined(CINTERFACE)..#define __STRUCT__ struct.#define STDMETHOD(method) virtual HRESULT WINAPI method.#define STDMETHOD_(type

C:\Program Files\Cheat Engine 7.5\include\winapi\guiddef.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	4165
Entropy (8bit):	5.37405161812663
Encrypted:	false
SSDEEP:	96:lVeZAP1SQySDz25/rPjEgE+2VPYFjrQUnL:lVe01S9kNcH
MD5:	D65FFFB282C1F60CCBFC4DCF1410BE1F
SHA1:	2BE8BADB6C6FB0DB0B023BFBC7B6842E0AB73A8F
SHA-256:	7DB1B1FE46513F578A3C777C3CE300D8403D31FBFB6D00EACFF93286D2ED1293
SHA-512:	E7F9554980671DCB14C62FF462AE34961C01E0DD1AFA9F8E010370B0941E22BA619ABEA98DCE090762888A1E485586BAAA0917167FF6373C8309374EBCE8054F
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef GUID_DEFINED.#define GUID_DEFINED.typedef struct _GUID {. unsigned long Data1;. unsigned short Data2;. unsigned short Data3;. unsigned char Data4[8 ];.} GUID;.#endif..#ifndef UUID_DEFINED.#define UUID_DEFINED.typedef GUID UUID;.#endif..#ifndef FAR.#define FAR.#endif..#ifndef DECLSPEC_SELECTANY.#define DECLSPEC_SELECTANY __declspec(selectany).#endif..#ifndef EXTERN_C.#ifdef __cplusplus.#define EXTERN_C extern "C".#else.#define EXTERN_C extern.#endif.#endif..#ifdef DEFINE_GUID.#undef DEFINE_GUID.#endif..#ifdef INITGUID.#ifdef __cplusplus.#define DEFINE_GUID(name,l,w1,w2,b1,b2,b3,b4,b5,b6,b7,b8) EXTERN_C const GUID DECLSPEC_SELECTANY name = { l,w1,w2,{ b1,b2,b3,b4,b5,b6,b7,b8 } }.#else.#define DEFINE_GUID(name,l,w1,w2,b1,b2,b3,b4,b5,b6,b7,b8) const GUID DECLSPEC_SELEC

C:\Program Files\Cheat Engine 7.5\include\winapi\is-1NSDB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	193650
Entropy (8bit):	5.442692211038205
Encrypted:	false
SSDEEP:	1536:mgqyl7JPZPZWFLvC3b+tc55bLqkI66qJ+bOaCIzxlWLp9EhxveAMimiAg9+38w8l:FvgTAw+39O8+NQkK9t/k7IM
MD5:	39AB9E1D4A6B6871FC59D837A1910566
SHA1:	CEA4A15910A1DC02AF23A06ACE7B8B7BD6E1001D
SHA-256:	0881DEBBBD1879A08341E395FA1DCED6A7B1007A80A9C6ECC831A7800C90CA02
SHA-512:	652B8695DBBF04C76DB183435FDDC21034FD9C8C10CF648A21787855417B5050580C424C4DA773676BD6A6FD8C30596D905E3C9E91E946B37EA5723FBA9DF481
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINNT_.#define _WINNT_..#ifdef __cplusplus.extern "C" {.#endif..#include <ctype.h>.#define ANYSIZE_ARRAY 1..//gr #include <specstrings.h>..#define RESTRICTED_POINTER..#ifndef __CRT_UNALIGNED.#define __CRT_UNALIGNED.#endif..#if defined(__ia64__) \|\| defined(__x86_64).#define UNALIGNED __CRT_UNALIGNED.#ifdef _WIN64.#define UNALIGNED64 __CRT_UNALIGNED.#else.#define UNALIGNED64.#endif.#else.#define UNALIGNED.#define UNALIGNED64.#endif..#if !defined(I_X86_) && !defined(_IA64_) && !defined(_AMD64_) && (defined(_X86_) && !defined(__x86_64)).#define I_X86_.#endif..#if !defined(I_X86_) && !defined(_IA64_) && !defined(_AMD64_) && defined(__x86_64).#define _AMD64_.#endif..#if !defined(I_X86_) && !(defined(_X86_) && !defined(__x86_64)) && !defined(_AMD64_) && defined(__ia64__).#if

C:\Program Files\Cheat Engine 7.5\include\winapi\is-1S69F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	2413
Entropy (8bit):	5.267985342570529
Encrypted:	false
SSDEEP:	48:G+qAaBjES2EZs96PiYkAahW4h+gt/04hOgldUOkke:TqAuEThH3Vy
MD5:	09DFC50C697476FDC240969717C514CE
SHA1:	C9D444C897A96A4B475379C7C6B826FDF2DFF2E5
SHA-256:	34842EE3389CB13A72A2B87EC930AADBFFCE8906EB31480180CFF541C7F44134
SHA-512:	DE3E258D4DF8E046A131110FADAC12572CA14A7359F1C44C41DEBC7E8F1424A93BEC6300E3CA21BEEB55FF4B3AB572F0B3059D9399C89CFF27D154DCC90238F7
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#if !defined(_BASETYPS_H_).#define _BASETYPS_H_..#ifdef __cplusplus.#define EXTERN_C extern "C".#else.#define EXTERN_C extern.#endif..#define STDMETHODCALLTYPE WINAPI.#define STDMETHODVCALLTYPE __cdecl..#define STDAPICALLTYPE WINAPI.#define STDAPIVCALLTYPE __cdecl..#define STDAPI EXTERN_C HRESULT WINAPI.#define STDAPI_(type) EXTERN_C type WINAPI..#define STDMETHODIMP HRESULT WINAPI.#define STDMETHODIMP_(type) type WINAPI..#define STDAPIV EXTERN_C HRESULT STDAPIVCALLTYPE.#define STDAPIV_(type) EXTERN_C type STDAPIVCALLTYPE..#define STDMETHODIMPV HRESULT STDMETHODVCALLTYPE.#define STDMETHODIMPV_(type) type STDMETHODVCALLTYPE..#if defined(__cplusplus) && !defined(CINTERFACE)..#define __STRUCT__ struct.#define STDMETHOD(method) virtual HRESULT WINAPI method.#define STDMETHOD_(type

C:\Program Files\Cheat Engine 7.5\include\winapi\is-2RB3V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	4.939467489498393
Encrypted:	false
SSDEEP:	6:UJg2JESe3SFB+SqicFPoJZVC1r2DySEWVgs1cG3O2:UJJISFcShcFP+4BnWKi3O2
MD5:	F7CE406B57AF97C8BA95EEB9D7840C1D
SHA1:	ED211A37E0EFCA13A0146F9FE775875D32DB3496
SHA-256:	8EB67DD233D5A387D6DC1814CB6EB6C6DE9A123438FAEFCA7B442691CAF23049
SHA-512:	B7EE10FBFE60F4F6E998D48D88C36095DFA70524B9E24A6E3BDD6C0A62FBFCD66725E28F227DA1469448C909D08DC57ADD7484D7FEECA35B2FF3A4F526756256
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#if !(defined(lint) \|\| defined(RC_INVOKED)).#pragma pack(push,1).#endif.

C:\Program Files\Cheat Engine 7.5\include\winapi\is-4CQ17.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	121301
Entropy (8bit):	5.419416589760816
Encrypted:	false
SSDEEP:	768:mmN0oz+ODr15Ye92/rvZVXkRs4pItxtv7OosWBkEwJaYygZtk+tUtwtmtDlwsigp:nuPn7z57mW7T1QFYLCOdKSbuo8Sl
MD5:	FD80383F6F92379E074379BA54D68BDC
SHA1:	0A4D4926DF853E126FCC52150C84822AF1EF8035
SHA-256:	DF5937AC1805B27ABBA03277D2C34CAEE8CB4387EDB894ADCD73E6172A9FBD94
SHA-512:	4ED6C5508C77A8A3272835C6AE1323514E42D015F3CB53168382FFD78FB1A73D806AF5421378D1430ED344BA1200E3006D5AAF4150E925C1F2267A8D637A50A4
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINGDI_.#define _WINGDI_..#define WINGDIAPI DECLSPEC_IMPORT.#define WINSPOOLAPI DECLSPEC_IMPORT..#ifdef __cplusplus.extern "C" {.#endif..#ifndef WINVER.#define WINVER 0x0502.#endif..#ifndef NOGDI.#ifndef NORASTEROPS.#define R2_BLACK 1.#define R2_NOTMERGEPEN 2.#define R2_MASKNOTPEN 3.#define R2_NOTCOPYPEN 4.#define R2_MASKPENNOT 5.#define R2_NOT 6.#define R2_XORPEN 7.#define R2_NOTMASKPEN 8.#define R2_MASKPEN 9.#define R2_NOTXORPEN 10.#define R2_NOP 11.#define R2_MERGENOTPEN 12.#define R2_COPYPEN 13.#define R2_MERGEPENNOT 14.#define R2_MERGEPEN 15.#define R2_WHITE 16.#define R2_LAST 16..#define SRCCOPY (DWORD)0x00CC0020.#define SRCPAINT (DWORD)0x00EE0086.#define SRCAND (DWORD)0x008800C6.#define SRCINVERT (DWORD)0x00660046.#define SRCERASE (DWORD)0x00440328.#define NOTS

C:\Program Files\Cheat Engine 7.5\include\winapi\is-5UQJA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	159607
Entropy (8bit):	5.448523174174419
Encrypted:	false
SSDEEP:	3072:p8iWoUKAVEvTQ/BUNRB+NNKjxyfmTcFqTPj:p8iWoUKAVEvTQmcFqTPj
MD5:	18908ACE3445091E5966CC99F9D4B5B9
SHA1:	130D1CFA2D8A8A17FA2AFA4DDF4FE3DFBA4542D5
SHA-256:	47EFFBA4D4BB7DFBE373F1156285A170042FE1A3552BCBBEE460E5DB68E1FF2D
SHA-512:	0E63D752B56051057C4E553307A708C2359EAC58EA96EA0077931642482EB8B6E0B28984A278663D85C6B1739564CAB6FFED3D9582306473841A355BD0CBEE61
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINBASE_.#define _WINBASE_..#define WINADVAPI DECLSPEC_IMPORT.#define WINBASEAPI DECLSPEC_IMPORT.#define ZAWPROXYAPI DECLSPEC_IMPORT..#ifdef __cplusplus.extern "C" {.#endif..#define DefineHandleTable(w) ((w),TRUE).#define LimitEmsPages(dw).#define SetSwapAreaSize(w) (w).#define LockSegment(w) GlobalFix((HANDLE)(w)).#define UnlockSegment(w) GlobalUnfix((HANDLE)(w)).#define GetCurrentTime() GetTickCount()..#define Yield()..#define INVALID_HANDLE_VALUE ((HANDLE)(LONG_PTR)-1).#define INVALID_FILE_SIZE ((DWORD)0xffffffff).#define INVALID_SET_FILE_POINTER ((DWORD)-1).#define INVALID_FILE_ATTRIBUTES ((DWORD)-1)..#define FILE_BEGIN 0.#define FILE_CURRENT 1.#define FILE_END 2..#define TIME_ZONE_ID_INVALID ((DWORD)0xffffffff)..#define WAIT_FAILED ((DWORD)0xffffffff).#define WAI

C:\Program Files\Cheat Engine 7.5\include\winapi\is-92IBT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	5614
Entropy (8bit):	5.234194137175846
Encrypted:	false
SSDEEP:	96:xOYJhN+GRWlYdGmc0/5ZLURGFVwae+NmZLaVkGMGMRRMhHmdd7sAKGU1LRlw+4i7:xO8hIGRWl6Gmc0hw8Vre+NmcVk5rSHIQ
MD5:	4BF8483CA6A55237B88B3FB04917C9B4
SHA1:	1D5A57A8AF15FF88521335970F6C547EB2BDA403
SHA-256:	5C9CBAA16ABF57400ED31B49AAB7EE015788DBE7D3B58F3D53C86DB3807DD6F0
SHA-512:	7C4E012EF32A9529A0FA648320796D2ABB287C3C37F22D2CFEFE62FD0851CF68B5D373316AD70B51D09F0D0F1F48843A5D6E430C12367B5363648EEFF1160466
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _BASETSD_H_.#define _BASETSD_H_..#if (defined(__x86_64) \|\| defined(__ia64__)) && !defined(RC_INVOKED).typedef unsigned __int64 POINTER_64_INT;.#else.typedef unsigned long POINTER_64_INT;.#endif..#define POINTER_32.#define POINTER_64.#define FIRMWARE_PTR..#ifdef __cplusplus.extern "C" {.#endif.. typedef signed char INT8,PINT8;. typedef signed short INT16,PINT16;. typedef signed int INT32,PINT32;. typedef signed __int64 INT64,PINT64;. typedef unsigned char UINT8,PUINT8;. typedef unsigned short UINT16,PUINT16;. typedef unsigned int UINT32,PUINT32;. typedef unsigned __int64 UINT64,PUINT64;. typedef signed int LONG32,PLONG32;. typedef unsigned int ULONG32,PULONG32;. typedef unsigned int DWORD32,PDWORD32;..#ifndef _W64.#define _W64.#endif..#ifdef _WIN64

C:\Program Files\Cheat Engine 7.5\include\winapi\is-93UT7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	4.932449945638745
Encrypted:	false
SSDEEP:	6:UJg2JESe3SFB+SqicFPoJZVC1r2DySEWVgs1cG3iV:UJJISFcShcFP+4BnWKi3iV
MD5:	9E2E16A461B193BAE9E69C59C9A3E040
SHA1:	17AAA9161D3F9D7270EDB80BC850B3AD1CD9151A
SHA-256:	CD3BA1258A5DD9C714879D3E499B021C85EE9827C06BAC2FC2C1E677B5909531
SHA-512:	37C580B406EB30FC66B0135D91D8DC743A9F2ABBF830A58272ECF910E4F4BDE10ED9A1CF07A8C0F24BFA2D8E86883AF76C5A7805FC70A2AE69F1A9D8225774DF
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#if !(defined(lint) \|\| defined(RC_INVOKED)).#pragma pack(push,4).#endif.

C:\Program Files\Cheat Engine 7.5\include\winapi\is-97NTF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	4165
Entropy (8bit):	5.37405161812663
Encrypted:	false
SSDEEP:	96:lVeZAP1SQySDz25/rPjEgE+2VPYFjrQUnL:lVe01S9kNcH
MD5:	D65FFFB282C1F60CCBFC4DCF1410BE1F
SHA1:	2BE8BADB6C6FB0DB0B023BFBC7B6842E0AB73A8F
SHA-256:	7DB1B1FE46513F578A3C777C3CE300D8403D31FBFB6D00EACFF93286D2ED1293
SHA-512:	E7F9554980671DCB14C62FF462AE34961C01E0DD1AFA9F8E010370B0941E22BA619ABEA98DCE090762888A1E485586BAAA0917167FF6373C8309374EBCE8054F
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef GUID_DEFINED.#define GUID_DEFINED.typedef struct _GUID {. unsigned long Data1;. unsigned short Data2;. unsigned short Data3;. unsigned char Data4[8 ];.} GUID;.#endif..#ifndef UUID_DEFINED.#define UUID_DEFINED.typedef GUID UUID;.#endif..#ifndef FAR.#define FAR.#endif..#ifndef DECLSPEC_SELECTANY.#define DECLSPEC_SELECTANY __declspec(selectany).#endif..#ifndef EXTERN_C.#ifdef __cplusplus.#define EXTERN_C extern "C".#else.#define EXTERN_C extern.#endif.#endif..#ifdef DEFINE_GUID.#undef DEFINE_GUID.#endif..#ifdef INITGUID.#ifdef __cplusplus.#define DEFINE_GUID(name,l,w1,w2,b1,b2,b3,b4,b5,b6,b7,b8) EXTERN_C const GUID DECLSPEC_SELECTANY name = { l,w1,w2,{ b1,b2,b3,b4,b5,b6,b7,b8 } }.#else.#define DEFINE_GUID(name,l,w1,w2,b1,b2,b3,b4,b5,b6,b7,b8) const GUID DECLSPEC_SELEC

C:\Program Files\Cheat Engine 7.5\include\winapi\is-AD97Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	5381
Entropy (8bit):	5.237607493279814
Encrypted:	false
SSDEEP:	96:EtGsCwPV1Ihot5C5snyv5vdQSZWVvc22c26T9Dd1s4S/BwS9BYwJw3+wIwV4mDVC:oC4V1Ihot5CFQjs4S/BwS9BmwJp9q1PK
MD5:	F0EF1B8EE3A22C3FA3CA4DD26012E309
SHA1:	4D78773275154677A5BB66D6393636CA2418EE69
SHA-256:	7D846678EC2A8C70F86308CF6BE585D760924C620DFCFB4B048F60D88577B69D
SHA-512:	7B230B6BE986E12C639DEE195198EE87FF1E9E0895FE3C101A3E8553D272986B9800C3C74B53A89128821D2D8D439A4968E48C29B2EDA43096E48F51B871B18C
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef VER_H.#define VER_H..#ifdef __cplusplus.extern "C" {.#endif..#define VS_FILE_INFO RT_VERSION.#define VS_VERSION_INFO 1.#define VS_USER_DEFINED 100..#define VS_FFI_SIGNATURE 0xFEEF04BDL.#define VS_FFI_STRUCVERSION 0x00010000L.#define VS_FFI_FILEFLAGSMASK 0x0000003FL..#define VS_FF_DEBUG 0x00000001L.#define VS_FF_PRERELEASE 0x00000002L.#define VS_FF_PATCHED 0x00000004L.#define VS_FF_PRIVATEBUILD 0x00000008L.#define VS_FF_INFOINFERRED 0x00000010L.#define VS_FF_SPECIALBUILD 0x00000020L..#define VOS_UNKNOWN 0x00000000L.#define VOS_DOS 0x00010000L.#define VOS_OS216 0x00020000L.#define VOS_OS232 0x00030000L.#define VOS_NT 0x00040000L.#define VOS_WINCE 0x00050000L..#define VOS__BASE 0x00000000L.#define VOS__WINDOWS16 0x00000001L.#define VOS__PM16 0x00000002L.#define VOS__PM32

C:\Program Files\Cheat Engine 7.5\include\winapi\is-BBNAD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	2173
Entropy (8bit):	5.14850892880743
Encrypted:	false
SSDEEP:	48:GAjzWlnWj5A0iB/s1bUys7sbUo7QJQj7RLbY:VjIWVAVB/s1Iys7sIo7QSjlvY
MD5:	437B745F448BA343620FEF2015B72E78
SHA1:	6E95B00A515154FAEDB95606F9AA429AFE40807E
SHA-256:	3B0D80E4B27E099C8AF543D6D9CCA295C68E115A0FBA7CD79CC0E76D1C3A5C11
SHA-512:	43EE580B0D94F5556A6D4227B103C52678CEECE4566A7CE3A9A494E8F19BCF3B33A3E765E10D62C53CC54552532C3B0B2828241354C4C14DF13CC7F90D6ED8AE
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINDOWS_.#define _WINDOWS_..#ifndef WIN32_LEAN_AND_MEAN.#define WIN32_LEAN_AND_MEAN 1.#endif..#ifndef WINVER.#define WINVER 0x0502.#endif..#include <_mingw.h>..#ifndef _INC_WINDOWS.#define _INC_WINDOWS..#if defined(RC_INVOKED) && !defined(NOWINRES)..#include <winresrc.h>.#else..#ifdef RC_INVOKED.#define NOATOM.#define NOGDI.#define NOGDICAPMASKS.#define NOMETAFILE.#define NOMINMAX.#define NOMSG.#define NOOPENFILE.#define NORASTEROPS.#define NOSCROLL.#define NOSOUND.#define NOSYSMETRICS.#define NOTEXTMETRIC.#define NOWH.#define NOCOMM.#define NOKANJI.#define NOCRYPT.#define NOMCX.#endif..#if !defined(I_X86_) && !defined(_IA64_) && !defined(_AMD64_) && (defined(_X86_) && !defined(__x86_64)).#define I_X86_.#endif..#if !defined(I_X86_) && !defined(_IA64_) && !defined(_AMD

C:\Program Files\Cheat Engine 7.5\include\winapi\is-FJ0FL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	150512
Entropy (8bit):	5.042627381884036
Encrypted:	false
SSDEEP:	1536:fAOSurpB+BkRymeRfJOj/7AL1YxEilv+y2aUs/gtvyEmZ1m6tDLiSgF:RHu7LSqiQakytxtDa
MD5:	8A51F06DF0CB380EB7E944203BFEDE79
SHA1:	92B3F5D7EBBAA0F35F30F5FA68698D93A708B0B5
SHA-256:	590134000B1B5C4FB7AFBCC54A445A42228D74164A9E8B24434D1A993F76852E
SHA-512:	E50C7D2391C84B3F975F5E6E732691102595BBB857987AD0577B370C34D9C9C32DE3FEA64DC8DD45608320EB0E7455EE306CA50B1F19D4B209BFE1618EF9B22A
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINERROR_.#define _WINERROR_..#define FACILITY_WINDOWSUPDATE 36.#define FACILITY_WINDOWS_CE 24.#define FACILITY_WINDOWS 8.#define FACILITY_URT 19.#define FACILITY_UMI 22.#define FACILITY_SXS 23.#define FACILITY_STORAGE 3.#define FACILITY_STATE_MANAGEMENT 34.#define FACILITY_SSPI 9.#define FACILITY_SCARD 16.#define FACILITY_SETUPAPI 15.#define FACILITY_SECURITY 9.#define FACILITY_RPC 1.#define FACILITY_WIN32 7.#define FACILITY_CONTROL 10.#define FACILITY_NULL 0.#define FACILITY_METADIRECTORY 35.#define FACILITY_MSMQ 14.#define FACILITY_MEDIASERVER 13.#define FACILITY_INTERNET 12.#define FACILITY_ITF 4.#define FACILITY_HTTP 25.#define FACILITY_DPLAY 21.#define FACILITY_DISPATCH 2.#define FACILITY_DIRECTORYSERVICE 37.#define FACILITY_CONFIGURATION 33.#define FACILITY_COM

C:\Program Files\Cheat Engine 7.5\include\winapi\is-GCQCF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	14473
Entropy (8bit):	5.318184429302839
Encrypted:	false
SSDEEP:	192:T3LK2osQDITqQWDVvRwPhOotRrwAIPmNLd1mBTVuRthEVPQKyybPki7wanag+4+M:lcio4tzIuhEVPQKyybrwan1+4+M
MD5:	A7EAC92053E54E029DC3B8356A49DF4A
SHA1:	475DF5425A60973CA79C1B0D5FA05DFD59E99E6A
SHA-256:	C965B8839E100E9AACAD333B373218F962A15840583231F968076441E781538B
SHA-512:	1A1F5032E2BA7A837FB043FC7B3DC15796B27FA481B2D8593F8012D503D1AAB5C82AB54404898FED81418FFC3B64712476DBC89ACAF92AACAC051FF40DD3F7CD
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _WINCON_.#define _WINCON_..#ifdef __cplusplus.extern "C" {.#endif.. typedef struct _COORD {. SHORT X;. SHORT Y;. } COORD,PCOORD;.. typedef struct _SMALL_RECT {. SHORT Left;. SHORT Top;. SHORT Right;. SHORT Bottom;. } SMALL_RECT,PSMALL_RECT;.. typedef struct _KEY_EVENT_RECORD {. WINBOOL bKeyDown;. WORD wRepeatCount;. WORD wVirtualKeyCode;. WORD wVirtualScanCode;. union {. WCHAR UnicodeChar;. CHAR AsciiChar;. } uChar;. DWORD dwControlKeyState;. } KEY_EVENT_RECORD,PKEY_EVENT_RECORD;..#define RIGHT_ALT_PRESSED 0x1.#define LEFT_ALT_PRESSED 0x2.#define RIGHT_CTRL_PRESSED 0x4.#define LEFT_CTRL_PRESSED 0x8.#define SHIFT_PRESSED 0x10.#define NUMLOCK_ON 0x20.#define SCROLLLOCK_ON 0x40.#define CAPSLOCK_ON 0x80.#define ENHA

C:\Program Files\Cheat Engine 7.5\include\winapi\is-GLR8Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	4.939467489498393
Encrypted:	false
SSDEEP:	6:UJg2JESe3SFB+SqicFPoJZVC1r2DySEWVgs1cG3kJuy:UJJISFcShcFP+4BnWKi3suy
MD5:	5F9BA2A3122F6963219BDD95EFF0D63B
SHA1:	FC7EF1DBF2D51D9E38E79BC4D2DFE7F89107263E
SHA-256:	D459CBD546929FD44980D32C1680A8F176D717CE9DF162F5C5C443DFDCCC9E42
SHA-512:	4339E932DA337FC33CB8544FAD3065F82F689E17AE9CFD6A3035A0A1C62271ED0EFC44553A75C29207E97555E55FF8F76D42FBEF57B46B0E117B087A367A5D1F
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#if !(defined(lint) \|\| defined(RC_INVOKED)).#pragma pack(push,2).#endif.

C:\Program Files\Cheat Engine 7.5\include\winapi\is-H9J2J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	5674
Entropy (8bit):	5.253868357743171
Encrypted:	false
SSDEEP:	96:l4nmx67GjIz13BkHelji9aF7e4KmCtnLK0kO5Ol60V:4mxbjYkHi+IM4OAO5gv
MD5:	4149CF07A0FCB5FAFAB7F58BCC951D8C
SHA1:	DBF6F1002B67DA30CE63BE5D41E0EAA76263AC9F
SHA-256:	137E9A43A136E4AE19B3A4C844023C6A1611B23685000364F6BE3143DB1A4C75
SHA-512:	1BC969D3700C3BEB6416EED13942142315EFEE5F929C55F539E11FB9196C8865CA05BE0A39094C6E7457B671BA33299D3861AEC6161DD0429E8A375F378659A9
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _WINDEF_.#define _WINDEF_..#ifndef STRICT.#define STRICT 1.#endif..#ifdef __cplusplus.extern "C" {.#endif..#ifndef WINVER.#define WINVER 0x0502.#endif..#ifndef BASETYPES.#define BASETYPES. typedef unsigned long ULONG;. typedef ULONG PULONG;. typedef unsigned short USHORT;. typedef USHORT PUSHORT;. typedef unsigned char UCHAR;. typedef UCHAR PUCHAR;. typedef char PSZ;.#endif..#define MAX_PATH 260..#ifndef NULL.#ifdef __cplusplus.#define NULL 0.#else.#define NULL ((void )0).#endif.#endif..#ifndef FALSE.#define FALSE 0.#endif..#ifndef TRUE.#define TRUE 1.#endif..#ifndef IN.#define IN.#endif..#ifndef OUT.#define OUT.#endif..#ifndef OPTIONAL.#define OPTIONAL.#endif..#undef far.#undef near.#undef pascal..#define far.#define near.#define pascal __stdcall..#define

C:\Program Files\Cheat Engine 7.5\include\winapi\is-MUNGH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	4.939467489498393
Encrypted:	false
SSDEEP:	6:UJg2JESe3SFB+SqicFPoJZVC1r2DySEWVgs1cG3uJuy:UJJISFcShcFP+4BnWKi3uV
MD5:	4FA6301A9105C4442FCD8181B17BF100
SHA1:	CD49157FA734AF5ECB57BDE0E7C57B9BC425CE98
SHA-256:	32FE7B5FF2387C916AD134EF5B5B0AC67447DA0E0DCCF405C31562AAC718D6D8
SHA-512:	EC6C5D061C788463D3E262E69ED74F5A21022007F4E3BC5DCDAA64ED641D0C4953A60A465E7972756E427E3B9AC71103AA36EF298F8E5D8FC946210152612599
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#if !(defined(lint) \|\| defined(RC_INVOKED)).#pragma pack(push,8).#endif.

C:\Program Files\Cheat Engine 7.5\include\winapi\is-P2U2R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	4.902277729484196
Encrypted:	false
SSDEEP:	6:UJg2JESe3SFB+SqicFPoJZVC1r2DySEWVgs1cGtSy:UJJISFcShcFP+4BnWKiky
MD5:	584EBD620B89C671805EB5917278C46F
SHA1:	645DCA8A4775E323EED290EB1262A898E3BD8DF3
SHA-256:	81C951E1FB87AA8F6E8871A073277F1CD1CCB9B66F6EFA92AFF35BCD00A60726
SHA-512:	F80C37DF443967189B8B3E246E860E854A65283B9E7DBBFD87FE30E6E8285C785DF2D6F74AC9D7D59CDF655E543B830042A51574FEDCF5611714946DA2D1D542
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#if !(defined(lint) \|\| defined(RC_INVOKED)).#pragma pack(pop).#endif.

C:\Program Files\Cheat Engine 7.5\include\winapi\is-PTTF7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with very long lines (302)
Category:	dropped
Size (bytes):	13963
Entropy (8bit):	5.433606364599901
Encrypted:	false
SSDEEP:	384:CVb+C+ikI8n1W8l12X3ufMfkebe+XxeceAUgnhicr7Df0ff8uc/1uA1uFZNz6deF:q+C3kI8n1W8l14VzPBAf
MD5:	0F0E5CB60E379839AC67467A6FD5280F
SHA1:	0783BEC9C6F621AEDD45D2F1010740D9A6152B0A
SHA-256:	6DBB969DC21E90D9044DABCD190268C1BB33E445862CE2A4A536E9A7134FA4EB
SHA-512:	06C87AE227BF6D9C00E8404C728CC77DE9840237647605AABF197A85131E4835FF6EE96D7BEE24FD7B423C86F64D673669D2D2E8061F03473B2B0A1E10DD8BCA
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINREG_.#define _WINREG_..#ifdef __cplusplus.extern "C" {.#endif..#ifndef WINVER.#define WINVER 0x0502.#endif..#define RRF_RT_REG_NONE 0x00000001.#define RRF_RT_REG_SZ 0x00000002.#define RRF_RT_REG_EXPAND_SZ 0x00000004.#define RRF_RT_REG_BINARY 0x00000008.#define RRF_RT_REG_DWORD 0x00000010.#define RRF_RT_REG_MULTI_SZ 0x00000020.#define RRF_RT_REG_QWORD 0x00000040..#define RRF_RT_DWORD (RRF_RT_REG_BINARY \| RRF_RT_REG_DWORD).#define RRF_RT_QWORD (RRF_RT_REG_BINARY \| RRF_RT_REG_QWORD).#define RRF_RT_ANY 0x0000ffff..#define RRF_NOEXPAND 0x10000000.#define RRF_ZEROONFAILURE 0x20000000.. typedef ACCESS_MASK REGSAM;..#define HKEY_CLASSES_ROOT ((HKEY) (ULONG_PTR)((LONG)0x80000000)).#define HKEY_CURRENT_USER ((HKEY) (ULONG_PTR)((LONG)0x80000001)).#define HKEY_LOCAL_MACHINE (

C:\Program Files\Cheat Engine 7.5\include\winapi\is-SIKIP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	179678
Entropy (8bit):	5.448601521160739
Encrypted:	false
SSDEEP:	3072:jgie2EUSlwrMbtENbSJGDN4tSUez2pUQkR:jgie7wrMSSJGDfUe++
MD5:	3243B7C1189CC2C02075C2B175592EA9
SHA1:	B520F45E195A50AB00ACC161EFEC7E6620E652AF
SHA-256:	4356BFCDF5209C4EC58DE486E2173CE4B17E0CE75A422B226FDDDD18597C9905
SHA-512:	CDAA9D91F80127028DC877924D2E41B4EF55714485536C4B64955195C94E8EBFBECF9A0D7545DF535CBF4C1977CA53C14379B96ABCEBF7AEC461BCBB87EF040E
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _WINUSER_.#define _WINUSER_..#define WINUSERAPI DECLSPEC_IMPORT..#ifdef __cplusplus.extern "C" {.#endif..#ifndef WINVER.#define WINVER 0x0502.#endif..#include <stdarg.h>..#ifndef NOUSER. typedef HANDLE HDWP;. typedef VOID MENUTEMPLATEA;. typedef VOID MENUTEMPLATEW;. typedef PVOID LPMENUTEMPLATEA;. typedef PVOID LPMENUTEMPLATEW;..#ifdef UNICODE. typedef MENUTEMPLATEW MENUTEMPLATE;. typedef LPMENUTEMPLATEW LPMENUTEMPLATE;.#else. typedef MENUTEMPLATEA MENUTEMPLATE;. typedef LPMENUTEMPLATEA LPMENUTEMPLATE;.#endif.. typedef LRESULT (CALLBACK WNDPROC)(HWND,UINT,WPARAM,LPARAM);. typedef INT_PTR (CALLBACK DLGPROC)(HWND,UINT,WPARAM,LPARAM);. typedef VOID (CALLBACK TIMERPROC)(HWND,UINT,UINT_PTR,DWORD);. typedef WINBOOL (CALLBACK *GRAYSTRINGPROC)(HDC,LPARAM,int);.

C:\Program Files\Cheat Engine 7.5\include\winapi\poppack.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	4.902277729484196
Encrypted:	false
SSDEEP:	6:UJg2JESe3SFB+SqicFPoJZVC1r2DySEWVgs1cGtSy:UJJISFcShcFP+4BnWKiky
MD5:	584EBD620B89C671805EB5917278C46F
SHA1:	645DCA8A4775E323EED290EB1262A898E3BD8DF3
SHA-256:	81C951E1FB87AA8F6E8871A073277F1CD1CCB9B66F6EFA92AFF35BCD00A60726
SHA-512:	F80C37DF443967189B8B3E246E860E854A65283B9E7DBBFD87FE30E6E8285C785DF2D6F74AC9D7D59CDF655E543B830042A51574FEDCF5611714946DA2D1D542
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#if !(defined(lint) \|\| defined(RC_INVOKED)).#pragma pack(pop).#endif.

C:\Program Files\Cheat Engine 7.5\include\winapi\pshpack1.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	4.939467489498393
Encrypted:	false
SSDEEP:	6:UJg2JESe3SFB+SqicFPoJZVC1r2DySEWVgs1cG3O2:UJJISFcShcFP+4BnWKi3O2
MD5:	F7CE406B57AF97C8BA95EEB9D7840C1D
SHA1:	ED211A37E0EFCA13A0146F9FE775875D32DB3496
SHA-256:	8EB67DD233D5A387D6DC1814CB6EB6C6DE9A123438FAEFCA7B442691CAF23049
SHA-512:	B7EE10FBFE60F4F6E998D48D88C36095DFA70524B9E24A6E3BDD6C0A62FBFCD66725E28F227DA1469448C909D08DC57ADD7484D7FEECA35B2FF3A4F526756256
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#if !(defined(lint) \|\| defined(RC_INVOKED)).#pragma pack(push,1).#endif.

C:\Program Files\Cheat Engine 7.5\include\winapi\pshpack2.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	4.939467489498393
Encrypted:	false
SSDEEP:	6:UJg2JESe3SFB+SqicFPoJZVC1r2DySEWVgs1cG3kJuy:UJJISFcShcFP+4BnWKi3suy
MD5:	5F9BA2A3122F6963219BDD95EFF0D63B
SHA1:	FC7EF1DBF2D51D9E38E79BC4D2DFE7F89107263E
SHA-256:	D459CBD546929FD44980D32C1680A8F176D717CE9DF162F5C5C443DFDCCC9E42
SHA-512:	4339E932DA337FC33CB8544FAD3065F82F689E17AE9CFD6A3035A0A1C62271ED0EFC44553A75C29207E97555E55FF8F76D42FBEF57B46B0E117B087A367A5D1F
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#if !(defined(lint) \|\| defined(RC_INVOKED)).#pragma pack(push,2).#endif.

C:\Program Files\Cheat Engine 7.5\include\winapi\pshpack4.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	4.932449945638745
Encrypted:	false
SSDEEP:	6:UJg2JESe3SFB+SqicFPoJZVC1r2DySEWVgs1cG3iV:UJJISFcShcFP+4BnWKi3iV
MD5:	9E2E16A461B193BAE9E69C59C9A3E040
SHA1:	17AAA9161D3F9D7270EDB80BC850B3AD1CD9151A
SHA-256:	CD3BA1258A5DD9C714879D3E499B021C85EE9827C06BAC2FC2C1E677B5909531
SHA-512:	37C580B406EB30FC66B0135D91D8DC743A9F2ABBF830A58272ECF910E4F4BDE10ED9A1CF07A8C0F24BFA2D8E86883AF76C5A7805FC70A2AE69F1A9D8225774DF
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#if !(defined(lint) \|\| defined(RC_INVOKED)).#pragma pack(push,4).#endif.

C:\Program Files\Cheat Engine 7.5\include\winapi\pshpack8.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	285
Entropy (8bit):	4.939467489498393
Encrypted:	false
SSDEEP:	6:UJg2JESe3SFB+SqicFPoJZVC1r2DySEWVgs1cG3uJuy:UJJISFcShcFP+4BnWKi3uV
MD5:	4FA6301A9105C4442FCD8181B17BF100
SHA1:	CD49157FA734AF5ECB57BDE0E7C57B9BC425CE98
SHA-256:	32FE7B5FF2387C916AD134EF5B5B0AC67447DA0E0DCCF405C31562AAC718D6D8
SHA-512:	EC6C5D061C788463D3E262E69ED74F5A21022007F4E3BC5DCDAA64ED641D0C4953A60A465E7972756E427E3B9AC71103AA36EF298F8E5D8FC946210152612599
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#if !(defined(lint) \|\| defined(RC_INVOKED)).#pragma pack(push,8).#endif.

C:\Program Files\Cheat Engine 7.5\include\winapi\winbase.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	159607
Entropy (8bit):	5.448523174174419
Encrypted:	false
SSDEEP:	3072:p8iWoUKAVEvTQ/BUNRB+NNKjxyfmTcFqTPj:p8iWoUKAVEvTQmcFqTPj
MD5:	18908ACE3445091E5966CC99F9D4B5B9
SHA1:	130D1CFA2D8A8A17FA2AFA4DDF4FE3DFBA4542D5
SHA-256:	47EFFBA4D4BB7DFBE373F1156285A170042FE1A3552BCBBEE460E5DB68E1FF2D
SHA-512:	0E63D752B56051057C4E553307A708C2359EAC58EA96EA0077931642482EB8B6E0B28984A278663D85C6B1739564CAB6FFED3D9582306473841A355BD0CBEE61
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINBASE_.#define _WINBASE_..#define WINADVAPI DECLSPEC_IMPORT.#define WINBASEAPI DECLSPEC_IMPORT.#define ZAWPROXYAPI DECLSPEC_IMPORT..#ifdef __cplusplus.extern "C" {.#endif..#define DefineHandleTable(w) ((w),TRUE).#define LimitEmsPages(dw).#define SetSwapAreaSize(w) (w).#define LockSegment(w) GlobalFix((HANDLE)(w)).#define UnlockSegment(w) GlobalUnfix((HANDLE)(w)).#define GetCurrentTime() GetTickCount()..#define Yield()..#define INVALID_HANDLE_VALUE ((HANDLE)(LONG_PTR)-1).#define INVALID_FILE_SIZE ((DWORD)0xffffffff).#define INVALID_SET_FILE_POINTER ((DWORD)-1).#define INVALID_FILE_ATTRIBUTES ((DWORD)-1)..#define FILE_BEGIN 0.#define FILE_CURRENT 1.#define FILE_END 2..#define TIME_ZONE_ID_INVALID ((DWORD)0xffffffff)..#define WAIT_FAILED ((DWORD)0xffffffff).#define WAI

C:\Program Files\Cheat Engine 7.5\include\winapi\wincon.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	14473
Entropy (8bit):	5.318184429302839
Encrypted:	false
SSDEEP:	192:T3LK2osQDITqQWDVvRwPhOotRrwAIPmNLd1mBTVuRthEVPQKyybPki7wanag+4+M:lcio4tzIuhEVPQKyybrwan1+4+M
MD5:	A7EAC92053E54E029DC3B8356A49DF4A
SHA1:	475DF5425A60973CA79C1B0D5FA05DFD59E99E6A
SHA-256:	C965B8839E100E9AACAD333B373218F962A15840583231F968076441E781538B
SHA-512:	1A1F5032E2BA7A837FB043FC7B3DC15796B27FA481B2D8593F8012D503D1AAB5C82AB54404898FED81418FFC3B64712476DBC89ACAF92AACAC051FF40DD3F7CD
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _WINCON_.#define _WINCON_..#ifdef __cplusplus.extern "C" {.#endif.. typedef struct _COORD {. SHORT X;. SHORT Y;. } COORD,PCOORD;.. typedef struct _SMALL_RECT {. SHORT Left;. SHORT Top;. SHORT Right;. SHORT Bottom;. } SMALL_RECT,PSMALL_RECT;.. typedef struct _KEY_EVENT_RECORD {. WINBOOL bKeyDown;. WORD wRepeatCount;. WORD wVirtualKeyCode;. WORD wVirtualScanCode;. union {. WCHAR UnicodeChar;. CHAR AsciiChar;. } uChar;. DWORD dwControlKeyState;. } KEY_EVENT_RECORD,PKEY_EVENT_RECORD;..#define RIGHT_ALT_PRESSED 0x1.#define LEFT_ALT_PRESSED 0x2.#define RIGHT_CTRL_PRESSED 0x4.#define LEFT_CTRL_PRESSED 0x8.#define SHIFT_PRESSED 0x10.#define NUMLOCK_ON 0x20.#define SCROLLLOCK_ON 0x40.#define CAPSLOCK_ON 0x80.#define ENHA

C:\Program Files\Cheat Engine 7.5\include\winapi\windef.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	5674
Entropy (8bit):	5.253868357743171
Encrypted:	false
SSDEEP:	96:l4nmx67GjIz13BkHelji9aF7e4KmCtnLK0kO5Ol60V:4mxbjYkHi+IM4OAO5gv
MD5:	4149CF07A0FCB5FAFAB7F58BCC951D8C
SHA1:	DBF6F1002B67DA30CE63BE5D41E0EAA76263AC9F
SHA-256:	137E9A43A136E4AE19B3A4C844023C6A1611B23685000364F6BE3143DB1A4C75
SHA-512:	1BC969D3700C3BEB6416EED13942142315EFEE5F929C55F539E11FB9196C8865CA05BE0A39094C6E7457B671BA33299D3861AEC6161DD0429E8A375F378659A9
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _WINDEF_.#define _WINDEF_..#ifndef STRICT.#define STRICT 1.#endif..#ifdef __cplusplus.extern "C" {.#endif..#ifndef WINVER.#define WINVER 0x0502.#endif..#ifndef BASETYPES.#define BASETYPES. typedef unsigned long ULONG;. typedef ULONG PULONG;. typedef unsigned short USHORT;. typedef USHORT PUSHORT;. typedef unsigned char UCHAR;. typedef UCHAR PUCHAR;. typedef char PSZ;.#endif..#define MAX_PATH 260..#ifndef NULL.#ifdef __cplusplus.#define NULL 0.#else.#define NULL ((void )0).#endif.#endif..#ifndef FALSE.#define FALSE 0.#endif..#ifndef TRUE.#define TRUE 1.#endif..#ifndef IN.#define IN.#endif..#ifndef OUT.#define OUT.#endif..#ifndef OPTIONAL.#define OPTIONAL.#endif..#undef far.#undef near.#undef pascal..#define far.#define near.#define pascal __stdcall..#define

C:\Program Files\Cheat Engine 7.5\include\winapi\windows.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	2173
Entropy (8bit):	5.14850892880743
Encrypted:	false
SSDEEP:	48:GAjzWlnWj5A0iB/s1bUys7sbUo7QJQj7RLbY:VjIWVAVB/s1Iys7sIo7QSjlvY
MD5:	437B745F448BA343620FEF2015B72E78
SHA1:	6E95B00A515154FAEDB95606F9AA429AFE40807E
SHA-256:	3B0D80E4B27E099C8AF543D6D9CCA295C68E115A0FBA7CD79CC0E76D1C3A5C11
SHA-512:	43EE580B0D94F5556A6D4227B103C52678CEECE4566A7CE3A9A494E8F19BCF3B33A3E765E10D62C53CC54552532C3B0B2828241354C4C14DF13CC7F90D6ED8AE
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINDOWS_.#define _WINDOWS_..#ifndef WIN32_LEAN_AND_MEAN.#define WIN32_LEAN_AND_MEAN 1.#endif..#ifndef WINVER.#define WINVER 0x0502.#endif..#include <_mingw.h>..#ifndef _INC_WINDOWS.#define _INC_WINDOWS..#if defined(RC_INVOKED) && !defined(NOWINRES)..#include <winresrc.h>.#else..#ifdef RC_INVOKED.#define NOATOM.#define NOGDI.#define NOGDICAPMASKS.#define NOMETAFILE.#define NOMINMAX.#define NOMSG.#define NOOPENFILE.#define NORASTEROPS.#define NOSCROLL.#define NOSOUND.#define NOSYSMETRICS.#define NOTEXTMETRIC.#define NOWH.#define NOCOMM.#define NOKANJI.#define NOCRYPT.#define NOMCX.#endif..#if !defined(I_X86_) && !defined(_IA64_) && !defined(_AMD64_) && (defined(_X86_) && !defined(__x86_64)).#define I_X86_.#endif..#if !defined(I_X86_) && !defined(_IA64_) && !defined(_AMD

C:\Program Files\Cheat Engine 7.5\include\winapi\winerror.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	150512
Entropy (8bit):	5.042627381884036
Encrypted:	false
SSDEEP:	1536:fAOSurpB+BkRymeRfJOj/7AL1YxEilv+y2aUs/gtvyEmZ1m6tDLiSgF:RHu7LSqiQakytxtDa
MD5:	8A51F06DF0CB380EB7E944203BFEDE79
SHA1:	92B3F5D7EBBAA0F35F30F5FA68698D93A708B0B5
SHA-256:	590134000B1B5C4FB7AFBCC54A445A42228D74164A9E8B24434D1A993F76852E
SHA-512:	E50C7D2391C84B3F975F5E6E732691102595BBB857987AD0577B370C34D9C9C32DE3FEA64DC8DD45608320EB0E7455EE306CA50B1F19D4B209BFE1618EF9B22A
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINERROR_.#define _WINERROR_..#define FACILITY_WINDOWSUPDATE 36.#define FACILITY_WINDOWS_CE 24.#define FACILITY_WINDOWS 8.#define FACILITY_URT 19.#define FACILITY_UMI 22.#define FACILITY_SXS 23.#define FACILITY_STORAGE 3.#define FACILITY_STATE_MANAGEMENT 34.#define FACILITY_SSPI 9.#define FACILITY_SCARD 16.#define FACILITY_SETUPAPI 15.#define FACILITY_SECURITY 9.#define FACILITY_RPC 1.#define FACILITY_WIN32 7.#define FACILITY_CONTROL 10.#define FACILITY_NULL 0.#define FACILITY_METADIRECTORY 35.#define FACILITY_MSMQ 14.#define FACILITY_MEDIASERVER 13.#define FACILITY_INTERNET 12.#define FACILITY_ITF 4.#define FACILITY_HTTP 25.#define FACILITY_DPLAY 21.#define FACILITY_DISPATCH 2.#define FACILITY_DIRECTORYSERVICE 37.#define FACILITY_CONFIGURATION 33.#define FACILITY_COM

C:\Program Files\Cheat Engine 7.5\include\winapi\wingdi.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	121301
Entropy (8bit):	5.419416589760816
Encrypted:	false
SSDEEP:	768:mmN0oz+ODr15Ye92/rvZVXkRs4pItxtv7OosWBkEwJaYygZtk+tUtwtmtDlwsigp:nuPn7z57mW7T1QFYLCOdKSbuo8Sl
MD5:	FD80383F6F92379E074379BA54D68BDC
SHA1:	0A4D4926DF853E126FCC52150C84822AF1EF8035
SHA-256:	DF5937AC1805B27ABBA03277D2C34CAEE8CB4387EDB894ADCD73E6172A9FBD94
SHA-512:	4ED6C5508C77A8A3272835C6AE1323514E42D015F3CB53168382FFD78FB1A73D806AF5421378D1430ED344BA1200E3006D5AAF4150E925C1F2267A8D637A50A4
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINGDI_.#define _WINGDI_..#define WINGDIAPI DECLSPEC_IMPORT.#define WINSPOOLAPI DECLSPEC_IMPORT..#ifdef __cplusplus.extern "C" {.#endif..#ifndef WINVER.#define WINVER 0x0502.#endif..#ifndef NOGDI.#ifndef NORASTEROPS.#define R2_BLACK 1.#define R2_NOTMERGEPEN 2.#define R2_MASKNOTPEN 3.#define R2_NOTCOPYPEN 4.#define R2_MASKPENNOT 5.#define R2_NOT 6.#define R2_XORPEN 7.#define R2_NOTMASKPEN 8.#define R2_MASKPEN 9.#define R2_NOTXORPEN 10.#define R2_NOP 11.#define R2_MERGENOTPEN 12.#define R2_COPYPEN 13.#define R2_MERGEPENNOT 14.#define R2_MERGEPEN 15.#define R2_WHITE 16.#define R2_LAST 16..#define SRCCOPY (DWORD)0x00CC0020.#define SRCPAINT (DWORD)0x00EE0086.#define SRCAND (DWORD)0x008800C6.#define SRCINVERT (DWORD)0x00660046.#define SRCERASE (DWORD)0x00440328.#define NOTS

C:\Program Files\Cheat Engine 7.5\include\winapi\winnt.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	193650
Entropy (8bit):	5.442692211038205
Encrypted:	false
SSDEEP:	1536:mgqyl7JPZPZWFLvC3b+tc55bLqkI66qJ+bOaCIzxlWLp9EhxveAMimiAg9+38w8l:FvgTAw+39O8+NQkK9t/k7IM
MD5:	39AB9E1D4A6B6871FC59D837A1910566
SHA1:	CEA4A15910A1DC02AF23A06ACE7B8B7BD6E1001D
SHA-256:	0881DEBBBD1879A08341E395FA1DCED6A7B1007A80A9C6ECC831A7800C90CA02
SHA-512:	652B8695DBBF04C76DB183435FDDC21034FD9C8C10CF648A21787855417B5050580C424C4DA773676BD6A6FD8C30596D905E3C9E91E946B37EA5723FBA9DF481
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINNT_.#define _WINNT_..#ifdef __cplusplus.extern "C" {.#endif..#include <ctype.h>.#define ANYSIZE_ARRAY 1..//gr #include <specstrings.h>..#define RESTRICTED_POINTER..#ifndef __CRT_UNALIGNED.#define __CRT_UNALIGNED.#endif..#if defined(__ia64__) \|\| defined(__x86_64).#define UNALIGNED __CRT_UNALIGNED.#ifdef _WIN64.#define UNALIGNED64 __CRT_UNALIGNED.#else.#define UNALIGNED64.#endif.#else.#define UNALIGNED.#define UNALIGNED64.#endif..#if !defined(I_X86_) && !defined(_IA64_) && !defined(_AMD64_) && (defined(_X86_) && !defined(__x86_64)).#define I_X86_.#endif..#if !defined(I_X86_) && !defined(_IA64_) && !defined(_AMD64_) && defined(__x86_64).#define _AMD64_.#endif..#if !defined(I_X86_) && !(defined(_X86_) && !defined(__x86_64)) && !defined(_AMD64_) && defined(__ia64__).#if

C:\Program Files\Cheat Engine 7.5\include\winapi\winreg.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with very long lines (302)
Category:	dropped
Size (bytes):	13963
Entropy (8bit):	5.433606364599901
Encrypted:	false
SSDEEP:	384:CVb+C+ikI8n1W8l12X3ufMfkebe+XxeceAUgnhicr7Df0ff8uc/1uA1uFZNz6deF:q+C3kI8n1W8l14VzPBAf
MD5:	0F0E5CB60E379839AC67467A6FD5280F
SHA1:	0783BEC9C6F621AEDD45D2F1010740D9A6152B0A
SHA-256:	6DBB969DC21E90D9044DABCD190268C1BB33E445862CE2A4A536E9A7134FA4EB
SHA-512:	06C87AE227BF6D9C00E8404C728CC77DE9840237647605AABF197A85131E4835FF6EE96D7BEE24FD7B423C86F64D673669D2D2E8061F03473B2B0A1E10DD8BCA
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef _WINREG_.#define _WINREG_..#ifdef __cplusplus.extern "C" {.#endif..#ifndef WINVER.#define WINVER 0x0502.#endif..#define RRF_RT_REG_NONE 0x00000001.#define RRF_RT_REG_SZ 0x00000002.#define RRF_RT_REG_EXPAND_SZ 0x00000004.#define RRF_RT_REG_BINARY 0x00000008.#define RRF_RT_REG_DWORD 0x00000010.#define RRF_RT_REG_MULTI_SZ 0x00000020.#define RRF_RT_REG_QWORD 0x00000040..#define RRF_RT_DWORD (RRF_RT_REG_BINARY \| RRF_RT_REG_DWORD).#define RRF_RT_QWORD (RRF_RT_REG_BINARY \| RRF_RT_REG_QWORD).#define RRF_RT_ANY 0x0000ffff..#define RRF_NOEXPAND 0x10000000.#define RRF_ZEROONFAILURE 0x20000000.. typedef ACCESS_MASK REGSAM;..#define HKEY_CLASSES_ROOT ((HKEY) (ULONG_PTR)((LONG)0x80000000)).#define HKEY_CURRENT_USER ((HKEY) (ULONG_PTR)((LONG)0x80000001)).#define HKEY_LOCAL_MACHINE (

C:\Program Files\Cheat Engine 7.5\include\winapi\winuser.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	179678
Entropy (8bit):	5.448601521160739
Encrypted:	false
SSDEEP:	3072:jgie2EUSlwrMbtENbSJGDN4tSUez2pUQkR:jgie7wrMSSJGDfUe++
MD5:	3243B7C1189CC2C02075C2B175592EA9
SHA1:	B520F45E195A50AB00ACC161EFEC7E6620E652AF
SHA-256:	4356BFCDF5209C4EC58DE486E2173CE4B17E0CE75A422B226FDDDD18597C9905
SHA-512:	CDAA9D91F80127028DC877924D2E41B4EF55714485536C4B64955195C94E8EBFBECF9A0D7545DF535CBF4C1977CA53C14379B96ABCEBF7AEC461BCBB87EF040E
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. /.#ifndef _WINUSER_.#define _WINUSER_..#define WINUSERAPI DECLSPEC_IMPORT..#ifdef __cplusplus.extern "C" {.#endif..#ifndef WINVER.#define WINVER 0x0502.#endif..#include <stdarg.h>..#ifndef NOUSER. typedef HANDLE HDWP;. typedef VOID MENUTEMPLATEA;. typedef VOID MENUTEMPLATEW;. typedef PVOID LPMENUTEMPLATEA;. typedef PVOID LPMENUTEMPLATEW;..#ifdef UNICODE. typedef MENUTEMPLATEW MENUTEMPLATE;. typedef LPMENUTEMPLATEW LPMENUTEMPLATE;.#else. typedef MENUTEMPLATEA MENUTEMPLATE;. typedef LPMENUTEMPLATEA LPMENUTEMPLATE;.#endif.. typedef LRESULT (CALLBACK WNDPROC)(HWND,UINT,WPARAM,LPARAM);. typedef INT_PTR (CALLBACK DLGPROC)(HWND,UINT,WPARAM,LPARAM);. typedef VOID (CALLBACK TIMERPROC)(HWND,UINT,UINT_PTR,DWORD);. typedef WINBOOL (CALLBACK *GRAYSTRINGPROC)(HDC,LPARAM,int);.

C:\Program Files\Cheat Engine 7.5\include\winapi\winver.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	5381
Entropy (8bit):	5.237607493279814
Encrypted:	false
SSDEEP:	96:EtGsCwPV1Ihot5C5snyv5vdQSZWVvc22c26T9Dd1s4S/BwS9BYwJw3+wIwV4mDVC:oC4V1Ihot5CFQjs4S/BwS9BmwJp9q1PK
MD5:	F0EF1B8EE3A22C3FA3CA4DD26012E309
SHA1:	4D78773275154677A5BB66D6393636CA2418EE69
SHA-256:	7D846678EC2A8C70F86308CF6BE585D760924C620DFCFB4B048F60D88577B69D
SHA-512:	7B230B6BE986E12C639DEE195198EE87FF1E9E0895FE3C101A3E8553D272986B9800C3C74B53A89128821D2D8D439A4968E48C29B2EDA43096E48F51B871B18C
Malicious:	false
Preview:	/*. This file has no copyright assigned and is placed in the Public Domain.. * This file is part of the w64 mingw-runtime package.. * No warranty is given; refer to the file DISCLAIMER within this package.. */.#ifndef VER_H.#define VER_H..#ifdef __cplusplus.extern "C" {.#endif..#define VS_FILE_INFO RT_VERSION.#define VS_VERSION_INFO 1.#define VS_USER_DEFINED 100..#define VS_FFI_SIGNATURE 0xFEEF04BDL.#define VS_FFI_STRUCVERSION 0x00010000L.#define VS_FFI_FILEFLAGSMASK 0x0000003FL..#define VS_FF_DEBUG 0x00000001L.#define VS_FF_PRERELEASE 0x00000002L.#define VS_FF_PATCHED 0x00000004L.#define VS_FF_PRIVATEBUILD 0x00000008L.#define VS_FF_INFOINFERRED 0x00000010L.#define VS_FF_SPECIALBUILD 0x00000020L..#define VOS_UNKNOWN 0x00000000L.#define VOS_DOS 0x00010000L.#define VOS_OS216 0x00020000L.#define VOS_OS232 0x00030000L.#define VOS_NT 0x00040000L.#define VOS_WINCE 0x00050000L..#define VOS__BASE 0x00000000L.#define VOS__WINDOWS16 0x00000001L.#define VOS__PM16 0x00000002L.#define VOS__PM32

C:\Program Files\Cheat Engine 7.5\is-04JI4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16718264
Entropy (8bit):	6.110071636301838
Encrypted:	false
SSDEEP:	393216:sjcp4nsiRMX7ZbqE14ImAfltGYav/HX8h:bbqE1RmLvvY
MD5:	EDEEF697CBF212B5ECFCD9C1D9A8803D
SHA1:	E90585899AE4B4385A6D0BF43C516C122E7883E2
SHA-256:	AC9BCC7813C0063BDCD36D8E4E79A59B22F6E95C2D74C65A4249C7D5319AE3F6
SHA-512:	1AAA8FC2F9FAFECBE88ABF07FBC97DC03A7C68CC1D870513E921BF3CAEAA97128583293BF5078A69AECBB93BF1E531605B36BD756984DB8D703784627D1877D1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./.......{..........=........@......................................e.......................................................p...........................k..................................p.\|.(.......................H............................text.....{.......{................. ..`.data.........\|.......{.............@....rdata...xa......za................@..@.pdata...............n..............@..@.bss.........P...........................CRT.........`.......&..............@....idata...b...p...d...(..............@....rsrc............ ..................@.../4..................................@..B........................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-0K02L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1882
Entropy (8bit):	4.658116184932645
Encrypted:	false
SSDEEP:	24:60wIlJhxWXs/2h8OjrGCLyO7OjO6NsVhVyQk7FUBL9HuTsx0refVS+IsZZsznGd2:HTP8gE8OvnKy6NsVu7FYLswlW/
MD5:	CC0F8B66BFEDC67DA8DBB2A7DF2AA006
SHA1:	C6D86CC43A042581E389DC9A28AFFDDF64294AC8
SHA-256:	CDDD0F35F7351E6F19486CCD7EEE5D31F0134C5C3554A12C7D51131DDE8E29CD
SHA-512:	A4AEC40AC6BEA2ADACF15829AEEEBE66117473A542303024669A828710C6AFD072C0F4890A6A334B35AC894A1A80A5BDD5E91A6FFCB7149540E304117A7E5800
Malicious:	false
Preview:	#write down modulenames that are commonly used by games..#this decreases the number of wrong results in various types of memory inspection....1911.dll..speedtreert.dll..visionengineplugin.vplugin..vision90.dll..vbase90.dll..nvscpapi.dll..physxcore.dll #nvidia physx..nxcooking.dll..physxloader.dll..physxextensions.dll..cudart.dll..openal32.dll..vorbisfile.dll..ogg.dll..vorbis.dll..vorbisenc.dll..vorbisfile.dll..binkw32.dll..bink2w64.dll..iconv.dll..gameoverlayrenderer.dll #steam..steam_api.dll..steam_api64.dll..steamclient.dll..steamclient64.dll..tier0_s.dll..vstdlib_s.dll..steam.dll..steam2.dll..mss32.dll..dbghelp.dll..umbra.dll..unrar.dll....#CE dll's..cehook.dll..allochook.dll..allochook-x86_64.dll..allochook-i386.dll..vehdebug-i386.dll..vehdebug-x86_64.dll..speedhack-i386.dll..speedhack-x86_64.dll..luaclient-i386.dll..luaclient-x86_64.dll..d3dhook.dll..d3dhook64.dll..ced3d9hook.dll..ced3d9hook64.dll..ced3d10hook.dll..ced3d10hook64.dll..ced3d11hook.dll..ced3d11hook64.dll..luaclient-

C:\Program Files\Cheat Engine 7.5\is-1HAUB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12807608
Entropy (8bit):	6.604078603198481
Encrypted:	false
SSDEEP:	393216:ueBcnBaXXA3MnU+239JmqUKSw6knnbWUuMu25s8U:uis/c2GF
MD5:	5BE6A65F186CF219FA25BDD261616300
SHA1:	B5D5AE2477653ABD03B56D1C536C9A2A5C5F7487
SHA-256:	274E91A91A7A520F76C8E854DC42F96484AF2D69277312D861071BDE5A91991C
SHA-512:	69634D85F66127999EA4914A93B3B7C90BC8C8FAB1B458CFA6F21AB0216D1DACC50976354F7F010BB31C5873CC2D2C30B4A715397FB0E9E01A5233C2521E7716
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................./......&h..t...q...<.......@h...@.................................$........................................P...........................k..................................P@h......................\..L............................text....&h......(h................. ..`.data....t...@h..v...,h.............@....rdata..X.B...u...B...u.............@..@.bss.....q...............................CRT.........@......................@....idata...H...P...J..................@....rsrc............ .................@.../4..................................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-1U45L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3223968
Entropy (8bit):	6.338087367720092
Encrypted:	false
SSDEEP:	49152:vdx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEjT333TYfx:0HDYsqiPRhINnq95FoHVBT333T+
MD5:	9AA2ACD4C96F8BA03BB6C3EA806D806F
SHA1:	9752F38CC51314BFD6D9ACB9FB773E90F8EA0E15
SHA-256:	1B81562FDAEAA1BC22CBAA15C92BAB90A12080519916CFA30C843796021153BB
SHA-512:	B0A00082C1E37EFBFC2058887DB60DABF6E9606713045F53DB450F16EBAE0296ABFD73A025FFA6A8F2DCB730C69DD407F7889037182CE46C68367F54F4B1DC8D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...oGXb.................B,.........`V,......`,...@...........................1......u1...@......@....................-.......-..9....................0..k....................................-.......................-.......-......................text.....,.......,................. ..`.itext...(...0,..*....,............. ..`.data........`,......F,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-...... -.............@..@.rsrc................"-.............@..@..............1.......0.............@..@........................................................

C:\Program Files\Cheat Engine 7.5\is-27N0B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	183200
Entropy (8bit):	6.842191242335636
Encrypted:	false
SSDEEP:	3072:KAm/u5ImKJacvUOQC2mCDiGuTEG2BiERGNcCYOqtwyROYeoHVP0bkHnP0z:Niu5MJa9hZun2BiERaEwyOM2Qsz
MD5:	F1C9C9A8B035DA9385D88CA34CD49305
SHA1:	77E48F73C224949EC8BD8A32087609B7BF217E94
SHA-256:	4168D6408994A297665AEEA68ABB6C062D58EA00851751959557E7F8A8BAC17D
SHA-512:	D7BD2FC8592E18CA46CDF1DC74496CF3CB5EF991F4BD9E141DEEABA0F665E731A5953CAAF1CD39859817EB6D0C1B77700FE08EEED15320757B3FA36D798C4C7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......cK..'..'..'....[.-....Y....uB.....uB..6..uB..5....X.=....a.,..'..V...C..!...CU.&...C..&..Rich'..................PE..L....(.c............................$U............@.................................(D....@..................................F..x....p...............`...k......d....7..p............................7..@............................................text............................... ..`.rdata..^...........................@..@.data........P.......@..............@....rsrc........p.......J..............@..@.reloc..d............L..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-4H8E2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	262552
Entropy (8bit):	6.029187209935358
Encrypted:	false
SSDEEP:	3072:JViiO5Ea9m3XJusq4opSm7Im9SC2w/iKhF58jfq65bgusSVIRZOl0vDoD4CfOMsj:JVZcWJusRPm7kCdKfkkApZt
MD5:	19B2050B660A4F9FCB71C93853F2E79C
SHA1:	5FFA886FA019FCD20008E8820A0939C09A62407A
SHA-256:	5421B570FBC1165D7794C08279E311672DC4F42CB7AE1CBDDCD7EEA0B1136FFF
SHA-512:	A93E47387AB0D327B71C3045B3964C7586D0E03DDDB2E692F6671FB99659E829591D5F23CE7A95683D82D239BA7D11FB5A123834629A53DE5CE5DBA6AA714A9A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...G O......h...`...............................................J^..................................................@.......P............`...-.......g..........................................................P................................text... O.......P.................. ..`.data........`.......T..............@....rdata..l............n..............@..@.pdata...-...`.......F..............@..@.bss....h................................CRT.................t..............@....idata...............v..............@....edata..@...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-5DOON.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	140184
Entropy (8bit):	6.5832665674944435
Encrypted:	false
SSDEEP:	3072:6UoPePVhoZB34/UWFdQomnRepTPFn35eoONSO2:j8ZBvWrnmnR2Un+
MD5:	61BA5199C4E601FA6340E46BEF0DFF2D
SHA1:	7C1A51D6D75B001BA1ACDE2ACB0919B939B392C3
SHA-256:	8783F06F7B123E16042BB0AF91FF196B698D3CD2AA930E3EA97CFC553D9FC0F4
SHA-512:	8CE180A622A5788BB66C5F3A4ABFDE62C858E86962F29091E9C157753088DDC826C67C51FF26567BFE2B75737897F14E6BB17EC89F52B525F6577097F1647D31
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.k6...e...e...e...e{..e...e...e...e9..e...e...e..e...e...es..e...e...e...e...e...e...eRich...e........PE..d...p..S.........." .....4...........b....................................... .......1....@......................................... ...b...D...P........................g......h...@S...............................................P...............................text....2.......4.................. ..`.rdata...L...P...N...8..............@..@.data....<..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-6LSG2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	309664
Entropy (8bit):	5.8237432164000404
Encrypted:	false
SSDEEP:	6144:TDwf7I4zq0ZDVQ5uIqp5rkenPajp80Gc5:T0f7Bz/G5uImQaPajp3
MD5:	59089C96334966EDFFC70BF4AE829910
SHA1:	8DC37D6F2364749D52DB1BCB9AD9FE30FB93930D
SHA-256:	49A55638C5A0F8112B89C45A24A2BCD102FF5DE2D22386649D7F6FFD283AF1FD
SHA-512:	3EDD411905298FDE78DF57B063B4B2000FA2D16F0E1A14E8940D4FBC2226C1CBA6925C47D3BECC10E76BBA9C5864CF671F5EF3B29CFA430823D0FA9BF9BBC3A9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........................e.......).. .............@.........................................................................`..d....p...............N...k......\|...........................P........................b...............................text....e.......f.................. ..`.data................j..............@....rdata...~..........................@..@.bss.....)... ...........................CRT.........P......................@....idata.......`......................@....rsrc........p......................@....reloc..\|........0..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-76J7R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1113504
Entropy (8bit):	5.932626447270598
Encrypted:	false
SSDEEP:	12288:3+hKmLazchlUT5PzJXmGFYKUeMzkMz7S480UJ+RNdO24a/s0X4G:Uy4n8VWGQdS480U4RN20X4G
MD5:	CCD151D8EE8ED05AA0E1D9142FD6E438
SHA1:	8D343BBC1A6F2D5D9ED8813427635696291C8F0D
SHA-256:	5C929F453DB7F0703BC8F939E39D48C79ECAB9E453918E5D0CD136C8026474CC
SHA-512:	DCB0B9A9B2908D5D55214F6A261B0A8C08889603CFABC327A7A82387012925BBF486B5C28B5250E9449FF9758748A021023C99EE02B59ABBB7B3C979A06DAEB4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0.Z't.4tt.4tt.4t..0ux.4t..7ur.4t..1u.4t.3.t~.4t&.1ui.4t&.0ue.4t&.7u~.4t..5uw.4tt.5t).4t..0uu.4t..1uu.4t..4uu.4t...tu.4t..6uu.4tRicht.4t........PE..d.....6c.........." .....\..........o........................................ ............`.............................................d......(.......<.......\........k..........@...8............................................................................textbss.A...............................text....Z...`...\.................. ..`.rdata...@.......B...`..............@..@.data...............................@....pdata..X...........................@..@.idata..r............Z..............@..@.msvcjmc8............l..............@....00cfg...............n..............@..@.rsrc...<............p..............@..@.reloc..7............v..............@..B................................................................

C:\Program Files\Cheat Engine 7.5\is-7DIKH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	271256
Entropy (8bit):	6.040002515360521
Encrypted:	false
SSDEEP:	6144:XcxPVJy83/NkY56owwouBQGsyTfkaiX6P0a:XkPV483FB56wsyTfkOJ
MD5:	F9C562B838A3C0620FB6EE46B20B554C
SHA1:	5095F54BE57622730698B5C92C61B124DFB3B944
SHA-256:	E08B035D0A894D8BEA64E67B1ED0BCE27567D417EAAA133E8B231F8A939E581D
SHA-512:	A20BC9A442C698C264FEF82AA743D9F3873227D7D55CB908E282FA1F5DCFF6B40C5B9CA7802576EF2F5A753FD1C534E9BE69464B29AF8EFEC8B019814B875296
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....d..t....-...........................................0.................................................................P........................g......h.......................................................0............................text....d.......f.................. ..`.data...t............j..............@....rdata..............................@..@.pdata...........0...`..............@..@.bss.....-...............................CRT................................@....idata..............................@....rsrc...............................@....reloc..h...........................@..B........................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-7NK6B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	386976
Entropy (8bit):	6.870368063282166
Encrypted:	false
SSDEEP:	6144:359aKWK/HqY5AXeWEfv6TBr4udWNrzJD10P9TQmxhAIXiCUXEC+Y4r/w2MGkTkm/:J9WsHse9fvcBrnd8rzZ10eMhEChC+Ygi
MD5:	486237BC5FA41DCE8C3022B9B6221FE5
SHA1:	C00BA51895DEAB2054C6F0F7DD3CF397E119C6FE
SHA-256:	4E2C87700CCDD3B34215C6BC64AE4582AC5FF373CFD3E93E8F7D2016960BA80D
SHA-512:	5F4010D8F9B0C865DE209E90625F178C8A7370AF1F7BE85552147EBD9EE7D033B01DD5A277FB646E2D289D2821462ADBB0959E507CD0A044CE79CB1C526A385B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*...y...y...y...x...y...x4..y...x...y./.y...y...x...y...x...y...x...y...x...y...y..y...x...y...x...y..1y...y...x...yRich...y........................PE..L...;.6c...........!.....f...N......D.....................................................@..........................B......$F..(....................\|...k.......7...8..p...........................p8..@...............D............................text...[d.......f.................. ..`.rdata..t............j..............@..@.data....E...P.......8..............@....rsrc................B..............@..@.reloc...7.......8...D..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-7TSFI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	541592
Entropy (8bit):	6.56379573889746
Encrypted:	false
SSDEEP:	6144:FshVOadaiL9mUHQMpgL8LgpqClZNKX6SumisBEb/NUidzSky3uDMK/LXTMBQqN5T:hOL9J2L8E5VKKSuLGEhXGstCXoYkc7BV
MD5:	B7C9F1E7E640F1A034BE84AF86970D45
SHA1:	F795DC3D781B9578A96C92658B9F95806FC9BDDE
SHA-256:	6D0A06B90213F082CB98950890518C0F08B9FC16DBFAB34D400267CB6CDADEFF
SHA-512:	DA63992B68F1112C0D6B33E6004F38E85B3C3E251E0D5457CD63804A49C5AA05AA23249E0614DACAD4FEC28CA6EFDB5DDEE06DA5BFBFA07E21942976201079F3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p.............q.R.....q.P.....q.Q.....y......y......y.......i0............Vx......Vx......Vx\.....Vx......Rich............PE..d....w._.........." .................:....................................... ......&.....`.........................................0f..p....t..(................Q.......g......\.......p............................................................................text............................... ..`.rdata..............................@..@.data...8............n..............@....pdata...Q.......R...\|..............@..@.rsrc...............................@..@.reloc..\...........................@..B................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-81GE3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	443296
Entropy (8bit):	6.630155817797785
Encrypted:	false
SSDEEP:	6144:bdQpG4IhjOSudLX4PGUGTdVwYr9ABfpMqYFOso5WMKYnTrLxWAld/wydfCigAA:apG4w5upwGTv9GWov1nlVAV
MD5:	0C7D89B75430A40824A5D7B79890324E
SHA1:	7E03E3D5386B1ED49104C3B35E44A545863BCBB9
SHA-256:	6B21B24279309F4117F8E39CDAF940F645C15D92442990A77655C8F898BB2227
SHA-512:	31453A2575FD7674AC7802DC8F740C79D357AD3464869F6EFD5E4A3892114EE9767715EBCA0D39E5B39CA8DA7BFED7E671D3EB24DBFB698C57ECA196D4FDFC85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H.mD............i.......i.......i........K......^.......^.......^.......i...........R...................................Rich............PE..d...8.6c.........." ................ %..............................................`{....`.........................................`........!..(................1...X...k...... .......p............................................................................text............................... ..`.rdata...).......*..................@..@.data...RX...0......................@....pdata...1.......2..................@..@.rsrc................N..............@..@.reloc.. ............P..............@..B........................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-87427.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	data
Category:	dropped
Size (bytes):	28924
Entropy (8bit):	7.991784495689372
Encrypted:	true
SSDEEP:	768:SSHnnhPVVYCzrpCuqOMWlPLe1uvY1R78Occgok:SSHnnJDXZY1RgOccK
MD5:	FE3637780172B207CB31BB3DC612CD34
SHA1:	B65FA4078DCB813EBBA16784C80BC7A0E71025DD
SHA-256:	080A0AE9634FB07F2E9B1DDEA31491564195865DCD2B6201E1A10A13E8CDD5E9
SHA-512:	8F1DA48E6F224B7E7E6EF26D11D3C484A254E9A335DA9E59B837A81F9B7DB501039F31EF9AD055A07BB139BC1147C114923742C3204156AE3371A0F225A433CC
Malicious:	false
Preview:	CEPACK......x.E.0..$.0I..`.........M......&...!.w...eC7.J .q.)Zq..u..^Y...z..+?.8C0!..T@A.k......0..s.g.......<....%.tuU.:u...SU..+...9.......3......./}...WS.....).{.Y....g..?....?...L...C9..Os..iN."w.O~..[..Rsc8~.u....3.....<s....L+s...+...3.3...............3s.{..^.s-..'.-0%r.n..2...%.F.R8.I..a.LxX..\|...=...ci...cb....&.v41@..t...gy..V.7..a.....r..\..k...\j...o..Z/.{..#..Xc......xPz..2...>.~.....:n5...7..x.....Z.....n..+.....h.....t............W....j.8..m.s.k/.e\..Jc}.. W......:8z....C.i[s..9..qz.........[Z6.~.k..7....!...Tk....u...;8m3.U....\|.y_.+x...A..f@6...p........I.....z..<.p.L.@.K?.a.0..O....... ..f..d0.w.>N-..E.w...L.-.b.g....{..K@.....gf.T (>.&.c..)o)7aQ#$.<.@2;.Y.......u.Wu.-....J.\hv.j..V..,.Kv.2.s.N...g.X......mf@P.....k....Q..../...Fj.5.........X{h............r...`.q+U.\.=..,Yf..).....dV..a..m.@..'iQVP....e..3.../v`@{ ..<C&...\|\|........3..7....<.)....u+6:2.V..{......B.]ibU.r.........H*.ea..M.E.ct.m.r.+}f..X2 . ...

C:\Program Files\Cheat Engine 7.5\is-8G4IN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	266648
Entropy (8bit):	6.017604835530295
Encrypted:	false
SSDEEP:	3072:KK2iOI60nWU4NJ4twEywGLOJQbcOL9z32fY8iV1OQfkz5w4Q7hk1D2oOyPOP:KKu0WU4J0w6xJkBAY8i7fkaThkA4g
MD5:	DD71848B5BBD150E22E84238CF985AF0
SHA1:	35C7AA128D47710CFDB15BB6809A20DBD0F916D8
SHA-256:	253D18D0D835F482E6ABBAF716855580EB8FE789292C937301E4D60EAD29531D
SHA-512:	0CBF35C9D7B09FB57D8A9079EAB726A3891393F12AEE8B43E01D1D979509E755B74C0FB677F8F2DFAB6B2E34A141F65D0CFBFE57BDA0BF7482841AD31ACE7790
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".... Z..........`........................................ .......U..........................................................P............p.. ........g......0...................................................@................................text... Z.......\.................. ..`.data........p.......`..............@....rdata...............z..............@..@.pdata.. ....p...0...T..............@..@.bss.....................................CRT................................@....idata..............................@....edata..............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-8HLKV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	140696
Entropy (8bit):	6.856834819192468
Encrypted:	false
SSDEEP:	1536:onOLYqoZQBD3m7bmVLcuVGpGXlWXQznQN8erRxQEmsYOT1GlERbo3iV8n/7DkCWy:o4YqoZNHi7VBAXvXMZ7ll3iyn3WOR3Oc
MD5:	42E2BF4210F8126E3D655218BD2AF2E4
SHA1:	78EFCB9138EB0C800451CF2BCC10E92A3ADF5B72
SHA-256:	1E30126BADFFFB231A605C6764DD98895208779EF440EA20015AB560263DD288
SHA-512:	C985988D0832CE26337F774B160AC369F2957C306A1D82FBBFFE87D9062AE5F3AF3C1209768CD574182669CD4495DBA26B6F1388814C0724A7812218B0B8DC74
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s.u...&...&...&.@r&...&.@d&...&.@c&...&=.,&...&2@{&...&...&...&.@m&...&.@u&...&.@v&...&Rich...&........................PE..L...~..S...........!.....@...z......*l.......P......................................x.....@.........................`...G...l...P........................g...........Q.................................@............P..X............................text....>.......@.................. ..`.rdata...E...P...F...D..............@..@.data....1..........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-9UL4R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33688
Entropy (8bit):	7.20956664617613
Encrypted:	false
SSDEEP:	768:zVYdpNkp9TvDXy2XmVEV3GPkjVvDXy2ulqwVEV3GPkjL:zVY1+nCDOEECDbOEw
MD5:	4ACE42D6530AF699FEB2372F805A6A40
SHA1:	FB8C7352808F104E851468F25D0DD14A25B8CFCA
SHA-256:	13DCE393B59B9EF4A5D4FCDC27267D018B350BDC44A62AACC5DBC7F1DF7F7A1C
SHA-512:	8BB770F304CD8BA23FB2A64370D74AC3FDC134235FF39802983B9BABDE12AB00E49A746F3C2113520F0E135CDFD1473C0B4B64272279D13E576912126AA556D2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..............." ..0............."3... ...@....... ....................................`..................................2..O....@...................g...`...... 2..8............................................ ............... ..H............text...(.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................3......H........"..............................................................R..{....o.....o....&&...}......0............r...p(......,.....r...po.......8.....{.....o......{....r...p(........,..{.....{....o.....r;..p(.......{..........%...o......o....o...........,e....+F....o......o....o........(....rI..p.o......o....o....(....o........X.....o....o..........-...+....+....(.......s ...}.....{.....o!.....{.....o".....0............\|....(#.....,..\|....($....*....0..............(%..

C:\Program Files\Cheat Engine 7.5\is-A30LA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	308120
Entropy (8bit):	6.921402988579037
Encrypted:	false
SSDEEP:	3072:3QMsoykzuYV4SPaa/Gr+RBmRQ5wipE04CIcFw6eAwE5Sm1Q5jsV+XkO4qOT:3NJyTuxkC57IZEzGmT
MD5:	462322CC93E55016D5EA78B2B9823657
SHA1:	3E8E00B690A4370D6F2DFDCF730F2D3FDA4806A6
SHA-256:	AEDC048FCFEC594E7307E4730D850E5E0121820A76CA1A363F4A2E41D084F393
SHA-512:	A46E56130A8D1CA588D9935D98468543328B42492F1257157D2C7FD99AC341E8A22337AC2228AECF33A70913A7E7161B300BB458E1C07D5D0B94A7AA1DD72D79
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t...t...t.....q.q...y.W.P...y.i.b...y.V......D}.}...t...+....%R.\....%j.u...y.m.u....%h.u...Richt...........................PE..L...h.&V...........!.....p................................................................@.....................................d....P...............L...g...`..@E......8...............................@...............T............................text....o.......p.................. ..`.rdata...v.......x...t..............@..@.data....@..........................@....rsrc........P......................@..@.reloc..@E...`...F..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-A5OSQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	206232
Entropy (8bit):	6.577803539808585
Encrypted:	false
SSDEEP:	6144:ZyuXZus0fJ34+UZQ5IvR2diworEdVpRmY:nXZgV4dkIJfrEdVt
MD5:	DE625AF5CF4822DB08035CC897F0B9F2
SHA1:	4440B060C1FA070EB5D61EA9AADDA11E4120D325
SHA-256:	3CDB85EE83EF12802EFDFC9314E863D4696BE70530B31E7958C185FC4D6A9B38
SHA-512:	19B22F43441E8BC72507BE850A8154321C20B7351669D15AF726145C0D34805C7DF58F9DC64A29272A4811268308E503E9840F06E51CCDCB33AFD61258339099
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#........t...D)..0........ ...............................@..................................................P........................g.......#...................................................................................text............................... ..`.data...t.... ......................@....rdata..0d...@...f... ..............@..@.bss....D)...............................CRT................................@....idata..............................@....rsrc...............................@....reloc...#.......$..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-AATAN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	446368
Entropy (8bit):	6.635233277412147
Encrypted:	false
SSDEEP:	6144:aSn7zUunHkqypGYKKOyt8GMyKw0ORVdPpEPwkdRHhvOOZoU/wC/cQBi4Blb:nzU8E9GDWKMRPAZhvpoUOo
MD5:	069EC7832ADBF93BD04A91B07FF00D78
SHA1:	5ED84D13FFCEF487EB039CD75DE91294C25ED0CC
SHA-256:	8C8C608AE67F8B8A4E56DAF2EDEA1A92CBA6866D4F324BD0E5AD1284126849A7
SHA-512:	D9E9D40DE2509B112762ADE7EF0BB6DB91EB5687AE6EA9689ABD7A7AF8BA601297655587EEF34F7D1DAC62D77E5B586BE71B19F044EBF53028CFE90DDCE776F8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................................8...Fk...................................................S...........Rich...........................PE..d...=.6c.........." ......................................................................`..........................................'.......*..(................1...d...k..............p............................................................................text...`........................... ..`.rdata...3.......4..................@..@.data....X...@......................@....pdata...1.......2...(..............@..@.rsrc................Z..............@..@.reloc...............\..............@..B........................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-AJB6K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	205720
Entropy (8bit):	6.5406944146931805
Encrypted:	false
SSDEEP:	3072:KNyaW1Pg7kFtOp8+vRha0DAyheYn13qaIhRFXOucMEx33sOZrcOo:KNyal78m8+vRMEe4a4OEtTi
MD5:	6E00495955D4EFAAC2E1602EB47033EE
SHA1:	95C2998D35ADCF2814EC7C056BFBE0A0EB6A100C
SHA-256:	5E24A5FE17EC001CAB7118328A4BFF0F2577BD057206C6C886C3B7FB98E0D6D9
SHA-512:	2004D1DEF322B6DD7B129FE4FA7BBE5D42AB280B2E9E81DE806F54313A7ED7231F71B62B6138AC767288FEE796092F3397E5390E858E06E55A69B0D00F18B866
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...G ........)...........0...............................@..........................................@.......P........................g......."......................................................h............................text... ........................... ..`.data........0......................@....rdata..._...P...`...*..............@..@.bss.....)...............................CRT................................@....idata..=...........................@....edata..@...........................@..@.reloc...".......$..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-APHCK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	data
Category:	dropped
Size (bytes):	132
Entropy (8bit):	6.551821770808043
Encrypted:	false
SSDEEP:	3:SNjBeQx+FGOujzBAk+skvy2a4nfJKnBTa6C:+jkk+dsAk+Fzag+BTab
MD5:	ADAFB7CDCA51FC803718F25172652DD3
SHA1:	DD882B60A842B0992F478349898415A857934330
SHA-256:	B1B61B2570DBAF2747C4862B8429424514D300A7E14B5065C8BBB4B751179E7E
SHA-512:	D0B3D17F0F1EFB8F2F0BCAA1295AED08043F0218BCFA092A47D46308911EC4BC2441711CAB300B852DE3DBCED1C83536750B1A77A75EAE5C8CBF95991AA88714
Malicious:	false
Preview:	.CaG.(9......q.5..4S..%..+...U*.>{5.......M.....-..kF.....7.."z..W.Lc...."6/.V.N..p.YC?...:m.D.k.T....u.0...c.U.h...\;1`.`B..

C:\Program Files\Cheat Engine 7.5\is-ASU18.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	122776
Entropy (8bit):	6.859839225631497
Encrypted:	false
SSDEEP:	1536:QyfNvGKKZVGcuasOKQBBTff07PSZHCSVKOCDCA32XQaOCKnOEPChMOE6:lNvG7vGcIiBTMS18RD7325YO/hMOr
MD5:	2A2EBE526ACE7EEA5D58E416783D9087
SHA1:	5DABE0F7586F351ADDC8AFC5585EE9F70C99E6C4
SHA-256:	E2A7DF4C380667431F4443D5E5FC43964B76C8FCB9CF4C7DB921C4140B225B42
SHA-512:	94ED0038068ABDDD108F880DF23422E21F9808CE04A0D14299AACC5D573521F52626C0C2752B314CDA976F64DE52C4D5BCAC0158B37D43AFB9BC345F31FDBBC0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............h...h...h...:U..h...:D..h...:R..h..\|....h...h...h...:[..h...:@..h..Rich.h..........PE..L...}..S...........!.........j.......K....... .......................................d....@..................................L..<....................x...g...........!..............................XB..@............ ..\|............................text............................... ..`.rdata...5... ...6..................@..@.data...<0...`.......D..............@....rsrc................X..............@..@.reloc..h............Z..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-AUJ8A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	144280
Entropy (8bit):	6.553148474736184
Encrypted:	false
SSDEEP:	3072:Kd3u82FbW5v1B9omLKfBbYWFhFCsfa5z8saPFZ1sL3OD1Ow:Kd+NFbWUMKfBTjFxfa5a1y4N
MD5:	0DAF9F07847CCEB0F0760BF5D770B8C1
SHA1:	992CC461F67ACEA58A866A78B6EEFB0CBCC3AAA1
SHA-256:	A2AC2BA27B0ED9ACC3F0EA1BEF9909A59169BC2EB16C979EF8E736A784BF2FA4
SHA-512:	B4DDA28721DE88A372AF39D4DFBA6E612CE06CC443D6A6D636334865A9F8CA555591FB36D9829B54BC0FB27F486D4F216D50F68E1C2DF067439FE8EBBF203B6A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q..7...d...d...d..Vd{..d..@d...d..Qd9..d...d...d.Id...d...dq..d.._d...d..Gd...d..Dd...dRich...d........PE..d...p..S.........." .....F...........t.......................................0............@.........................................p...G......P........................g... ..h...0c...............................................`...............................text...fD.......F.................. ..`.rdata...J...`...L...J..............@..@.data....<..........................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-BQRFH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	242616
Entropy (8bit):	6.432754517349666
Encrypted:	false
SSDEEP:	3072:Bj9mOBuELLZXBJPCR6ygny56rs+iO2AwCNCtALb44TPk3Ap1rleY/DptNH/P0uHV:fn7LhBJ9W56A+iOlfN/LbZnbptN0uZH
MD5:	9AF96706762298CF72DF2A74213494C9
SHA1:	4B5FD2F168380919524ECCE77AA1BE330FDEF57A
SHA-256:	65FA2CCB3AC5400DD92DDA5F640445A6E195DA7C827107260F67624D3EB95E7D
SHA-512:	29A0619093C4C0ECF602C861EC819EF16550C0607DF93067EAEF4259A84FD7D40EB88CD5548C0B3B265F3CE5237B585F508FDD543FA281737BE17C0551163BD4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........H..................$...t.................@.............................................................................d....................H...k..................................P.......................4................................text............................... ..`.data...$...........................@....rdata..............................@..@.bss....t....P...........................CRT.................,..............@....idata..............................@....rsrc................:..............@.../4......$............F..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-DSBVA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	306758
Entropy (8bit):	7.936079952495831
Encrypted:	false
SSDEEP:	6144:/UuFqUYSsTDiKebI7F03RPf2rB84daXcXrcURJo8tGgqQdB5+cbsQe/zQXE9LA2:tFhYSsnl0I7FG8S4daC/RGg1bnerQILf
MD5:	BB80FEC3B6E843B61859914480706CD9
SHA1:	0CED874BEE5BDA6059B5195911AA117693D9D2DE
SHA-256:	2D52F9D59211F8906ACE16525721B1400343BDF720F062CF111D84089F129009
SHA-512:	78D8A024DABD111B59BEEA4DC21150C7FBB3A6924201D2F3FF9E720E4BBC967BBFF285BA2064BC35C260FFDE433C639FDC0252C47AE29B43398117EDA21CF648
Malicious:	false
Preview:	ITSF....`........2.........\|.{.......".....\|.{......."..`...............x.......T0.......0..............F...............ITSP....T...........................................j..].!......."..T...............PMGLS................/..../#IDXHDR..t.../#ITBITS..../#IVB...B.,./#STRINGS...O.r./#SYSTEM..v.6./#TOPICS...t.../#URLSTR...t.[./#URLTBL...t.../#WINDOWS...2.../$FIftiMain...<..8./$OBJINST...}.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property...y../$WWKeywordLinks/..../$WWKeywordLinks/BTree..z.L./$WWKeywordLinks/Data...F.../$WWKeywordLinks/Map...G../$WWKeywordLinks/Property...Y ./0-ptaddresslist.html...8.S./1-ptmemoryview.html......./2-ptondebugevent.html...".../3-ptprocesswatcherevent.html...;.i$/3Dpinballforwindowspointercode.html.....s /4-ptfunctionpointerschange.html...$.2./5-ptmainmenu.html...V.]./aa_addextracommand.html...v.../aa_removeextracommand.html......./About.html...q."./Aboutb1.JPG...*.i./AboutCheatEngine.html.....U./Aboutthedebugger.html.....V./address.html...9.../Ad

C:\Program Files\Cheat Engine 7.5\is-DSI7G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2086
Entropy (8bit):	4.748005607182281
Encrypted:	false
SSDEEP:	48:HZooJUJAimKakohOgM4TDB6liofD0x6g8W:HioemKakaOgM4J6l5C6g8W
MD5:	650C02FC9F949D14D62E32DD7A894F5E
SHA1:	FA5399B01AADD9F1A4A5632F8632711C186EC0DE
SHA-256:	C4D23DB8EFFB359B4AA4D1E1E480486FE3A4586CE8243397A94250627BA4F8CC
SHA-512:	F2CAAF604C271283FC7AF3AA9674B9D647C4AC53DFFCA031DBF1220D3ED2E867943F5409A95F41C61D716879BED7C888735F43A068F1CC1452B4196D611CB76D
Malicious:	false
Preview:	//credits: ms d3d tutorials which I hacked apart....Texture2D txDiffuse : register( t0 );..SamplerState samLinear : register( s0 );....cbuffer ConstantBuffer : register( b0 )..{....float4x4 rotation;.. float2 originpoint;...float2 translation;...float2 scaling;...float transparency;....float garbage;...}..........//--------------------------------------------------------------------------------------..struct VS_INPUT..{.. float4 Pos : POSITION;.. float2 Tex : TEXCOORD0;..};....struct PS_INPUT..{.. float4 Pos : SV_POSITION;.. float2 Tex : TEXCOORD0;..};......//--------------------------------------------------------------------------------------..// Vertex Shader..//--------------------------------------------------------------------------------------..PS_INPUT VS( VS_INPUT input )..{.... PS_INPUT r=input;.. float4 rp;........ r.Pos[0]-=originpoint[0];.. r.Pos[1]+=originpoint[1];.. r.Pos=mul(r.Pos, rotation);.... r.Pos[0]+=originpoint[0];.. r.Pos[

C:\Program Files\Cheat Engine 7.5\is-EJPQ1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	data
Category:	dropped
Size (bytes):	99199
Entropy (8bit):	7.9924368254113025
Encrypted:	true
SSDEEP:	1536:CGNxLS1cRzW1Dx15WXGNp7u4A3AP6ovMlJEyWYykDQdTkQRWMJv2kXWMFopxLZq5:QcFW1DdDrTP6o0jEyERskXepHqz9
MD5:	EC8679FCB11314E333F6518113F1D71E
SHA1:	F6642D2551238733324141810B12C964FFE3B518
SHA-256:	45CFE56AE9CBB58FC51700425A19771C87029F63CB1A96CB258AEBE6AEE9D37A
SHA-512:	71EF7CBACD90317D32B0E4E81F64B6A4BABF644A1391396E9FF6C000C902660CFE87E5A86DF456EF5FB2DE0E6688BBF0778AB917D98BC86FB81AEA658672B4DB
Malicious:	false
Preview:	CEPACK.....}}\|S.....m....B..k...U7.....Q.@..u.a...V.`...zz..6.~u..'.lCe...(i...2M)....dzK.F.m(.....4.....~....M..s...<.y.s.M.]>F.0..O,.0-..W.......?.....\......+.>..p].c.........9...@a......-\r...G.[......U....,c.R..1.>..O...53.fI)..7.2L..S..N..U.W..DD.\|..,~...SJcz....z.,.......4.Sz...t....lrb..G.P........}.....C..@.>..;t).......e...#.._..+.....c.i.....W......?.z..........-i.ui.U.......Z3....[.....O.b........I.....4..x.&n...h..4.bM.:M\|.&.@./..h.VM\|.&^.....Wk..h..i.k4....:M..o..5.:M.A.o....}.........fM\|.&.U...o..wh.-..nM.....4.x@.?...5..x.&~Z..5..M<...j..M<..3...9M...5q.&....h..5.BM......i...u..\|M\|.&^../....2M.B._............h.k5.5.u..S...Wk.u.x.&..&.......7k.[4..6M\|.&.C.oI..k./m\|s.o..9....%.(.Mu..N-b..s/..!1.V.).s<~\....d...U...m..((...\|._...{...y70/.A.X....b... ....@:..l3..tdT`....b...>Z..!......~.'....G:XF...H\."....%...T.+^x~.....?b.......}S...0........+.9UP.l...........v.O..].?...6.....g1.s.i...,.0..[...<.C.

C:\Program Files\Cheat Engine 7.5\is-ERBSE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	187288
Entropy (8bit):	6.46399109534477
Encrypted:	false
SSDEEP:	3072:XMTS4QqrM7BqUHEwXDVT6B8AF6aBBcFkLODeYJObCkEjOUkOG:XIQqrc7V5Trw6aBBcFk6CtbID4
MD5:	4A3B7C52EF32D936E3167EFC1E920AE6
SHA1:	D5D8DAA7A272547419132DDB6E666F7559DBAC04
SHA-256:	26EDE848DBA071EB76C0C0EF8E9D8AD1C53DFAB47CA9137ABC9D683032F06EBB
SHA-512:	36D7F8A0A749DE049A830CC8C8F0D3962D8DCE57B445F5F3C771A86DD11AAA10DA5F36F95E55D3DC90900E4DBDDD0DCC21052C53AA11F939DB691362C42E5312
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d../ .t\| .t\| .t\|f.\|..t\|f.\|_.t\|f.\|*.t\|.B.\|#.t\| .u\|\|.t\|.#.\|9.t\|.#.\|!.t\|-.\|!.t\|.#.\|!.t\|Rich .t\|................PE..d....d.W.........." ................t................................................f....`..........................................4.......:..(....................t...g..............8...........................p...p............................................text............................... ..`.rdata..(...........................@..@.data....K...P.......4..............@....pdata...............R..............@..@.rsrc................l..............@..@.reloc...............n..............@..B................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-FC05A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	161688
Entropy (8bit):	6.832669552984183
Encrypted:	false
SSDEEP:	1536:K3uc99F6AOdjfTOZztxlGWGXLQbcpNk6FowD6QcEY7Xjl5hf8keDQa/c7usWjcd6:K3ukXTNGp7+6zaEY7Zf/a0ye3ZoOvKOS
MD5:	DF443813546ABCEF7F33DD9FC0C6070A
SHA1:	635D2D453D48382824E44DD1E59D5C54D735EE2C
SHA-256:	D14911C838620251F7F64C190B04BB8F4E762318CC763D993C9179376228D8CA
SHA-512:	9F9BEA9112D9DB9BCECFC8E4800B7E8032EFB240CBBDDAF26C133B4CE12D27B47DC4E90BC339C561714BC972F6E809B2EC9C9E1FACC6C223FBAC66B089A14C25
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..U~...~...~...s...^...s.#.i...s.......w.o.}...~...'....v..g....v .....s.'......v".....Rich~...........................PE..L....d.W...........!.........................................................p......w.....@................................. ...(....@...................g...P..(...p...8...........................h...@...............4............................text............................... ..`.rdata...T.......V..................@..@.data... =..........................@....rsrc........@......................@..@.reloc..(....P......................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-GGMI4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	data
Category:	dropped
Size (bytes):	46468
Entropy (8bit):	7.994038510231404
Encrypted:	true
SSDEEP:	768:knKJWrjSpYCoxMO0HqzZuCxbSbONOirgFENxbWUYfQsQB/ju9x0QhS5d7uuNMRgH:knKJorQO0KcFigi841WUYfQhju9x0OcF
MD5:	715D61B9BCC484E271775F36865A4CDE
SHA1:	8AE158AEF6F6005AA3D6E6F8A09A05FD95551784
SHA-256:	C4B5797588C80520745732B96D7C6681F8420BDF55E426C40B852E56E5630124
SHA-512:	5C8E462FA504AC91D928617C74E287B598CE326A323C8A05533D4245D018A4A4CC354D05A0568785E7642D8CF779805950D70FE167C456B2D15F8901D714C037
Malicious:	false
Preview:	CEPACK0:....\|T..?~7..,...0.(....%........%.DL...uAE.....7...k...,..c[.........I.....Bk.y..........=..n6.}.......Wf.33g..9s..[r.V!U..#9E.........?...^.&.2..c....y.b...9..<..5?x(...<..#.....Y.x8...s..t.<......:d....K~.......O_....J...Q.S.y.o.m........^....F..G..s.A....D.E.......0.&...w....R...aV^.'.r_E?Vr.Z-.=E....K..j.].^i.4..Q.#"n.x.Y......l.r... ..N9.......7...m.U...o....~z........I.9. NY........N.....Q...=..bP......w..o(.P.a...7.o..V=B.Pv..I..o..-......1.sp.P(x........M...~-.......R.N7...P.o..:....0)...+.Rq.(../....L.O.e.......^..8'.{"..!.=R.\...\|.o.. ..U.c.5-.~g.S..3.A....p..+.#JC.....j..;.1S... ..STX.`y...Z....f.d....SI..Q....(P\|d....l0....<{...0{.r..Pr}...BE....{...2/;....H..kg.o....r<j.K3.S.U.e>X.<...c.4.d7/.`....k....YV.zU........).GO....Y.x....[.9.p...q.........G...7z.....y.......a.El.F9&...[3...XF.P.<l.rU.o.C.a.4w..jI.UeU.tUi......0.O..~J..^.a.M%VzwZ...U.WU$..qMU..h.\..MU...A.....1<...-......'...gG.U6!X.M.s

C:\Program Files\Cheat Engine 7.5\is-IM0FE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	332704
Entropy (8bit):	6.512223997122371
Encrypted:	false
SSDEEP:	6144:UokW02RSGoOZQcW2jS95cM0EsZjv8trtH3Vizwy:ZkW02RsOKcWnDdMv8trtX0
MD5:	E9B5905D495A88ADBC12C811785E72EC
SHA1:	CA0546646986AAB770C7CF2E723C736777802880
SHA-256:	3EB9CD27035D4193E32E271778643F3ACB2BA73341D87FD8BB18D99AF3DFFDEA
SHA-512:	4124180B118149C25F8EA8DBBB2912B4BD56B43F695BF0FF9C6CCC95ADE388F1BE7D440A791D49E4D5C9C350EA113CF65F839A3C47D705533716ACC53DD038F8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#........D(..$-..................................................P...........................................d........................k.......:..................................................P................................text............................... ..`.data...D(.......*..................@....rdata..............................@..@.bss....$-...p...........................CRT.................Z..............@....idata...............\..............@....edata...............j..............@..@.reloc...:.......<...l..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-J3Q59.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	12502
Entropy (8bit):	5.40558493486102
Encrypted:	false
SSDEEP:	192:0egHuderGTd4G9mSZk/8fdtINfbLmJFcSC5xm+9qh07EBS5pekFrLUK80u9ETxst:AHuderlSZk/8FtIF4umMqEpDg3fT
MD5:	62E1FA241D417668F7C5DA6E4009A5A6
SHA1:	F887409E3C204A87731F317A999DC7E4CC8D3FCD
SHA-256:	82E8EF7DF20A86791CEF062F2DCACB1D91B4ADC9F5DEA2FD274886BE8365B2F8
SHA-512:	2283CBB9E1D5D53AD1ED9BC9DB6034FB3C53C633B11001F373523640BBBBA95DA9A3A0866C7D5FA0620FACAB7D18C8577DFD69496FC7319E0A4A74D0B9E10C45
Malicious:	false
Preview:	--Defines:....--checkbox state defines..cbUnchecked=0..cbChecked=1..cbGrayed=2......--onMouseEvent button defines:..mbLeft=0..mbRight=1..mbMiddle=2..mbExtra1=3..mbExtra2=4......--memo scrollbar defines..ssNone=0..ssHorizontal=1..ssVertical=2..ssBoth=3..ssAutoHorizontal=4..ssAutoVertical=5..ssAutoBoth=6......bsNone=0..bsSingle=1..bsSizeable=2..bsDialog=3..bsToolWindow=4..bsSizeToolWin=5........--scan types: (fast scan methods)..fsmNotAligned=0..fsmAligned=1..fsmLastDigits=2....--rounding types..rtRounded=0..rtExtremerounded=1..rtTruncated=2....--scan options..soUnknownValue=0..soExactValue=1..soValueBetween=2..soBiggerThan=3..soSmallerThan=4..soIncreasedValue=5..soIncreasedValueBy=6..soDecreasedValue=7..soDecreasedValueBy=8..soChanged=9..soUnchanged=10......--debug variables..--Breakpoint methods:..bpmInt3=0..bpmDebugRegister=1..bpmException=2......--Breakpoint triggers:..bptExecute=0..bptAccess=1..bptWrite=2....--breakpoint continue methods:..co_run=0..co_stepinto=1..co_stepover=2....-

C:\Program Files\Cheat Engine 7.5\is-JBLAJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	336600
Entropy (8bit):	6.344264969706984
Encrypted:	false
SSDEEP:	3072:6LYEDJlXw5pAnHp2ukwTX6N8B4A84zMtEl1knxgaPZ3nbanlYZn2l1S2CAYOpIOs:6LYEDJAAnHp2uk2KNO0tEQV+b3n6
MD5:	19D52868C3E0B609DBEB68EF81F381A9
SHA1:	CE365BD4CF627A3849D7277BAFBF2F5F56F496DC
SHA-256:	B96469B310BA59D1DB320A337B3A8104DB232A4344A47A8E5AE72F16CC7B1FF4
SHA-512:	5FBD53D761695DE1DD6F0AFD0964B33863764C89692345CAB013C0B1B6332C24DCF766028F305CC87D864D17229D7A52BF19A299CA136A799053C368F21C8926
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!...G.3..D....G...C.......P.......................................E...............................P.......@..P...................@....g...`...$...................................................A..t............................text....3.......4.................. ..`.data...D....P.......8..............@....rdata...a...p...b...L..............@..@.bss.....G...............................CRT.........0......................@....idata..y....@......................@....edata.......P......................@..@.reloc...$...`...&..................@..B.stab... ...........................@..B.stabstr............................@..B................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-JFC09.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	201
Entropy (8bit):	4.465403493165412
Encrypted:	false
SSDEEP:	6:JW4+sNv/lQBAHpbs/UcUFJKPACcAE8J6Xv:JB+slzs/tUrKcbXv
MD5:	62771A63FDC87764BFF87D82918AB02A
SHA1:	8E468DED8CED87A10470BD5594337A854FF344BA
SHA-256:	5C16124BA0B39214BECB1AF4161BD82147AD8468879A3FD8E9FACC656A1D2E6F
SHA-512:	8D1792B712504336CAC0B175146F2B7EAEDA043BD3941C7B7C54CF926A4BA4835F0EFF7A2AD5C7B5509F80E7420C3F5F94200D4C3F922DB92B807E20E09A84D0
Malicious:	false
Preview:	--This lua script gets loaded when Cheat Engine loads..--You can use this to define some often used functions and libraries you'd like to use....require("defines")....--for documentation read celua.txt

C:\Program Files\Cheat Engine 7.5\is-KLETU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	268704
Entropy (8bit):	5.837891086948313
Encrypted:	false
SSDEEP:	6144:0drkqKo/nt7PrwnoK0M6EZgugEkkoSE5O7Z3LLr:6rkm9mP6EZgugEnoSE5OB
MD5:	9A4D1B5154194EA0C42EFEBEB73F318F
SHA1:	220F8AF8B91D3C7B64140CBB5D9337D7ED277EDB
SHA-256:	2F3214F799B0F0A2F3955DBDC64C7E7C0E216F1A09D2C1AD5D0A99921782E363
SHA-512:	6EEF3254FC24079751FC8C38DDA9A8E44840E5A4DF1FF5ADF076E4BE87127075A7FEA59BA7EF9B901AAF10EB64F881FC8FB306C2625140169665DD3991E5C25B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...............................d)..`........ ....@.................................:8..........................................d........................k...................................3.......................................................text............................... ..`.data........ ......................@....rdata...g...@...h...(..............@..@.bss....d)...............................CRT................................@....idata..N...........................@....rsrc...............................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-L37DV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4210080
Entropy (8bit):	6.041283402178925
Encrypted:	false
SSDEEP:	49152:aMiOO5AqojVbq2s2Kyvzq/9E3piKR+77v5WiESldKtyQ6WuDgRPOjgy+OSijV:aMiOOaBbq2VVvnlykESip
MD5:	AEC662CEAE2C4D5ABAEEEE084D828582
SHA1:	A57CEB95E3FD3F8E8C59C0B7E913E2681B64751D
SHA-256:	2DD35A044D1291D593F1DA15C40FD124DA3E4D52D0D045EC61465B725E58079D
SHA-512:	FF28EB79795A6D4AD97A5C79CEB5314208C616BE7CC9196622B9BB2AB8149C6CAA166EED6165923DC8FA253A400422CBEE9E061E72DCF61CE66C700D1451AE7A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./.......#..m......-........................................@...... A......................................................@=.......=......0:.Ta....?..k..................................p.$.(....................O=..............................text.....#.......#................. ..`.data....m....$..n....#.............@....rdata.......p......b.............@..@.pdata..Ta...0:..b....:.............@..@.bss.........<..........................CRT.........0=......~<.............@....idata..@>...@=..@....<.............@....rsrc.........=.......<.............@...................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-L3GJI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	455072
Entropy (8bit):	6.627282046325032
Encrypted:	false
SSDEEP:	6144:8NqQopGY6gsnGubx5JbmZl2Wjm+9498RkaGlef/AYbAPrqEThN0dWI/mo1pdUMMe:fQoIfvxCc64fauA0lhydIo1AfDW
MD5:	E8DFC0D2D41483C7725E4EBB7E32D324
SHA1:	B2890C91EFBA390B68E481CD2EE311136B740EDE
SHA-256:	1172F2D7B1FB34408C8FFC248E3E719922843EA07BD5B409BE3405D1C300B3F7
SHA-512:	539A1BD18D4753D69756B9B7E6603DD6E7A3F354CA002DECE206F7E2F1E2792704F3D80F38B37C0C41F16A1FD9DE32CC4DD5873959D762C5AA13388715EE7803
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................................8...Fi...................................................Q...........Rich...........PE..d...5.6c.........." ................P5...............................................h....`..........................................<.......?..(...............d2.......k..............p...........................p................................................text............................... ..`.rdata...8.......:..................@..@.data....X...P.......<..............@....pdata..d2.......4...H..............@..@.rsrc................\|..............@..@.reloc...............~..............@..B........................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-LR956.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	210336
Entropy (8bit):	6.575377720318411
Encrypted:	false
SSDEEP:	3072:vWMJUr2f2Im9kj/FqgmHpJ1/YCVuIB9Vxv7bn1UC9gfkCeEWHFP0jHzP0Q:vWc02f2R6FqgoJ1boIPRUsfGjQQ
MD5:	A2C0B5D0D9E5C2A2C774E8B587850447
SHA1:	C8AA4CB01676D57B34AAB22C7FD018B63DFF6892
SHA-256:	F0F3D0FAD632D9DDAC8FF0B4EAEC20094FA0F9ABDDF784954DFBB0723A997F21
SHA-512:	85F4AEB562424ABF0E2BC5EDE0CDF0052FBB15E7DF70F691C11B06171A8A45A6672C2C688CD5B6FFEBEE16C36FDAC7978E39CA04F8C29F75D588D2ACA3599395
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@..........rZ.....rX.:..................rY....f.`..........(......(.T....(......Rich...........PE..d....(.c..........".................<X.........@....................................^.....`.................................................L...x........................k..............p...............................................(............................text............................... ..`.rdata..............................@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-MRM89.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	456096
Entropy (8bit):	6.635086574093954
Encrypted:	false
SSDEEP:	6144:tTaB+hAvavjZihpuXh9js6zMxfdKCXbRRUsQHoh3+KZ+a3cnldkEBX/zrMMZKUjo:haBtvavY6XhNrzSk2gxQ3Wn7kw3o
MD5:	AA97F366592E0FA41D2D2F61765CA7D5
SHA1:	BE85DAF3B07E66225CD4167F96ED6292CCE54E1E
SHA-256:	D63036771F21AE7E056F2211CB560BFCF79ADE356B59D8F462050B2DD840E86C
SHA-512:	F16D3F899504EF556D186BEBE1A526D9999454AB60697CDE221130720AB8154003543A62C4E53124C902E51FCF62B653C914B316DA0E3766DF5026E386DD47CC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......HJjD.+...+...+..iM...+..iM...+..iM...+.......+..^C...+..^C...+..^C...+..iM...+...+..S+...B...+...B...+...B...+...B...+..Rich.+..........................PE..d...3.6c.........." ................@P..............................................C.....`..........................................C......4G..(................3.......k......$... ...p............................................ ...............................text...p........................... ..`.rdata.../... ...0..................@..@.data...jX...P.......@..............@....pdata...3.......4...L..............@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-MUHHF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	149912
Entropy (8bit):	6.586184520889439
Encrypted:	false
SSDEEP:	3072:/20T06lYodB6ZcnHgSFulvfV0tYP/ipaQ8PFRBIiOBNOW:1Y6bdB6uHgSwtfV0+P/is1BIpD
MD5:	0EAAC872AADC457C87EE995BBF45A9C1
SHA1:	5E9E9B98F40424AD5397FC73C13B882D75499D27
SHA-256:	6F505CC5973687BBDA1C2D9AC8A635D333F57C12067C54DA7453D9448AB40B8F
SHA-512:	164D1E6EF537D44AC4C0FD90D3C708843A74AC2E08FA2B3F0FDD4A180401210847E0F7BB8EC3056F5DC1D5A54D3239C59FB37914CE7742A4C0EB81578657D24B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Pr.P.............As.e....Ae......At.:.....;......Al.........p....Az......Ab......Aa.....Rich............................PE..d...p..S.........." .....Z..........@\|.......................................@......b.....@.............................................G.......P.... ...................g...0..h...0s...............................................p...............................text....Y.......Z.................. ..`.rdata...L...p...N...^..............@..@.data....<..........................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-MV96K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	399264
Entropy (8bit):	6.025523802176381
Encrypted:	false
SSDEEP:	12288:G0N02KsbnIU70vYrRHAjC0Y0glwgugEnoSE5jq:U2tIUYArRv0Y0glwgugEnoSE5jq
MD5:	F921416197C2AE407D53BA5712C3930A
SHA1:	6A7DAA7372E93C48758B9752C8A5A673B525632B
SHA-256:	E31B233DDF070798CC0381CC6285F6F79EA0C17B99737F7547618DCFD36CDC0E
SHA-512:	0139EFB76C2107D0497BE9910836D7C19329E4399AA8D46BBE17AE63D56AB73004C51B650CE38D79681C22C2D1B77078A7D7185431882BAF3E7BEF473AC95DCE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.......................P....)...-................@.......................... ..................................................d........................k..................................P.......................0................................text...P........................... ..`.data....).......*..................@....rdata.............................@..@.bss.....-...............................CRT................................@....idata..............................@....rsrc...............................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-NNHHO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	127384
Entropy (8bit):	6.856313478886397
Encrypted:	false
SSDEEP:	1536:yq8Iw0TnMfrUEuKo+w/lT35oBqhSw3kmuqW3Crf0d3N1NsCeOEy6jCMpOEsC:yq8IdTMTyXUR2JJry3NreOnMpOu
MD5:	5F1A333671BF167730ED5F70C2C18008
SHA1:	C8233BBC6178BA646252C6566789B82A3296CAB5
SHA-256:	FD2A2B4FE4504C56347C35F24D566CC0510E81706175395D0A2BA26A013C4DAF
SHA-512:	6986D93E680B3776EB5700143FC35D60CA9DBBDF83498F8731C673F9FD77C8699A24A4849DB2A273AA991B8289E4D6C3142BBDE77E11F2FAF603DF43E8FEA105
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[.;.:.h.:.h.:.h.h8h.:.h.h.h.:.h.h)h.:.hN.fh.:.hAh1h.:.h.:.h.:.h.h'h.:.h.h?h.:.h.h<h.:.hRich.:.h........................PE..L...}..S...........!.........j......#T.......0......................................r.....@..........................c..b....Z..P........................g......<....1..............................(P..@............0..`............................text............................... ..`.rdata..r4...0...6... ..............@..@.data....0...p.......V..............@....rsrc................l..............@..@.reloc...............n..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-NS6P9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	data
Category:	dropped
Size (bytes):	55173
Entropy (8bit):	7.995644990698608
Encrypted:	true
SSDEEP:	1536:aPQbr8Hv6jZwnB8K5vHTcM2b9+lmFD/cEt1kbD5F:Tbr8Hv6ji75vHTx9kD/cquP
MD5:	3885F7AF9007DF5A9874E61EDBB45F58
SHA1:	F7A7719E5A9036604CC64922FF2DC4FD40D253DD
SHA-256:	52EAA08C57AA0BA9737ED4413786DAB747DF4C692F34BF601D4FB0B37F231D08
SHA-512:	CAFF16F4171D205A1B44B18651FBA7B72D33F7FDD657C5EBA44853B26929B3F48749D9C5B07F158EA903D41C09A905D27D0A4E3D7B6228550B8C255FC64D5A3D
Malicious:	false
Preview:	CEPACK.....{\|SE.8~o...4$"..."...JQ.P.Z..[.j}.E.VE..j]A[[.1........oD..)E[\.........1..."".....4e..........;....3g.9.V-O.47<..i./.........b..B...i....gB.EW.k....+'_..2....../.......E...N9=x..S.....D..>...W...g......Wr)../.s....C...}=..6.b.s[..~.?y...w.........i.M..t{.B..6..>.../W...0..k._;..........4.&.].....G....E.y....t....O..Wmj.K.P..ti...e...X`...I..k%;.3u....ow..D..E...:.h..D..E...r...dM.{WNS...%z...y..i...?5:..V.....F.:B]...=.gz.O.?..l.F.@.=G.....\9m..S4n.h+.wF........l..6[..W..f............W..pr]X..z+..t:.......5;......a.Y.u..R.{..f......X4Tx....o2..._.1o........d7.....g.......~.....XG_.._1c....}.......\|.........0.u....-.u..N..y=.~..:x5..C.k....j.A.HIuQ4...cZ./.6}.X........;.:5.....0?.N.`....x.......l..w...BEf\|F..GC.h....oe....V2..B.Y...b......'......q$6..k.7@M1x...i..o.Y.M....N+.N.1..x.~.r...............Qa...a..].p...._....d..$L....g..Nn.SQ[.......Mb..b\|y...}....%v1....D].,Jji..(Q.h..M..G.q...[B.h.j.y`

C:\Program Files\Cheat Engine 7.5\is-O71KG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	3208608
Entropy (8bit):	6.4378051911330445
Encrypted:	false
SSDEEP:	49152:itwSHCeicAlYJhPx7Ur4+Kn8KTqeUrncXbvTCeVxkg8vL5V2zRkit6bch6WuDgR1:itwAf64swnNmnfsR3ccJkKSib
MD5:	0D4BDC37F5031A827B2877770974FE49
SHA1:	7D7D63F1CC49FB94D2FD59AF8A0BA89966CE0E07
SHA-256:	F3C536EC5307D71260FA5D6D70AC56A20A00DBC3FB785E0DEB4EF0F7DC66FC2E
SHA-512:	D1FAF9BCF6BBF6E458780F4D913BA600A5F987FF33BE8D24A1165F5BFA925B2D1DFFDAA6E666712D09D58478174BC2956877A4A60376F7773D1E818BB38A23E1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........................d...D....-.......0....@..........................@1.......1.......................................-...... ................0..k..................................P0......................8.-.\............................text............................... ..`.data...d....0......................@....rdata...=... %..>....%.............@..@.bss....D....`-..........................CRT..........-......F-.............@....idata.../....-..0...H-.............@....rsrc........ .......x-.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-OQMOE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	464280
Entropy (8bit):	6.881353710429075
Encrypted:	false
SSDEEP:	12288:dBj8paX8fQ/T/md4OASZAOLRwRai6wXGn+hfy:dxLrLmd4OA4L8DXGnmy
MD5:	AD3F33BAC8EADAB224ADAF4CF6D5B97A
SHA1:	6CCFB97236C5AD3B48A3EB7A113E3E297422E808
SHA-256:	58B206AB9A3D84FDAFB537B419F721ECDEADE489707DBAB227B043D5343DB369
SHA-512:	C319A1C3D0D90AFEFD27DC0379C79E38993490FFA14CB281F419BC94FDE5776CD7EAB54351C57F6EAEEBCACF7F965FA0B8A8DD67489E799FCD84D39393C62A3E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]..3...3...3..d...3..d....3..d....3...6...3...7...3...0...3.......3...2...3.<.;...3.<.3...3.<....3.<.1...3.Rich..3.................PE..L....v._...........!..... ...................0............................................@..........................c.......q..(........................g.......2...W..p............................X..@............0..h............................text...@........ .................. ..`.rdata...I...0...J...$..............@..@.data................n..............@....rsrc................x..............@..@.reloc...2.......4...z..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-OUQ5Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	data
Category:	dropped
Size (bytes):	132
Entropy (8bit):	6.561254441246199
Encrypted:	false
SSDEEP:	3:OP/KrtviZQl8kimG0bj/xeRBtjajKdp2tAdNQL6aj:8/XQl823j5eRBtOjK2tGNe6aj
MD5:	735EAEA06DAE6CD67680127419FBA366
SHA1:	A38126141A4266CDBA17B22CBC4588D88CCFCEB5
SHA-256:	5A2D3E0F10E3701DFB251C3F270B00493CEAD1C3D1CEB34FF976D70C57DC1B58
SHA-512:	92374BDC99BDDDCC2A8B74049B9FF1623EE03B505BA2607E31301F95F2DF8EF3513ECAD4491E2B6B61934F64816E3E9AD3FA3B0914E96D6E55A4B4DF4ED5E028
Malicious:	false
Preview:	.....s.....N..-.........YI .....L.`0......H...Ko.Y....f....Z.pe....... ..)..3.Go...F..s.U.C....{../._U.}\|.."*x..z..bn.D.>;....

C:\Program Files\Cheat Engine 7.5\is-PMK62.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	135064
Entropy (8bit):	6.612681349758152
Encrypted:	false
SSDEEP:	3072:ZGrrgbU27p/nFdpF/vwFLUjh2v5VjObfSVMPFtE8PdYO3kOc:crk3ZFdpRYUjh2verh6
MD5:	2AF7AFE35AB4825E58F43434F5AE9A0F
SHA1:	B67C51CAD09B236AE859A77D0807669283D6342F
SHA-256:	7D82694094C1BBC586E554FA87A4B1ED6EBC9EB14902FD429824DCD501339722
SHA-512:	23B7C6DB0CB9C918AD9F28FA0E4E683C7E2495E89A136B75B7E1BE6380591DA61B6FB4F7248191F28FD3D80C4A391744A96434B4AB96B9531B5EBB0EC970B9D0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........nV..............................%..........................Rich............PE..d...p..S.........." .....&...~......0\...............................................8....@.................................................l...<........................g......$....C...............................................@...............................text....%.......&.................. ..`.rdata..~K...@...L.................@..@.data....;...........v..............@....pdata..............................@..@.rsrc...............................@..@.reloc..>...........................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-PP0OR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	479536
Entropy (8bit):	5.994666279988566
Encrypted:	false
SSDEEP:	6144:Tch6UtcJYg8yRAkB+vsoqOvfkv+y3ilZkaCeMG:e6Utc6gdcfkv+KIR
MD5:	DAA81711AD1F1B1F8D96DC926D502484
SHA1:	7130B241E23BEDE2B1F812D95FDB4ED5EECADBFD
SHA-256:	8422BE70E0EC59C962B35ACF8AD80671BCC8330C9256E6E1EC5C07691388CD66
SHA-512:	9EAA8E04AD7359A30D5E2F9256F94C1643D4C3F3C0DFF24D6CD9E31A6F88CB3B470DD98F01F8B0F57BB947ADC3D45C35749ED4877C7CBBBCC181145F0C361065
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................& ...G.......XJ..P................................................................................................`.......P..P...............t1.......g...p..(...................................................`S...............................text.............................. ..`.data...............................@....rdata..............................@..@.pdata..t1.......2..................@..@.bss....XJ...............................CRT.........@......................@....idata.......P......................@....edata.......`......................@..@.reloc..(....p......................@..B/4..................................@..B/16.................................@..B/30.................................@..B/42.....@...........................@..B........................................................................................

C:\Program Files\Cheat Engine 7.5\is-QFQ4U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3403192
Entropy (8bit):	6.035185815441339
Encrypted:	false
SSDEEP:	49152:ar2V9BrWblVbqS1+Cxz0MB95D//ocnaMo6WuDgRPZO/Y12y6Pu:aqV9BqzbqSR009StqG
MD5:	1C1630B241D5A6BE07BFBA2B3EA97A25
SHA1:	7203255D1A6021874D41A48FCD5719FD7034F34C
SHA-256:	526CDDD0D843F5984AC6CB98D28F22B090682C3A8704122B644EC8AE2C9A10E5
SHA-512:	BDDEDB575FEBF8C8103CFBB1981FD1D5F20D2E0F1D6F4252A98930D587420A69750DDC1BE46932CDF979B8633054321F462557D88349459E111BE43139BEFF4A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........3......./..... z..tN...j..0,.......................................@4.......4.......................................................2.......2..3... 0.......3..k..................................p...(.....................2..............................text... z.......\|.................. ..`.data...tN.......P..................@....rdata...7....!..8....!.............@..@.pdata....... 0.......0.............@..@.bss.....j...02..........................CRT..........2.......2.............@....idata...;....2..<....2.............@....rsrc....3....2..4...L2.............@.../4...........04.......3.............@..B........................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-QQIJI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with very long lines (520), with CRLF line terminators
Category:	dropped
Size (bytes):	215333
Entropy (8bit):	4.786182096058482
Encrypted:	false
SSDEEP:	6144:VcIxsXTXvMeRTWJANaOOwubWiSe65oCmL/+5y/McvJVNry++Ctso2NwVWy+cOcEV:JLSRgun
MD5:	924416232DF99AEF96A2D9E8125AFE78
SHA1:	7F29A338CEFA00BE5FCDC8B94C41FFC31EE625B9
SHA-256:	77C6D324F03A8429BCE858824CFFFCFB7A50D39616D2F9D2729910E086F5AD9A
SHA-512:	470C55E302C86353584EEABB3510B4EFF6353ED16F549DB7C155B2C8283216F2B413D77C9FE20A12F6F55A07C9BE24614DF3A8F5B2CABF1597010249239D63F5
Malicious:	false
Preview:	List of CE specific functions and variables:....Global Variables:..TrainerOrigin : A variable that contains the path of the trainer that launched cheat engine (Only set when launched as a trainer)..process : A variable that contains the main modulename of the currently opened process..MainForm: The main ce gui..AddressList: The address list of the main ce gui......Global Functions:..getCEVersion(): Returns a floating point value specifying the version of cheat engine..getCheatEngineFileVersion(): Returns the full version data of the cheat engine version. A raw integer, and a table containing major, minor, release and build....getOperatingSystem(): Returns 0 if CE is running in Windows, 1 for Mac....darkMode(): Returns true if CE is running in windows Dark Mode. Has no effect on mac....activateProtection(): Prevents basic memory scanners from opening the cheat engine process (Not that useful)..enableDRM(altitude OPTIONAL, secondaryprocessid OPTIONAL ) : Prevents normal memory scanners f

C:\Program Files\Cheat Engine 7.5\is-R767B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16708024
Entropy (8bit):	6.11289505731243
Encrypted:	false
SSDEEP:	196608:H/KthjnNWKtC5bqOrXSFjmnIQGQCW/4PRtYRN3Ticx8cP:fKthjnNWKtC5bqOrXSjmnxGQaTdy8c
MD5:	910DE25BD63B5DA521FC0B598920C4EC
SHA1:	94A15930AAF99F12B349BE80924857673CDC8566
SHA-256:	8CAEF5000B57BCA014EF33E962DF4FCA21AEAD0664892724674619EF732440AD
SHA-512:	6FF910BB4912FEA1FA8FD91E47AE6348C8BF2EFF4F2F5F9EF646A775CA1ECFEF02C23F81BAF6FE2D0B0BDDA7617D91DF52E75DC6063E86EA0444B0538CBD4E6C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./.......{.....@....=........@......................................!.......................................................P...............p..L........k..................................p.{.(....................i..H............................text.....{.......{................. ..`.data.........{.......{.............@....rdata...qa......ra................@..@.pdata..L....p.......F..............@..@.bss....@....0...........................CRT.........@......................@....idata...b...P...d..................@....rsrc............ ...d..............@.../4......(...........................@..B........................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-RKO1I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	202648
Entropy (8bit):	6.566120700945174
Encrypted:	false
SSDEEP:	3072:fr03mcDwt5b2+z615yQ7SLVTnyJYpgerOEmgsRBZnwO4oO8:fg3mrHb2+z615yQ7GnyOpFOEFKD2G
MD5:	9F50134C8BE9AF59F371F607A6DAA0B6
SHA1:	6584B98172CBC4916A7E5CA8D5788493F85F24A7
SHA-256:	DD07117ED80546F23D37F8023E992DE560A1F55A76D1EB6DFD9D55BAA5E3DAD6
SHA-512:	5CCAFA2B0E2D20034168EE9A79E8EFFF64F12F5247F6772815EF4CB9EE56F245A06B088247222C5A3789AE2DCEFADBC2C15DF4FF5196028857F92B9992B094E0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#........d............... ...............................@......D...........................................P........................g.......#......................................................d............................text............................... ..`.data...d.... ......................@....rdata..,c...@...d..................@..@.bss....................................CRT.................~..............@....idata..............................@....edata..............................@..@.reloc...#.......$..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-RUAAP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	386976
Entropy (8bit):	6.870406853054738
Encrypted:	false
SSDEEP:	6144:e59aKWK/HqY5AXeWEfv6TBr4udWNrrJ710vFTAmJxQIfaCU/MC3O74r/wuMGFYsN:G9WsHse9fvcBrnd8rrR10WUxkCxC3O7S
MD5:	81633981057858F56BECB3BD316283E9
SHA1:	F6981034B1A5E23766BA4D40D451D784A1CFF83E
SHA-256:	4885754E6AC08304858383E47D3ADA425409988871BA6586151143D511488614
SHA-512:	99886CB451EAE690657AC848B63D58CD8B436849F6D073C5C073B624A6956397AC5AB6B636B1970C60DCE4EB5B3512372A4EC79FC28E9397AFE7D0791466D0A3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*...y...y...y...x...y...x4..y...x...y./.y...y...x...y...x...y...x...y...x...y...y..y...x...y...x...y..1y...y...x...yRich...y........................PE..L...0.6c...........!.....f...N......D.....................................................@.........................pB.......F..(....................\|...k.......7...8..p...........................p8..@...............D............................text...[d.......f.................. ..`.rdata..`............j..............@..@.data....E...P.......8..............@....rsrc................B..............@..@.reloc...7.......8...D..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-SBH22.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	DOS/MBR boot sector
Category:	dropped
Size (bytes):	477184
Entropy (8bit):	5.927630308859684
Encrypted:	false
SSDEEP:	12288:JEgIgQUO3gqHm5DHLj7S0/Y9kwRofaqcEL5jw/ayKImdyoO:Gg/hEm5DrHE9kwRofaqcEL5jw/ayKImD
MD5:	036B059F8C1CC9AFF3D010E5446BB16C
SHA1:	450842B84E2FACE167E2D138E4F96317CB255BB3
SHA-256:	248F3D48664482090D2C8C01B98518777DED1D900E17ACBC077EFE17258411A6
SHA-512:	4BA5E167A2E3BFE92D43759642AF7BCDB6F4C9EFA30C0F9DE85D6E9758B62FC7ED89FAFDE48910E4E059080E457E3556D23CB1D59B3062C75F81DB9C59B75657
Malicious:	false
Preview:	.$.CETC2#...............>.A..............f..p....$p1...f...pf...pf...pf.6.pf.>.pf...pf.&.p.."p...&p..(p..*p.X.,p....0p. .f..}......0.......\|1....?........}..............`.............6.\|...?@..\|.......& \|.!....Q....."\|.6$\|...\|....s......\|..........u........1.."\|..."\|S...J.[:..\|r....."\|..$\|..$\|:..\|u...$\|....$\|YI...Qu.Y.....\|f...\|......f}....0...P.P.&f}..g}...e..e.E...X..g}...f}...<.t...e..e.E.....F....f}.....Q....f.Y...`1.....t.=..t.=..t....X...@.f1........1..f.......@s.a..DBVM BS.......U......PR>..".>..#..........R........Z.&..&.D......Ps.........r...>..".>..#.ZX.....F.<$u..PRZX.PSQW....N..$N9.r.1......0..N...u..A9.r... N...._Y[X.PSQW....N..$N9.r,1.......w...0.......a..N...u..A9.r... N...._Y[X.88=$e801:$e820:..$ax=$bx=$cx=$dx=$SMAP ERROR!..$..................$................................get VESA info success..$get VESA info failed..$ Failurevideomode 0x$..1...H..&......6........&;.........t........retry reading disk..........f1.f1........]>..?.>

C:\Program Files\Cheat Engine 7.5\is-SJKQD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	131480
Entropy (8bit):	6.84563405497219
Encrypted:	false
SSDEEP:	1536:jRXPVJPMo10+PfXl/IRTlsfQstLh66crJWeWyPCUpfrCWV13P1+CUOEvCvOEMI7:BdJPMlMb1g6e0dU9rf3P7UObvOja
MD5:	43DAC1F3CA6B48263029B348111E3255
SHA1:	9E399FDDC2A256292A07B5C3A16B1C8BDD8DA5C1
SHA-256:	148F12445F11A50EFBD23509139BF06A47D453E8514733B5A15868D10CC6E066
SHA-512:	6E77A429923B503FC08895995EB8817E36145169C2937DACC2DA92B846F45101846E98191AEB4F0F2F13FFF05D0836AA658F505A04208188278718166C5E3032
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[.;.:.h.:.h.:.h.h4h.:.h.h"h.:.h.h%h.:.hN.jh.:.hAh=h.:.h.:.h.:.h.h+h.:.h.h3h.:.h.h0h.:.hRich.:.h........................PE..L...~..S...........!.........h......wd.......@......................................EA....@.........................pr..G....j..P........................g......d....A..............................._..@............@..X............................text....,.......................... ..`.rdata...3...@...4...2..............@..@.data....0...........f..............@....rsrc................\|..............@..@.reloc..$............~..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-SNPLC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1491
Entropy (8bit):	5.150461183336365
Encrypted:	false
SSDEEP:	24:c3UnepmoqbOOrYFlrJYrYFIzLQ9Zonc432smXOkuEWRO632s3yOtTf1p13to+Zqh:xOOrYj2rYCzeqnc432sem32s3xtD13tQ
MD5:	1EE5923E90E9DB03EF80F6DA5C14FB7B
SHA1:	BCB456DB885C932605F4DCFFABBF771BC7CB5C41
SHA-256:	1A971954CD09C202E73E625329EE4DDF7291C7C0E155A1086DA7FAAC1957C94B
SHA-512:	8A008D4FAEE52F76A6C9024DE88963261730FA12EB54B0BE5FB80F8CC02CF7FEC0EFC126A209A646BE17D91B78FFC2E54BAAB7E346474BCFFFD92D3C942E959F
Malicious:	false
Preview:	Copyright 2018 Alex Ionescu. All rights reserved.....Redistribution and use in source and binary forms, with or without modification, are permitted provided..that the following conditions are met:..1. Redistributions of source code must retain the above copyright notice, this list of conditions and.. the following disclaimer...2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions.. and the following disclaimer in the documentation and/or other materials provided with the.. distribution.....THIS SOFTWARE IS PROVIDED BY ALEX IONESCU ``AS IS'' AND ANY EXPRESS OR IMPLIED..WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND..FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ALEX IONESCU..OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR..CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS..OR SERVICES; LOSS OF USE,

C:\Program Files\Cheat Engine 7.5\is-SQBUT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	data
Category:	dropped
Size (bytes):	36018
Entropy (8bit):	7.994007484272608
Encrypted:	true
SSDEEP:	768:9vQvLQOAupOW0bBJ8RkEgh+zhlrKlfaMfToatTCCRFxg4Oaun:9Yv1bpOW0bBJ8goVUsMfcUvzOaun
MD5:	927EF77EFDA84808C9088632C76843E5
SHA1:	AA73E4C27F8A00DF4C9B8BD05088D483B5F8FF9B
SHA-256:	422A2989BABB5E9512C98B3FA24C4F5A0BA9A72C3C71A920C5F979316E1674C7
SHA-512:	98B6BA444008B5978D65FA83487465D700D6EEE721CE8990F1D2E034945F7650E7031E4B9E18C945FE81C6919E5213750DC4E2D86829988E25A3B237559E90E8
Malicious:	false
Preview:	CEPACK......\|T.0~v.$9I69.$.$@.`.F..%.!.$....]"$`.t]..p.`%.x...a....R.....^.X..B........6...j......3gw...{.....\|...{..3.<3..3..<3)...g.8....q\3...s...=.K...d...?.h6,...<.m..P...<.H.......$e\|.........0.hiE.#?Z...II..a.?<p1..s.......1....hc....M...;..6:X\|..Y.yc.sob...A<.....[l..~....#t....x....q...........q1.<1Q...X....l.g...u.....S...l..b..F...}......>.:_2.c....H.\|0LPs..G...5..}@z...3.u..~o]G".....]..c.:.}......5..?.k..V......?...D.....o.-.......[N.)...K\|2..E.f...(3..I.#..E.....3...O.Gv.R.U.....&."..y9-5...4..!.q'......%...!..N-....d.r-U..3,..3........'.0;..h....G.....IN...M...x(.,`M...t.C...?.,4..+...@...4-.>....;>.x(..K.&.B...4.IR..@RK....$-....R..g.Z*4:...R.@...Ry.J..M.q.u.hb....s%....A.r...2S.. .;.v...&....h.......4.[.._..[b(ih..@.}zi..N.K.....'u..$i.V.BR.[....F.I.....A&..........e,..)...P.%.Ui..\|.oP.B..0&../_..R..N..(3...(.~9....2z...a.h.[O.h...S..[..S..F...a..v...83E9....U..~.@..b#c.;..YN %..m....E1D.t.d 6......h%....

C:\Program Files\Cheat Engine 7.5\is-TTU3J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	423328
Entropy (8bit):	6.077270660749132
Encrypted:	false
SSDEEP:	6144:gLJXTQOQV/MzZTixW5GmL7HOf0ADMTE21gFOpJz:Q+V/M9WWnL7HOf0ADMIuR
MD5:	8D487547F1664995E8C47EC2CA6D71FE
SHA1:	D29255653AE831F298A54C6FA142FB64E984E802
SHA-256:	F50BAF9DC3CD6B925758077EC85708DB2712999B9027CC632F57D1E6C588DF21
SHA-512:	79C230CFE8907DF9DA92607A2C1ACE0523A36C3A13296CB0265329208EDC453E293D7FBEDBD5410DECF81D20A7FE361FDEBDDADBC1DC63C96130B0BEDF5B1D8A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........6...2...................................................................................................p.......P..d................H.......k..........................................................LT...............................text............................... ..`.data....6.......8..................@....rdata...V...P...X...4..............@..@.pdata...H.......J..................@..@.bss.....2...............................CRT.........@......................@....idata.......P......................@....edata.......p......................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-U9FAM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	data
Category:	dropped
Size (bytes):	1112834
Entropy (8bit):	7.995534990823338
Encrypted:	true
SSDEEP:	24576:H1XCCswrgMlbH4v3Cj6N3yHORtmV7VJPX/uPQDNDcpLwBlxaZm5g5Gvh6at0:ACRlbHhj6N3vR4Vt/uSN2L6LaZAgcvHC
MD5:	38B22DEDFBCAFE1376ACEB7A0722FB8F
SHA1:	6C96AA4E7C71C82A82951443BA6DAE9019601E55
SHA-256:	F092D81531B8603A52F70245D041E2C43B020280BD9F358172330FF405E451CD
SHA-512:	135EF19161572A57AE1BC618C6CC7FDE889BD1A5C88E6125080C3712E7F0AE96F2A9B7728765C1B115F91CE48200CA47CA0C43E31625CBD11DFFA181610F03CA
Malicious:	false
Preview:	CEPACK..&..}\|T.7~Nf.L...@..".2(..Di....M#.....(meJ.(7...'..'.f.0.k..V.....k...QQf...HqB(N.b@jO.T..&C.2...93.....y>...=s.w.....k...R..zN.q...H..8._....U.3i.[...i.........5{K.3.-.....\|...g.{cv..t....^..U..yb..'...4JD.[...I...t.x]f...c.y#8.....U..;I.....ro....M..Qo..?&.....g......\|.?.^w#......%@OV.wO....r.x..7.#.PFJP...B...9n.O\|..-.F>.w....1...[.....^6..q......p..~{.V..<-Xp.z..z....m..........=5......n.......}..).....x...........,.m...0......1.....>..^._d...~...<.........b=...62...L.g1x6...lf.B./fp...0x)..1.....\.....a.j..c.z.o`..........v..`p9...\..Z..dp=.w1.E..a.^..c.~..`p...2......a....3...>..b...g......V.... ....bp...Q..3..`#.M..dp..g38..f./d.b..2x...2x.........^.....f.z.o`..........v..`p9...\..Z..dp=.w1.E..e.>..g...70. ...\|.....ap;.;..c.)...\|......`.....2x..!.....c.7...62...L.g1x6...lf.B./fp...0x)..1.....\.....a.j..c.z.o`..........v..`p9...\..Z..dp=.w1.E..a.^..c.~..`p...2......a....3...>..b...g......V.... ....bp...q..3..`#.M..dp..g38..f./d.b..2x...2x...

C:\Program Files\Cheat Engine 7.5\is-UJMF9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	data
Category:	dropped
Size (bytes):	132
Entropy (8bit):	6.608714005689305
Encrypted:	false
SSDEEP:	3:/toxN4m4GbUss7S2tY1wnwi9DU4liplagVMlWqOUFgaUSR708:Lm4GbnkSHunwlaiplNmlVOUaar08
MD5:	FE5E5B8B50F441DD772BFA1996AC744E
SHA1:	11D00533ADE98E94C7C6609F4E4B002A94CB440C
SHA-256:	A769BC72C97106722BF5CE8D76AFDC3EC54FC38931872B0637D8B7A281FFFE22
SHA-512:	559FB92A2C58B84AC1CDA6115AA175B0285EA98903EB1F6C91E3A0ECF39F6D667711F97D0EFF8CD98BA25256EC7B339E38D892A90186DB482587E1A80462A6EB
Malicious:	false
Preview:	.^..'....'..d.]-+4.].....Q..m...bs...w.M.kTBU..5C...e.....].a..0.N+rF^.-..\......f...B).#H......XM....Ej`.q....I.3p...p:.(.Y

C:\Program Files\Cheat Engine 7.5\is-V9D11.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.292808527787486
Encrypted:	false
SSDEEP:	3:VSPAiQ7UeSaClo+tHEu3jdXgOYsO:Vr7Ueyl4u3jdQOS
MD5:	A2E60A2F01F69D0DA415C58F25C37E5B
SHA1:	FA1A0D6183FEE10DE5FA4C554370556217E3AF26
SHA-256:	DC9354CCF9667D1E5CA13D6468BA2C258256042D7C25E6D91ADE7F8E2A2FF3BF
SHA-512:	CE7F5F8365D2EF3DA14D4123CC7EF053A7F99E8F98D47E6C5967F267B8EC7FDAC2DA993D0FC26DF8EB2FACE176BA56B7359BA1F29F021E1DFDD561B15EFE64AF
Malicious:	false
Preview:	#Enter modulenames you do not wish to trace..#kernel32.dll #example. comment out to ignore kernel32.dll

C:\Program Files\Cheat Engine 7.5\is-VADJ1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	339864
Entropy (8bit):	6.56829741282491
Encrypted:	false
SSDEEP:	6144:ZnVdQfxRaiC76I/wZGteu+WJrXeN6joNtMrvMl9u61s1JGTBHpMqdmgIIE5pY2B:jdsxs6I6k9MUoNt2vSs8KqdmgIIE/b
MD5:	A358DAE60F1C0F6A633F98B1E4D3E850
SHA1:	2016F1FB0F8000E515602498432951B7C5BC5ACA
SHA-256:	25C648CFDB4CDBBB13630ADC7C14F2BB556C98F5CD1DCBECAFFA91629D2D4A4C
SHA-512:	879B5E95CF7F06E105930724BBC6967B367417DCE390A15DE48BF5CE76CE2435EA4A59095AB67EEE5A05FA41126DDB984C2154ABA34B33FAC895A1CCC2D2A617
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O.j...9...9...9..p9...9..V9...9..W9...9..h9...9K.\|9...9...9...9#.S9...9#.k9...9.\|l9...9#.i9...9Rich...9........PE..d...t.&V.........." .........J...............................................0............`..........................................h.......t..d...............\+.......g... ......@...8............................8..p............................................text............................... ..`.rdata..P...........................@..@.data....R......."...n..............@....pdata..\+.......,..................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\is-VP6HP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	data
Category:	dropped
Size (bytes):	132
Entropy (8bit):	6.593562490537789
Encrypted:	false
SSDEEP:	3:O18qyj/0fZMX/ferOk9OWtW2kdT0PgluBKd9cCkAl8F:O10/3er/X1Y4BKtJuF
MD5:	A4B42FDCA7043792CCC37C611DB21075
SHA1:	17CBF2EC6ECA6BD0CAF1DA78AF51D9F363151168
SHA-256:	8B8955524079508FEC59D396A891110660AE2486F24BC8BCBCDBCC975BB49AE7
SHA-512:	B6877F5B5B88A9B05A85F562D975A8820ACAC3773AA5FB91CEB1DA6C731C90C486A6AAF78DF6EDCF69B0EA74286DC7CC8FA2CBF98453539EFA55EC18D38116BB
Malicious:	false
Preview:	...[0n...w+$.H'1,..t...).=s..Ds.......y....G2......wX+...W=............./X1AjF~G4...OD>....J.R."..S......0.Q[8....A..6.... ...

C:\Program Files\Cheat Engine 7.5\languages\How to add languages.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	GNU gettext message catalogue, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1767
Entropy (8bit):	4.60229123925247
Encrypted:	false
SSDEEP:	48:vWKOiRBBMn0KciKvm/QRQY0cCu9llVyZVkFNS5Ns:ZqsRWQb91/NS5Ns
MD5:	05E8F84A134363796895E8AB8089619A
SHA1:	D6925DDDE83B117D7310C4A257DD9EE444245612
SHA-256:	D8462C8704A83973632D5F38D36F7852BF78D8A81C43BBC2F5AC8FF3A4D8B658
SHA-512:	C63F273EDB9411AA15F6B0C94C5FDE7189A33DCBD50141BB85D3BD31A4A009B1E5F6CF93E10A4300A39F0431452C49070C37D5907965CE49CCB4CED4BFB70EBA
Malicious:	false
Preview:	create a language folder for your country (appropriate folder names are in the format of: en_US, nl_NL, ru_RU, etc...)..copy the .po files to the appropriate folder and then start editing ......Order of picking:.. if there is a cheatengine.po it will pick that, else cheatengine-x86_64.po and if that fails cheatengine-i386.po.. the 32-bit version can work perfectly fine with the 64-bit po.... Same for the tutorial......By default it picks the system language, but you can overide this by adding --LANG langstr or -l langstr to the parameters of Cheat Engine......editing po files...There are some po editing tools but you can also do it by hand..msgid contains the original string and msgstr contains the translated string...If msgstr is empty the original string will be shown....Certain strings are not present in the cheatengine.po file, but are present in lclstrconsts.po..The lclstrconsts.po file belongs to the LCL that the Cheat Engine GUI is build upon......Custom name for your transla

C:\Program Files\Cheat Engine 7.5\languages\Java.po (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	GNU gettext message catalogue, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4485
Entropy (8bit):	4.847226854261297
Encrypted:	false
SSDEEP:	48:IAK8957xHV03E5IDRH3Y8LUHPop+1dpmq3W2D40AujDHZYnAd9BaJ5:IqJ6EURIvOScBj01ZYnAzcH
MD5:	FC3504DD7281F478FA29530B4BDBC3D8
SHA1:	084D65DF95350C869D5DDEFB53C0436236FCF4C7
SHA-256:	162E0DE680FE0E8BCABB09F9D51259A1CE5F83B481BBFC32DE055E0C7CEFC33C
SHA-512:	FCDB7F5244DD8EFB6448BA15B621B49D5F24E0AD79A02C5F1F91664A9CDA2C548540961075FA819DCF7459602EFCC41C34670B32B0A16A6639E4598BF76BDA28
Malicious:	false
Preview:	#: java-AAF..msgid "Auto assembler failed:"..msgstr ""....#: java-JEST..msgid "Java:eventserver terminated"..msgstr ""....#: java-JD..msgid "Java:Disconnected"..msgstr ""....#: java-JUER..msgid "Java:Unexpected event received"..msgstr ""....#: java-JEHT..msgid "Java:Event handler terminating"..msgstr ""....#: java-IJS..msgid "Invalid java signature"..msgstr ""....#: java-ARTANS..msgid "Array return types are not supported"..msgstr ""....#: java-PCDNM..msgid "Parameter count does not match"..msgstr ""....#: java-SWNS..msgid "Scantype was not set"..msgstr ""....#: java-Class..msgid "Class"..msgstr ""....#: java-Method..msgid "Method"..msgstr ""....#: java-Position..msgid "Position"..msgstr ""....#: java-MI..msgid "More info %s.%s(%d)"..msgstr ""....#: java-TDMATGV..msgid "The following methods accessed the given variable"..msgstr ""....#: java-results..msgid "results"..msgstr ""....#: java-OWWTJAILAS..msgid "java_find_what_writes only works when the jvmti agent is launched at start"..msg

C:\Program Files\Cheat Engine 7.5\languages\SaveSessions.po (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	GNU gettext message catalogue, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	284
Entropy (8bit):	4.462768521135749
Encrypted:	false
SSDEEP:	6:InTTzQ9vrJXm6D9AMXqnTzQ3Lz2oVX2aT5WnpXMZBhnpl:InT4O6D+Nn43PYaTVZ/
MD5:	684C9B4A3EE100B044C2BFB0EDD64919
SHA1:	9A8AC81C35F3EA58E97D3A083E3FECA83F01A0AA
SHA-256:	E4283FFAB471763663C189527C805C6985B92C252074727A41E304839C45AB91
SHA-512:	B15DCC949F588C612F3A92D0DEFED4CEA025C86ED4C27E8B3BDF52A218CDE913B89FF4079A419D068CA4EA2793534246A4D17EB25BA4A45D6F5A19639B300E37
Malicious:	false
Preview:	#: SS-OaPF..msgid "Open a process first"..msgstr ""....#: SS-CESF..msgid "Cheat Engine Scan files"..msgstr ""....#: SS-OaPFDaS..msgid "Open a process first and do a scan"..msgstr ""....#: SS-SSS..msgid "Save scan session"..msgstr ""....#: SS-LSS..msgid "Load scan session"..msgstr ""

C:\Program Files\Cheat Engine 7.5\languages\Tutorial-x86_64.po (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	GNU gettext message catalogue, ASCII text, with very long lines (516), with CRLF line terminators
Category:	dropped
Size (bytes):	28896
Entropy (8bit):	4.8485599257299
Encrypted:	false
SSDEEP:	384:jObDfIDkxEV6uOssgT33Nm61682jD1gSuKlRr0ol425ESJoD/LmdSHdd+drGbzMz:jiDfISv9k+tjYo0ol4YOCU9d2mzMaq
MD5:	30F95F6B621C5619BCF23592F634DFE7
SHA1:	824308A98923960760C0E37C8411091A40A42ED0
SHA-256:	E10D0B9DF7A59FC657AAA4355B884E7905FDC009612D39C89CB8561CF6049C18
SHA-512:	70934880CD569D4B8179F1420EF7429571F92548B573C8D83A8FAE789D85EA7C79B59E9A4667515BEF03EA186B81961893E522743D7A1F19A8EDD755D85B1228
Malicious:	false
Preview:	msgid ""..msgstr "Content-Type: text/plain; charset=UTF-8"....#: tform1.btnok.caption..msgctxt "tform1.btnok.caption"..msgid "OK"..msgstr ""....#: tform1.button1.caption..msgctxt "tform1.button1.caption"..msgid "Next"..msgstr ""....#: tform1.caption..msgid "Cheat Engine Tutorial v3.4"..msgstr ""....#: tform1.edtpassword.hint..msgid "Use this to go imeadiatly to the step you want to try"..msgstr ""....#: tform1.edtpassword.text..msgid "090453"..msgstr ""....#: tform1.label1.caption..msgid "Password"..msgstr ""....#: tform10.button3.caption..msgid "Restart game"..msgstr ""....#: tform10.button4.caption..msgctxt "tform10.button4.caption"..msgid "Attack"..msgstr ""....#: tform10.button5.caption..msgctxt "tform10.button5.caption"..msgid "Attack"..msgstr ""....#: tform10.button6.caption..msgctxt "tform10.button6.caption"..msgid "Restart game and autoplay"..msgstr ""....#: tform10.button7.caption..msgctxt "tform10.button7.caption"..msgid "Attack"..msgstr ""....#: tform10.button8.caption..msgc

C:\Program Files\Cheat Engine 7.5\languages\VersionCheck.po (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	GNU gettext message catalogue, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	772
Entropy (8bit):	5.014428182186076
Encrypted:	false
SSDEEP:	12:IxYsI/YaxIBqhAsSIebWFIIcGnIAqWIeyIwZ5GmyI48DqVpDYybxIqUcO:IxBaQDsabWFup5zvD6DnbbO
MD5:	F67F26AECAC8F570A9EB02F0929ABAC5
SHA1:	43DB5011E744CFD43E4446B73BEC1178FA55C80D
SHA-256:	A31280A8CF98B30556BD99B25781D09686E67D85C3EB89D42584832A18962AD0
SHA-512:	DA06E6DFCC7DCA2E9F6017D316B2EC685135C6FD0F5C4F0C83960D3C4A3C503CF9FF205D619BDA77987A36E789E78804FDDD7A9DF84562789D2CFE42A7EE6E0C
Malicious:	false
Preview:	#: VC-U2CVICNEL..msgid "Unable to check version (Invalid content, not enough lines)"..msgstr ""....#: VC-U2CVIC..msgid "Unable to check version (Invalid content)"..msgstr ""......#: VC-CFNV..msgid "Check for new version"..msgstr ""....#: VC-NCA..msgid "Cheat Engine %s is available at www.cheatengine.org. Go there now?"..msgstr ""......#: VC-UP2D..msgid "You are up to date. The latest version is %s"..msgstr ""....#: VC-WTF..msgid "Unable to check version (Can't connect)"..msgstr ""....#: VC-UPDATETO..msgid "Update to %s"..msgstr ""....#: VC-UPDATETO..msgid "In how many days should I notify you again?"..msgstr ""....#: VC-SETTINGS-TEXT..msgid "Check for updates when Cheat Engine starts"..msgstr ""......#: VC-INTERVAL..msgid "Interval(days):"..msgstr ""............

C:\Program Files\Cheat Engine 7.5\languages\cheatengine-x86_64.po (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	GNU gettext message catalogue, ASCII text, with very long lines (332), with CRLF line terminators
Category:	dropped
Size (bytes):	453577
Entropy (8bit):	4.778949128243926
Encrypted:	false
SSDEEP:	6144:gZ44KYZGVK44SCYJs6xj6JnhYpMzqtBtnIgJ:o44Ki4FCYJHpMABtnr
MD5:	3260EDC88460A983A6796D746CFF2815
SHA1:	444DF138C1FF161D4CDE2FC134403F11D6294528
SHA-256:	C6414831A61EFB7872E4FA41C65646413A57EED6ECFCA307AFBF1D04FD5B5432
SHA-512:	28C4BD49669ED330FB9BE5D34016E7D557EA964F17E8B6B39700216A4698F3131AB6A42FC1C2065056CAF709A2A63FF630CDA3EC53F76C3768E62CB0D7E8D743
Malicious:	false
Preview:	msgid ""..msgstr "Content-Type: text/plain; charset=UTF-8"....#: aboutunit.rsareyousureyouwanttolaunchdbvm..msgid "Are you sure you want to launch DBVM? You seem to be running in 32-bit, so don't really need it that badly (Except for ultimap and cloaked operations)"..msgstr ""....#: aboutunit.rsdidyoureallythinkyoudfindaneastereggbydoingthiswel..msgid "Did you really think you'd find an easter egg by doing this? Well, you know what? You where right!"..msgstr ""....#: aboutunit.rslaunchdbvmwasnotassigned..msgid "launchdbvm was not assigned"..msgstr ""....#: aboutunit.rsthismeansthatyourecurrentlynotrunningdbvm..msgid "This means that you're currently not running dbvm, but that your system is capable of running it"..msgstr ""....#: aboutunit.rsthismeansthatyoursystemisrunningdbvm..msgid "This means that your system is running dbvm. This means ce will make use of some advanced tools that are otherwise unavailable"..msgstr ""....#: aboutunit.rsthismeansthatyouwillneedanewcpuinteltobeableto

C:\Program Files\Cheat Engine 7.5\languages\is-2CQ46.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	GNU gettext message catalogue, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3133
Entropy (8bit):	4.680373003343051
Encrypted:	false
SSDEEP:	48:IhHlcWZkIteIVcqUcTNqcNPnVSYQr6sbYuwGW:Ircee/qUpcV5QOsEuwGW
MD5:	5D6D7A6A5ADC10BB638B085FA47A5A00
SHA1:	C4A2D207F3002767844F1B6130F2DDAF6F45A7F9
SHA-256:	37D28D4690BD14D15D9E2198610C7F7DED33DC7D118A1B8BDC2C32FFD0D92C74
SHA-512:	8DC87E314AFEE056F7D6D384F823F71DD5D3802CD0ADEEEAE5FF856D1E9068A8E981E1F588733C8948FB1B824285F7F093B6CB35DAC872327D645CA3912E2A5B
Malicious:	false
Preview:	#: pseudocodediagram-file..msgid "File"..msgstr ""....#: pseudocodediagram-lff..msgid "Load from file"..msgstr ""....#: pseudocodediagram-stfywto..msgid "Select the file you wish to open"..msgstr ""....#: pseudocodediagram-dfcc..msgid "Diagram files (.CEDIAG )\|.CEDIAG"..msgstr ""....#: pseudocodediagram-stf..msgid "Save to file"..msgstr ""....#: pseudocodediagram-fitfywtstda..msgid "Fill in the filename you wish to save this diagram as"..msgstr ""....#: pseudocodediagram-sdti..msgid "Save diagram to image"..msgstr ""....#: pseudocodediagram-fitfywtstdi..msgid "Fill in the filename you wish to save this diagram image"..msgstr ""....#: pseudocodediagram-pfpp..msgid "PNG files (.PNG )\|.PNG"..msgstr ""....#: pseudocodediagram-close..msgid "Close"..msgstr ""....#: pseudocodediagram-display..msgid "Display"..msgstr ""....#: pseudocodediagram-spfu2oc..msgid "Show path from Ultimap1/2 or Codefilter"..msgstr ""....#: pseudocodediagram-spftw..msgid "Show path from tracer window"..msgstr ""..

C:\Program Files\Cheat Engine 7.5\languages\is-CIE95.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1044
Entropy (8bit):	4.607911901797074
Encrypted:	false
SSDEEP:	24:SyKwrQRrYuB24kEiVmSoUiEY0M6zrvLB/Nt:f224kfVLNNt
MD5:	9924B578270AB864E800BF38B2FA65BE
SHA1:	65174EA0E3FA382BBCF7DEEB2E5F5C74AA0E51F4
SHA-256:	16EC4573AE731BC32397874599F2E2FED68BAEE932F23DA6DDDDCE99917B8D70
SHA-512:	C27B43A3944BF9A9B6A6E88FEAF0BA40C84364580015420075EF89131A23586B7FF2908A2992CA0FFC7BC928ABA12A0B111260A592A479DDF97B46375D772714
Malicious:	false
Preview:	.#: patchscan-nave..msgid "Not a valid executable"..msgstr ""....#: patchscan-navwe..msgid "Not a valid windows executable"..msgstr ""....#: patchscan-ttomicns..msgid "This type of module is currently not supported"..msgstr ""....#: patchscan-ce..msgid "Compare error. "..msgstr ""....#: patchscan-ml..msgid "Module List"..msgstr ""....#: patchscan-stmtsfp..msgid "Select the modules to scan for patches. Hold shift/ctrl to select multiple modules"..msgstr ""....#: patchscan-ok..msgid " OK "..msgstr ""....#: patchscan-cancel..msgid "Cancel"..msgstr ""....#: patchscan-scanning..msgid "Scanning: %s"..msgstr ""....#: patchscan-ei..msgid "Error in "..msgstr ""....#: patchscan-pl..msgid "Patch list"..msgstr ""....#: patchscan-address..msgid "Address"..msgstr ""....#: patchscan-original..msgid "Original"..msgstr ""....#: patchscan-patched..msgid "Patched"..msgstr ""....#: patchscan-rwo..msgid "Restore with original"..msgstr ""....#: patchscan-rp..msgid "Reapply patch"..msgstr ""....#: patchs

C:\Program Files\Cheat Engine 7.5\languages\is-EBM2L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	GNU gettext message catalogue, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1767
Entropy (8bit):	4.60229123925247
Encrypted:	false
SSDEEP:	48:vWKOiRBBMn0KciKvm/QRQY0cCu9llVyZVkFNS5Ns:ZqsRWQb91/NS5Ns
MD5:	05E8F84A134363796895E8AB8089619A
SHA1:	D6925DDDE83B117D7310C4A257DD9EE444245612
SHA-256:	D8462C8704A83973632D5F38D36F7852BF78D8A81C43BBC2F5AC8FF3A4D8B658
SHA-512:	C63F273EDB9411AA15F6B0C94C5FDE7189A33DCBD50141BB85D3BD31A4A009B1E5F6CF93E10A4300A39F0431452C49070C37D5907965CE49CCB4CED4BFB70EBA
Malicious:	false
Preview:	create a language folder for your country (appropriate folder names are in the format of: en_US, nl_NL, ru_RU, etc...)..copy the .po files to the appropriate folder and then start editing ......Order of picking:.. if there is a cheatengine.po it will pick that, else cheatengine-x86_64.po and if that fails cheatengine-i386.po.. the 32-bit version can work perfectly fine with the 64-bit po.... Same for the tutorial......By default it picks the system language, but you can overide this by adding --LANG langstr or -l langstr to the parameters of Cheat Engine......editing po files...There are some po editing tools but you can also do it by hand..msgid contains the original string and msgstr contains the translated string...If msgstr is empty the original string will be shown....Certain strings are not present in the cheatengine.po file, but are present in lclstrconsts.po..The lclstrconsts.po file belongs to the LCL that the Cheat Engine GUI is build upon......Custom name for your transla

C:\Program Files\Cheat Engine 7.5\languages\is-ERRVD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	GNU gettext message catalogue, ASCII text, with very long lines (332), with CRLF line terminators
Category:	dropped
Size (bytes):	453577
Entropy (8bit):	4.778949128243926
Encrypted:	false
SSDEEP:	6144:gZ44KYZGVK44SCYJs6xj6JnhYpMzqtBtnIgJ:o44Ki4FCYJHpMABtnr
MD5:	3260EDC88460A983A6796D746CFF2815
SHA1:	444DF138C1FF161D4CDE2FC134403F11D6294528
SHA-256:	C6414831A61EFB7872E4FA41C65646413A57EED6ECFCA307AFBF1D04FD5B5432
SHA-512:	28C4BD49669ED330FB9BE5D34016E7D557EA964F17E8B6B39700216A4698F3131AB6A42FC1C2065056CAF709A2A63FF630CDA3EC53F76C3768E62CB0D7E8D743
Malicious:	false
Preview:	msgid ""..msgstr "Content-Type: text/plain; charset=UTF-8"....#: aboutunit.rsareyousureyouwanttolaunchdbvm..msgid "Are you sure you want to launch DBVM? You seem to be running in 32-bit, so don't really need it that badly (Except for ultimap and cloaked operations)"..msgstr ""....#: aboutunit.rsdidyoureallythinkyoudfindaneastereggbydoingthiswel..msgid "Did you really think you'd find an easter egg by doing this? Well, you know what? You where right!"..msgstr ""....#: aboutunit.rslaunchdbvmwasnotassigned..msgid "launchdbvm was not assigned"..msgstr ""....#: aboutunit.rsthismeansthatyourecurrentlynotrunningdbvm..msgid "This means that you're currently not running dbvm, but that your system is capable of running it"..msgstr ""....#: aboutunit.rsthismeansthatyoursystemisrunningdbvm..msgid "This means that your system is running dbvm. This means ce will make use of some advanced tools that are otherwise unavailable"..msgstr ""....#: aboutunit.rsthismeansthatyouwillneedanewcpuinteltobeableto

C:\Program Files\Cheat Engine 7.5\languages\is-FPKDI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	GNU gettext message catalogue, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	284
Entropy (8bit):	4.462768521135749
Encrypted:	false
SSDEEP:	6:InTTzQ9vrJXm6D9AMXqnTzQ3Lz2oVX2aT5WnpXMZBhnpl:InT4O6D+Nn43PYaTVZ/
MD5:	684C9B4A3EE100B044C2BFB0EDD64919
SHA1:	9A8AC81C35F3EA58E97D3A083E3FECA83F01A0AA
SHA-256:	E4283FFAB471763663C189527C805C6985B92C252074727A41E304839C45AB91
SHA-512:	B15DCC949F588C612F3A92D0DEFED4CEA025C86ED4C27E8B3BDF52A218CDE913B89FF4079A419D068CA4EA2793534246A4D17EB25BA4A45D6F5A19639B300E37
Malicious:	false
Preview:	#: SS-OaPF..msgid "Open a process first"..msgstr ""....#: SS-CESF..msgid "Cheat Engine Scan files"..msgstr ""....#: SS-OaPFDaS..msgid "Open a process first and do a scan"..msgstr ""....#: SS-SSS..msgid "Save scan session"..msgstr ""....#: SS-LSS..msgid "Load scan session"..msgstr ""

C:\Program Files\Cheat Engine 7.5\languages\is-IGC53.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	GNU gettext message catalogue, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	772
Entropy (8bit):	5.014428182186076
Encrypted:	false
SSDEEP:	12:IxYsI/YaxIBqhAsSIebWFIIcGnIAqWIeyIwZ5GmyI48DqVpDYybxIqUcO:IxBaQDsabWFup5zvD6DnbbO
MD5:	F67F26AECAC8F570A9EB02F0929ABAC5
SHA1:	43DB5011E744CFD43E4446B73BEC1178FA55C80D
SHA-256:	A31280A8CF98B30556BD99B25781D09686E67D85C3EB89D42584832A18962AD0
SHA-512:	DA06E6DFCC7DCA2E9F6017D316B2EC685135C6FD0F5C4F0C83960D3C4A3C503CF9FF205D619BDA77987A36E789E78804FDDD7A9DF84562789D2CFE42A7EE6E0C
Malicious:	false
Preview:	#: VC-U2CVICNEL..msgid "Unable to check version (Invalid content, not enough lines)"..msgstr ""....#: VC-U2CVIC..msgid "Unable to check version (Invalid content)"..msgstr ""......#: VC-CFNV..msgid "Check for new version"..msgstr ""....#: VC-NCA..msgid "Cheat Engine %s is available at www.cheatengine.org. Go there now?"..msgstr ""......#: VC-UP2D..msgid "You are up to date. The latest version is %s"..msgstr ""....#: VC-WTF..msgid "Unable to check version (Can't connect)"..msgstr ""....#: VC-UPDATETO..msgid "Update to %s"..msgstr ""....#: VC-UPDATETO..msgid "In how many days should I notify you again?"..msgstr ""....#: VC-SETTINGS-TEXT..msgid "Check for updates when Cheat Engine starts"..msgstr ""......#: VC-INTERVAL..msgid "Interval(days):"..msgstr ""............

C:\Program Files\Cheat Engine 7.5\languages\is-IVS6D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	GNU gettext message catalogue, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2438
Entropy (8bit):	4.816958401157341
Encrypted:	false
SSDEEP:	48:InNN5uwDdugIWruZxDNj9kospRbxaq2lSZeu2H7phQpo1TMAFpRvbubzb/PdQQiN:InJbxugIWSPNj9kospFxV2lSZeZH7/nR
MD5:	5194E6AAC00716CEB7498A8263ABDB03
SHA1:	D249CC96E60A36B0B9DA99D69903BD81D3F32C8F
SHA-256:	3842AF13D8462A02E6F3A8B3B5C3079EAF1081B030415287F67F10FB6F622109
SHA-512:	A7F89289E3A8827367E827A29224FEC0CC9D8699A082D592F372E13FB413BFD8B837A8313AD6530FA4BB6409E06A85BDBA890CE00B00DC7FF3FCF873F7F0EF4F
Malicious:	false
Preview:	#: monoscript-FITM..msgid "Failure injecting the MonoDatacollector dll"..msgstr ""....#: monoscript-DYWTL..msgid "Do you wish to let the mono extention figure out the name and start address? If it's not a proper object this may crash the target."..msgstr ""....#: monoscript-IO..msgid "Instances of "..msgstr ""....#: monoscript-WTAJG..msgid "Warning: These are just guesses. Validate them yourself"..msgstr ""....#: monoscript-AN..msgid "address==nil"..msgstr ""....#: monoscript-Invoke..msgid "Invoke "..msgstr ""....#: monoscript-IA..msgid "Instance address"..msgstr ""....#: monoscript-PW..msgid "<Please wait...>"..msgstr ""....#: monoscript-Parameters..msgid "Parameters"..msgstr ""....#: monoscript-OK..msgid "OK"..msgstr ""....#: monoscript-Cancel..msgid "Cancel"..msgstr ""....#: monoscript-Parameter..msgid "parameter "..msgstr ""....#: monoscript-INAVA..msgid " is not a valid address"..msgstr ""....#: monoscript-INAVV..msgid "is not a valid value"..msgstr ""....#: monoscript-IFT..msgid

C:\Program Files\Cheat Engine 7.5\languages\is-L6R39.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	GNU gettext message catalogue, ASCII text, with very long lines (516), with CRLF line terminators
Category:	dropped
Size (bytes):	28896
Entropy (8bit):	4.8485599257299
Encrypted:	false
SSDEEP:	384:jObDfIDkxEV6uOssgT33Nm61682jD1gSuKlRr0ol425ESJoD/LmdSHdd+drGbzMz:jiDfISv9k+tjYo0ol4YOCU9d2mzMaq
MD5:	30F95F6B621C5619BCF23592F634DFE7
SHA1:	824308A98923960760C0E37C8411091A40A42ED0
SHA-256:	E10D0B9DF7A59FC657AAA4355B884E7905FDC009612D39C89CB8561CF6049C18
SHA-512:	70934880CD569D4B8179F1420EF7429571F92548B573C8D83A8FAE789D85EA7C79B59E9A4667515BEF03EA186B81961893E522743D7A1F19A8EDD755D85B1228
Malicious:	false
Preview:	msgid ""..msgstr "Content-Type: text/plain; charset=UTF-8"....#: tform1.btnok.caption..msgctxt "tform1.btnok.caption"..msgid "OK"..msgstr ""....#: tform1.button1.caption..msgctxt "tform1.button1.caption"..msgid "Next"..msgstr ""....#: tform1.caption..msgid "Cheat Engine Tutorial v3.4"..msgstr ""....#: tform1.edtpassword.hint..msgid "Use this to go imeadiatly to the step you want to try"..msgstr ""....#: tform1.edtpassword.text..msgid "090453"..msgstr ""....#: tform1.label1.caption..msgid "Password"..msgstr ""....#: tform10.button3.caption..msgid "Restart game"..msgstr ""....#: tform10.button4.caption..msgctxt "tform10.button4.caption"..msgid "Attack"..msgstr ""....#: tform10.button5.caption..msgctxt "tform10.button5.caption"..msgid "Attack"..msgstr ""....#: tform10.button6.caption..msgctxt "tform10.button6.caption"..msgid "Restart game and autoplay"..msgstr ""....#: tform10.button7.caption..msgctxt "tform10.button7.caption"..msgid "Attack"..msgstr ""....#: tform10.button8.caption..msgc

C:\Program Files\Cheat Engine 7.5\languages\is-OLBHT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	283
Entropy (8bit):	4.58883566118718
Encrypted:	false
SSDEEP:	6:dc1MUMt3Y+j2ZSWF1iyFQFNHNTSoaOiXkq3cM8TcKDymRKCFWp4aq32vn:dc2LYKefEyBO/bMnE2zFv
MD5:	AF5ED8F4FE5370516403AE39200F5A4F
SHA1:	9299E9998A0605182683A58A5A6AB01A9B9BC037
SHA-256:	4AA4F0B75548D45C81D8E876E2DB1C74BDDFD64091F102706D729B50A7AF53A5
SHA-512:	F070049A2FAE3223861424E7FE79CBAE6601C9BEE6A56FADDE4485AD3C597DC1F3687E720177AB28564A1FAAB52B6679E9315F74327D02AA1FB31E7B8233A80F
Malicious:	false
Preview:	;If the --LANG parameter OR the LANG environment variable are not set and this inifile..;is present in this folder it will be used to pick the language...[Language]..;If preferedLanguage is kept empty CE will choose the language of your operating system instead..PreferedLanguage=*..

C:\Program Files\Cheat Engine 7.5\languages\is-PGR7M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	GNU gettext message catalogue, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4485
Entropy (8bit):	4.847226854261297
Encrypted:	false
SSDEEP:	48:IAK8957xHV03E5IDRH3Y8LUHPop+1dpmq3W2D40AujDHZYnAd9BaJ5:IqJ6EURIvOScBj01ZYnAzcH
MD5:	FC3504DD7281F478FA29530B4BDBC3D8
SHA1:	084D65DF95350C869D5DDEFB53C0436236FCF4C7
SHA-256:	162E0DE680FE0E8BCABB09F9D51259A1CE5F83B481BBFC32DE055E0C7CEFC33C
SHA-512:	FCDB7F5244DD8EFB6448BA15B621B49D5F24E0AD79A02C5F1F91664A9CDA2C548540961075FA819DCF7459602EFCC41C34670B32B0A16A6639E4598BF76BDA28
Malicious:	false
Preview:	#: java-AAF..msgid "Auto assembler failed:"..msgstr ""....#: java-JEST..msgid "Java:eventserver terminated"..msgstr ""....#: java-JD..msgid "Java:Disconnected"..msgstr ""....#: java-JUER..msgid "Java:Unexpected event received"..msgstr ""....#: java-JEHT..msgid "Java:Event handler terminating"..msgstr ""....#: java-IJS..msgid "Invalid java signature"..msgstr ""....#: java-ARTANS..msgid "Array return types are not supported"..msgstr ""....#: java-PCDNM..msgid "Parameter count does not match"..msgstr ""....#: java-SWNS..msgid "Scantype was not set"..msgstr ""....#: java-Class..msgid "Class"..msgstr ""....#: java-Method..msgid "Method"..msgstr ""....#: java-Position..msgid "Position"..msgstr ""....#: java-MI..msgid "More info %s.%s(%d)"..msgstr ""....#: java-TDMATGV..msgid "The following methods accessed the given variable"..msgstr ""....#: java-results..msgid "results"..msgstr ""....#: java-OWWTJAILAS..msgid "java_find_what_writes only works when the jvmti agent is launched at start"..msg

C:\Program Files\Cheat Engine 7.5\languages\is-QPVNS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	GNU gettext message catalogue, ASCII text, with very long lines (407), with CRLF line terminators
Category:	dropped
Size (bytes):	31373
Entropy (8bit):	4.738121487849168
Encrypted:	false
SSDEEP:	384:gyw0FrKFidHPeeMV6uSsX5Ipahgjmg7vxAP7:gyFKFwPume5Ipaum7
MD5:	B16C41734CCB91D59D6EFD720B8CC5C2
SHA1:	894641756D69268F40A97A659E7FEC6422424D74
SHA-256:	D4940DFF786E4B3C2DFE9B0518B64B91A2B8C0F0B8185E2B4CF7784E615F20A1
SHA-512:	C38458F79B2A651065C31602BBC9C230C49E1567254A5D044E9A94FE9DC63B19B0EABFE7446688E58F843FEB65CF290453B3E8BFB800EEBF1459A4134C0CFBB0
Malicious:	false
Preview:	msgid ""..msgstr "".."MIME-Version: 1.0\n".."Content-Type: text/plain; charset=UTF-8\n".."Content-Transfer-Encoding: 8bit\n"....#: lclstrconsts.hhshelpbrowsernotexecutable..msgid "Browser %s%s%s not executable."..msgstr ""....#: lclstrconsts.hhshelpbrowsernotfound..msgid "Browser %s%s%s not found."..msgstr ""....#: lclstrconsts.hhshelperrorwhileexecuting..msgid "Error while executing %s%s%s:%s%s"..msgstr ""....#: lclstrconsts.hhshelpnohtmlbrowserfound..msgid "Unable to find a HTML browser."..msgstr ""....#: lclstrconsts.hhshelpnohtmlbrowserfoundpleasedefineoneinhelpconfigurehe..msgid "No HTML Browser found.%sPlease define one in Environment -> Options -> Help -> Help Options"..msgstr ""....#: lclstrconsts.hhshelpthehelpdatabasewasunabletofindfile..msgid "The help database %s%s%s was unable to find file %s%s%s."..msgstr ""....#: lclstrconsts.hhshelpthemacrosinbrowserparamswillbereplacedbytheurl..msgid "The macro %s in BrowserParams will be replaced by the URL."..msgstr ""....#: lclstrco

C:\Program Files\Cheat Engine 7.5\languages\language.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	283
Entropy (8bit):	4.58883566118718
Encrypted:	false
SSDEEP:	6:dc1MUMt3Y+j2ZSWF1iyFQFNHNTSoaOiXkq3cM8TcKDymRKCFWp4aq32vn:dc2LYKefEyBO/bMnE2zFv
MD5:	AF5ED8F4FE5370516403AE39200F5A4F
SHA1:	9299E9998A0605182683A58A5A6AB01A9B9BC037
SHA-256:	4AA4F0B75548D45C81D8E876E2DB1C74BDDFD64091F102706D729B50A7AF53A5
SHA-512:	F070049A2FAE3223861424E7FE79CBAE6601C9BEE6A56FADDE4485AD3C597DC1F3687E720177AB28564A1FAAB52B6679E9315F74327D02AA1FB31E7B8233A80F
Malicious:	false
Preview:	;If the --LANG parameter OR the LANG environment variable are not set and this inifile..;is present in this folder it will be used to pick the language...[Language]..;If preferedLanguage is kept empty CE will choose the language of your operating system instead..PreferedLanguage=*..

C:\Program Files\Cheat Engine 7.5\languages\lclstrconsts.po (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	GNU gettext message catalogue, ASCII text, with very long lines (407), with CRLF line terminators
Category:	dropped
Size (bytes):	31373
Entropy (8bit):	4.738121487849168
Encrypted:	false
SSDEEP:	384:gyw0FrKFidHPeeMV6uSsX5Ipahgjmg7vxAP7:gyFKFwPume5Ipaum7
MD5:	B16C41734CCB91D59D6EFD720B8CC5C2
SHA1:	894641756D69268F40A97A659E7FEC6422424D74
SHA-256:	D4940DFF786E4B3C2DFE9B0518B64B91A2B8C0F0B8185E2B4CF7784E615F20A1
SHA-512:	C38458F79B2A651065C31602BBC9C230C49E1567254A5D044E9A94FE9DC63B19B0EABFE7446688E58F843FEB65CF290453B3E8BFB800EEBF1459A4134C0CFBB0
Malicious:	false
Preview:	msgid ""..msgstr "".."MIME-Version: 1.0\n".."Content-Type: text/plain; charset=UTF-8\n".."Content-Transfer-Encoding: 8bit\n"....#: lclstrconsts.hhshelpbrowsernotexecutable..msgid "Browser %s%s%s not executable."..msgstr ""....#: lclstrconsts.hhshelpbrowsernotfound..msgid "Browser %s%s%s not found."..msgstr ""....#: lclstrconsts.hhshelperrorwhileexecuting..msgid "Error while executing %s%s%s:%s%s"..msgstr ""....#: lclstrconsts.hhshelpnohtmlbrowserfound..msgid "Unable to find a HTML browser."..msgstr ""....#: lclstrconsts.hhshelpnohtmlbrowserfoundpleasedefineoneinhelpconfigurehe..msgid "No HTML Browser found.%sPlease define one in Environment -> Options -> Help -> Help Options"..msgstr ""....#: lclstrconsts.hhshelpthehelpdatabasewasunabletofindfile..msgid "The help database %s%s%s was unable to find file %s%s%s."..msgstr ""....#: lclstrconsts.hhshelpthemacrosinbrowserparamswillbereplacedbytheurl..msgid "The macro %s in BrowserParams will be replaced by the URL."..msgstr ""....#: lclstrco

C:\Program Files\Cheat Engine 7.5\languages\monoscript.po (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	GNU gettext message catalogue, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2438
Entropy (8bit):	4.816958401157341
Encrypted:	false
SSDEEP:	48:InNN5uwDdugIWruZxDNj9kospRbxaq2lSZeu2H7phQpo1TMAFpRvbubzb/PdQQiN:InJbxugIWSPNj9kospFxV2lSZeZH7/nR
MD5:	5194E6AAC00716CEB7498A8263ABDB03
SHA1:	D249CC96E60A36B0B9DA99D69903BD81D3F32C8F
SHA-256:	3842AF13D8462A02E6F3A8B3B5C3079EAF1081B030415287F67F10FB6F622109
SHA-512:	A7F89289E3A8827367E827A29224FEC0CC9D8699A082D592F372E13FB413BFD8B837A8313AD6530FA4BB6409E06A85BDBA890CE00B00DC7FF3FCF873F7F0EF4F
Malicious:	false
Preview:	#: monoscript-FITM..msgid "Failure injecting the MonoDatacollector dll"..msgstr ""....#: monoscript-DYWTL..msgid "Do you wish to let the mono extention figure out the name and start address? If it's not a proper object this may crash the target."..msgstr ""....#: monoscript-IO..msgid "Instances of "..msgstr ""....#: monoscript-WTAJG..msgid "Warning: These are just guesses. Validate them yourself"..msgstr ""....#: monoscript-AN..msgid "address==nil"..msgstr ""....#: monoscript-Invoke..msgid "Invoke "..msgstr ""....#: monoscript-IA..msgid "Instance address"..msgstr ""....#: monoscript-PW..msgid "<Please wait...>"..msgstr ""....#: monoscript-Parameters..msgid "Parameters"..msgstr ""....#: monoscript-OK..msgid "OK"..msgstr ""....#: monoscript-Cancel..msgid "Cancel"..msgstr ""....#: monoscript-Parameter..msgid "parameter "..msgstr ""....#: monoscript-INAVA..msgid " is not a valid address"..msgstr ""....#: monoscript-INAVV..msgid "is not a valid value"..msgstr ""....#: monoscript-IFT..msgid

C:\Program Files\Cheat Engine 7.5\languages\patchscan.po (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	GNU gettext message catalogue, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1044
Entropy (8bit):	4.607911901797074
Encrypted:	false
SSDEEP:	24:SyKwrQRrYuB24kEiVmSoUiEY0M6zrvLB/Nt:f224kfVLNNt
MD5:	9924B578270AB864E800BF38B2FA65BE
SHA1:	65174EA0E3FA382BBCF7DEEB2E5F5C74AA0E51F4
SHA-256:	16EC4573AE731BC32397874599F2E2FED68BAEE932F23DA6DDDDCE99917B8D70
SHA-512:	C27B43A3944BF9A9B6A6E88FEAF0BA40C84364580015420075EF89131A23586B7FF2908A2992CA0FFC7BC928ABA12A0B111260A592A479DDF97B46375D772714
Malicious:	false
Preview:	.#: patchscan-nave..msgid "Not a valid executable"..msgstr ""....#: patchscan-navwe..msgid "Not a valid windows executable"..msgstr ""....#: patchscan-ttomicns..msgid "This type of module is currently not supported"..msgstr ""....#: patchscan-ce..msgid "Compare error. "..msgstr ""....#: patchscan-ml..msgid "Module List"..msgstr ""....#: patchscan-stmtsfp..msgid "Select the modules to scan for patches. Hold shift/ctrl to select multiple modules"..msgstr ""....#: patchscan-ok..msgid " OK "..msgstr ""....#: patchscan-cancel..msgid "Cancel"..msgstr ""....#: patchscan-scanning..msgid "Scanning: %s"..msgstr ""....#: patchscan-ei..msgid "Error in "..msgstr ""....#: patchscan-pl..msgid "Patch list"..msgstr ""....#: patchscan-address..msgid "Address"..msgstr ""....#: patchscan-original..msgid "Original"..msgstr ""....#: patchscan-patched..msgid "Patched"..msgstr ""....#: patchscan-rwo..msgid "Restore with original"..msgstr ""....#: patchscan-rp..msgid "Reapply patch"..msgstr ""....#: patchs

C:\Program Files\Cheat Engine 7.5\languages\pseudocodediagram.po (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	GNU gettext message catalogue, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3133
Entropy (8bit):	4.680373003343051
Encrypted:	false
SSDEEP:	48:IhHlcWZkIteIVcqUcTNqcNPnVSYQr6sbYuwGW:Ircee/qUpcV5QOsEuwGW
MD5:	5D6D7A6A5ADC10BB638B085FA47A5A00
SHA1:	C4A2D207F3002767844F1B6130F2DDAF6F45A7F9
SHA-256:	37D28D4690BD14D15D9E2198610C7F7DED33DC7D118A1B8BDC2C32FFD0D92C74
SHA-512:	8DC87E314AFEE056F7D6D384F823F71DD5D3802CD0ADEEEAE5FF856D1E9068A8E981E1F588733C8948FB1B824285F7F093B6CB35DAC872327D645CA3912E2A5B
Malicious:	false
Preview:	#: pseudocodediagram-file..msgid "File"..msgstr ""....#: pseudocodediagram-lff..msgid "Load from file"..msgstr ""....#: pseudocodediagram-stfywto..msgid "Select the file you wish to open"..msgstr ""....#: pseudocodediagram-dfcc..msgid "Diagram files (.CEDIAG )\|.CEDIAG"..msgstr ""....#: pseudocodediagram-stf..msgid "Save to file"..msgstr ""....#: pseudocodediagram-fitfywtstda..msgid "Fill in the filename you wish to save this diagram as"..msgstr ""....#: pseudocodediagram-sdti..msgid "Save diagram to image"..msgstr ""....#: pseudocodediagram-fitfywtstdi..msgid "Fill in the filename you wish to save this diagram image"..msgstr ""....#: pseudocodediagram-pfpp..msgid "PNG files (.PNG )\|.PNG"..msgstr ""....#: pseudocodediagram-close..msgid "Close"..msgstr ""....#: pseudocodediagram-display..msgid "Display"..msgstr ""....#: pseudocodediagram-spfu2oc..msgid "Show path from Ultimap1/2 or Codefilter"..msgstr ""....#: pseudocodediagram-spftw..msgid "Show path from tracer window"..msgstr ""..

C:\Program Files\Cheat Engine 7.5\libipt-32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	161688
Entropy (8bit):	6.832669552984183
Encrypted:	false
SSDEEP:	1536:K3uc99F6AOdjfTOZztxlGWGXLQbcpNk6FowD6QcEY7Xjl5hf8keDQa/c7usWjcd6:K3ukXTNGp7+6zaEY7Zf/a0ye3ZoOvKOS
MD5:	DF443813546ABCEF7F33DD9FC0C6070A
SHA1:	635D2D453D48382824E44DD1E59D5C54D735EE2C
SHA-256:	D14911C838620251F7F64C190B04BB8F4E762318CC763D993C9179376228D8CA
SHA-512:	9F9BEA9112D9DB9BCECFC8E4800B7E8032EFB240CBBDDAF26C133B4CE12D27B47DC4E90BC339C561714BC972F6E809B2EC9C9E1FACC6C223FBAC66B089A14C25
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..U~...~...~...s...^...s.#.i...s.......w.o.}...~...'....v..g....v .....s.'......v".....Rich~...........................PE..L....d.W...........!.........................................................p......w.....@................................. ...(....@...................g...P..(...p...8...........................h...@...............4............................text............................... ..`.rdata...T.......V..................@..@.data... =..........................@....rsrc........@......................@..@.reloc..(....P......................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\libipt-64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	187288
Entropy (8bit):	6.46399109534477
Encrypted:	false
SSDEEP:	3072:XMTS4QqrM7BqUHEwXDVT6B8AF6aBBcFkLODeYJObCkEjOUkOG:XIQqrc7V5Trw6aBBcFk6CtbID4
MD5:	4A3B7C52EF32D936E3167EFC1E920AE6
SHA1:	D5D8DAA7A272547419132DDB6E666F7559DBAC04
SHA-256:	26EDE848DBA071EB76C0C0EF8E9D8AD1C53DFAB47CA9137ABC9D683032F06EBB
SHA-512:	36D7F8A0A749DE049A830CC8C8F0D3962D8DCE57B445F5F3C771A86DD11AAA10DA5F36F95E55D3DC90900E4DBDDD0DCC21052C53AA11F939DB691362C42E5312
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d../ .t\| .t\| .t\|f.\|..t\|f.\|_.t\|f.\|*.t\|.B.\|#.t\| .u\|\|.t\|.#.\|9.t\|.#.\|!.t\|-.\|!.t\|.#.\|!.t\|Rich .t\|................PE..d....d.W.........." ................t................................................f....`..........................................4.......:..(....................t...g..............8...........................p...p............................................text............................... ..`.rdata..(...........................@..@.data....K...P.......4..............@....pdata...............R..............@..@.rsrc................l..............@..@.reloc...............n..............@..B................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\libiptlicense.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1491
Entropy (8bit):	5.150461183336365
Encrypted:	false
SSDEEP:	24:c3UnepmoqbOOrYFlrJYrYFIzLQ9Zonc432smXOkuEWRO632s3yOtTf1p13to+Zqh:xOOrYj2rYCzeqnc432sem32s3xtD13tQ
MD5:	1EE5923E90E9DB03EF80F6DA5C14FB7B
SHA1:	BCB456DB885C932605F4DCFFABBF771BC7CB5C41
SHA-256:	1A971954CD09C202E73E625329EE4DDF7291C7C0E155A1086DA7FAAC1957C94B
SHA-512:	8A008D4FAEE52F76A6C9024DE88963261730FA12EB54B0BE5FB80F8CC02CF7FEC0EFC126A209A646BE17D91B78FFC2E54BAAB7E346474BCFFFD92D3C942E959F
Malicious:	false
Preview:	Copyright 2018 Alex Ionescu. All rights reserved.....Redistribution and use in source and binary forms, with or without modification, are permitted provided..that the following conditions are met:..1. Redistributions of source code must retain the above copyright notice, this list of conditions and.. the following disclaimer...2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions.. and the following disclaimer in the documentation and/or other materials provided with the.. distribution.....THIS SOFTWARE IS PROVIDED BY ALEX IONESCU ``AS IS'' AND ANY EXPRESS OR IMPLIED..WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND..FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ALEX IONESCU..OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR..CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS..OR SERVICES; LOSS OF USE,

C:\Program Files\Cheat Engine 7.5\libmikmod32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	308120
Entropy (8bit):	6.921402988579037
Encrypted:	false
SSDEEP:	3072:3QMsoykzuYV4SPaa/Gr+RBmRQ5wipE04CIcFw6eAwE5Sm1Q5jsV+XkO4qOT:3NJyTuxkC57IZEzGmT
MD5:	462322CC93E55016D5EA78B2B9823657
SHA1:	3E8E00B690A4370D6F2DFDCF730F2D3FDA4806A6
SHA-256:	AEDC048FCFEC594E7307E4730D850E5E0121820A76CA1A363F4A2E41D084F393
SHA-512:	A46E56130A8D1CA588D9935D98468543328B42492F1257157D2C7FD99AC341E8A22337AC2228AECF33A70913A7E7161B300BB458E1C07D5D0B94A7AA1DD72D79
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t...t...t.....q.q...y.W.P...y.i.b...y.V......D}.}...t...+....%R.\....%j.u...y.m.u....%h.u...Richt...........................PE..L...h.&V...........!.....p................................................................@.....................................d....P...............L...g...`..@E......8...............................@...............T............................text....o.......p.................. ..`.rdata...v.......x...t..............@..@.data....@..........................@....rsrc........P......................@..@.reloc..@E...`...F..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\libmikmod64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	339864
Entropy (8bit):	6.56829741282491
Encrypted:	false
SSDEEP:	6144:ZnVdQfxRaiC76I/wZGteu+WJrXeN6joNtMrvMl9u61s1JGTBHpMqdmgIIE5pY2B:jdsxs6I6k9MUoNt2vSs8KqdmgIIE/b
MD5:	A358DAE60F1C0F6A633F98B1E4D3E850
SHA1:	2016F1FB0F8000E515602498432951B7C5BC5ACA
SHA-256:	25C648CFDB4CDBBB13630ADC7C14F2BB556C98F5CD1DCBECAFFA91629D2D4A4C
SHA-512:	879B5E95CF7F06E105930724BBC6967B367417DCE390A15DE48BF5CE76CE2435EA4A59095AB67EEE5A05FA41126DDB984C2154ABA34B33FAC895A1CCC2D2A617
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O.j...9...9...9..p9...9..V9...9..W9...9..h9...9K.\|9...9...9...9#.S9...9#.k9...9.\|l9...9#.i9...9Rich...9........PE..d...t.&V.........." .........J...............................................0............`..........................................h.......t..d...............\+.......g... ......@...8............................8..p............................................text............................... ..`.rdata..P...........................@..@.data....R......."...n..............@....pdata..\+.......,..................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\lua53-32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	464280
Entropy (8bit):	6.881353710429075
Encrypted:	false
SSDEEP:	12288:dBj8paX8fQ/T/md4OASZAOLRwRai6wXGn+hfy:dxLrLmd4OA4L8DXGnmy
MD5:	AD3F33BAC8EADAB224ADAF4CF6D5B97A
SHA1:	6CCFB97236C5AD3B48A3EB7A113E3E297422E808
SHA-256:	58B206AB9A3D84FDAFB537B419F721ECDEADE489707DBAB227B043D5343DB369
SHA-512:	C319A1C3D0D90AFEFD27DC0379C79E38993490FFA14CB281F419BC94FDE5776CD7EAB54351C57F6EAEEBCACF7F965FA0B8A8DD67489E799FCD84D39393C62A3E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........]..3...3...3..d...3..d....3..d....3...6...3...7...3...0...3.......3...2...3.<.;...3.<.3...3.<....3.<.1...3.Rich..3.................PE..L....v._...........!..... ...................0............................................@..........................c.......q..(........................g.......2...W..p............................X..@............0..h............................text...@........ .................. ..`.rdata...I...0...J...$..............@..@.data................n..............@....rsrc................x..............@..@.reloc...2.......4...z..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\lua53-64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	541592
Entropy (8bit):	6.56379573889746
Encrypted:	false
SSDEEP:	6144:FshVOadaiL9mUHQMpgL8LgpqClZNKX6SumisBEb/NUidzSky3uDMK/LXTMBQqN5T:hOL9J2L8E5VKKSuLGEhXGstCXoYkc7BV
MD5:	B7C9F1E7E640F1A034BE84AF86970D45
SHA1:	F795DC3D781B9578A96C92658B9F95806FC9BDDE
SHA-256:	6D0A06B90213F082CB98950890518C0F08B9FC16DBFAB34D400267CB6CDADEFF
SHA-512:	DA63992B68F1112C0D6B33E6004F38E85B3C3E251E0D5457CD63804A49C5AA05AA23249E0614DACAD4FEC28CA6EFDB5DDEE06DA5BFBFA07E21942976201079F3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p.............q.R.....q.P.....q.Q.....y......y......y.......i0............Vx......Vx......Vx\.....Vx......Rich............PE..d....w._.........." .................:....................................... ......&.....`.........................................0f..p....t..(................Q.......g......\.......p............................................................................text............................... ..`.rdata..............................@..@.data...8............n..............@....pdata...Q.......R...\|..............@..@.rsrc...............................@..@.reloc..\...........................@..B................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\luaclient-i386.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	202648
Entropy (8bit):	6.566120700945174
Encrypted:	false
SSDEEP:	3072:fr03mcDwt5b2+z615yQ7SLVTnyJYpgerOEmgsRBZnwO4oO8:fg3mrHb2+z615yQ7GnyOpFOEFKD2G
MD5:	9F50134C8BE9AF59F371F607A6DAA0B6
SHA1:	6584B98172CBC4916A7E5CA8D5788493F85F24A7
SHA-256:	DD07117ED80546F23D37F8023E992DE560A1F55A76D1EB6DFD9D55BAA5E3DAD6
SHA-512:	5CCAFA2B0E2D20034168EE9A79E8EFFF64F12F5247F6772815EF4CB9EE56F245A06B088247222C5A3789AE2DCEFADBC2C15DF4FF5196028857F92B9992B094E0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#........d............... ...............................@......D...........................................P........................g.......#......................................................d............................text............................... ..`.data...d.... ......................@....rdata..,c...@...d..................@..@.bss....................................CRT.................~..............@....idata..............................@....edata..............................@..@.reloc...#.......$..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\luaclient-x86_64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	266648
Entropy (8bit):	6.017604835530295
Encrypted:	false
SSDEEP:	3072:KK2iOI60nWU4NJ4twEywGLOJQbcOL9z32fY8iV1OQfkz5w4Q7hk1D2oOyPOP:KKu0WU4J0w6xJkBAY8i7fkaThkA4g
MD5:	DD71848B5BBD150E22E84238CF985AF0
SHA1:	35C7AA128D47710CFDB15BB6809A20DBD0F916D8
SHA-256:	253D18D0D835F482E6ABBAF716855580EB8FE789292C937301E4D60EAD29531D
SHA-512:	0CBF35C9D7B09FB57D8A9079EAB726A3891393F12AEE8B43E01D1D979509E755B74C0FB677F8F2DFAB6B2E34A141F65D0CFBFE57BDA0BF7482841AD31ACE7790
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".... Z..........`........................................ .......U..........................................................P............p.. ........g......0...................................................@................................text... Z.......\.................. ..`.data........p.......`..............@....rdata...............z..............@..@.pdata.. ....p...0...T..............@..@.bss.....................................CRT................................@....idata..............................@....edata..............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\main.lua (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	201
Entropy (8bit):	4.465403493165412
Encrypted:	false
SSDEEP:	6:JW4+sNv/lQBAHpbs/UcUFJKPACcAE8J6Xv:JB+slzs/tUrKcbXv
MD5:	62771A63FDC87764BFF87D82918AB02A
SHA1:	8E468DED8CED87A10470BD5594337A854FF344BA
SHA-256:	5C16124BA0B39214BECB1AF4161BD82147AD8468879A3FD8E9FACC656A1D2E6F
SHA-512:	8D1792B712504336CAC0B175146F2B7EAEDA043BD3941C7B7C54CF926A4BA4835F0EFF7A2AD5C7B5509F80E7420C3F5F94200D4C3F922DB92B807E20E09A84D0
Malicious:	false
Preview:	--This lua script gets loaded when Cheat Engine loads..--You can use this to define some often used functions and libraries you'd like to use....require("defines")....--for documentation read celua.txt

C:\Program Files\Cheat Engine 7.5\overlay.fx (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2086
Entropy (8bit):	4.748005607182281
Encrypted:	false
SSDEEP:	48:HZooJUJAimKakohOgM4TDB6liofD0x6g8W:HioemKakaOgM4J6l5C6g8W
MD5:	650C02FC9F949D14D62E32DD7A894F5E
SHA1:	FA5399B01AADD9F1A4A5632F8632711C186EC0DE
SHA-256:	C4D23DB8EFFB359B4AA4D1E1E480486FE3A4586CE8243397A94250627BA4F8CC
SHA-512:	F2CAAF604C271283FC7AF3AA9674B9D647C4AC53DFFCA031DBF1220D3ED2E867943F5409A95F41C61D716879BED7C888735F43A068F1CC1452B4196D611CB76D
Malicious:	false
Preview:	//credits: ms d3d tutorials which I hacked apart....Texture2D txDiffuse : register( t0 );..SamplerState samLinear : register( s0 );....cbuffer ConstantBuffer : register( b0 )..{....float4x4 rotation;.. float2 originpoint;...float2 translation;...float2 scaling;...float transparency;....float garbage;...}..........//--------------------------------------------------------------------------------------..struct VS_INPUT..{.. float4 Pos : POSITION;.. float2 Tex : TEXCOORD0;..};....struct PS_INPUT..{.. float4 Pos : SV_POSITION;.. float2 Tex : TEXCOORD0;..};......//--------------------------------------------------------------------------------------..// Vertex Shader..//--------------------------------------------------------------------------------------..PS_INPUT VS( VS_INPUT input )..{.... PS_INPUT r=input;.. float4 rp;........ r.Pos[0]-=originpoint[0];.. r.Pos[1]+=originpoint[1];.. r.Pos=mul(r.Pos, rotation);.... r.Pos[0]+=originpoint[0];.. r.Pos[

C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary.sln (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1513
Entropy (8bit):	5.570853751982549
Encrypted:	false
SSDEEP:	24:pPEkvanEc5GgSyTA8VffAa6iAoPARiA2PAo6kA68IAvkAU8TlzbBW:pP0EmdSy8ZLlHRl19DPXvDxts
MD5:	8E1EECB2D6B4F579A7FE4B11361E1D96
SHA1:	647911F537437A80F06C1324AC9AF5843BFCFA01
SHA-256:	37DAA1B4FB9966A0EED6DAEBB98FAE863C92F433D97CEA90DD95107FA7F14A1A
SHA-512:	1BE14802B7B2C13DCAEDBFB8814C7DF011A48C27D83C249EE5C074ACD0AF2070595D8809EC1EF92A6DE1FF4BFA55B3D393A9E5390C04EEF72FD1F1952DA2CCAE
Malicious:	false
Preview:	...Microsoft Visual Studio Solution File, Format Version 12.00..# Visual Studio 15..VisualStudioVersion = 15.0.28307.489..MinimumVisualStudioVersion = 10.0.40219.1..Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "CEPluginLibrary", "CEPluginLibrary\CEPluginLibrary.csproj", "{99772D98-3865-4E8D-BB02-A855950904F8}"..EndProject..Global...GlobalSection(SolutionConfigurationPlatforms) = preSolution....Debug\|Any CPU = Debug\|Any CPU....Debug\|x64 = Debug\|x64....Release\|Any CPU = Release\|Any CPU....Release\|x64 = Release\|x64...EndGlobalSection...GlobalSection(ProjectConfigurationPlatforms) = postSolution....{99772D98-3865-4E8D-BB02-A855950904F8}.Debug\|Any CPU.ActiveCfg = Debug\|Any CPU....{99772D98-3865-4E8D-BB02-A855950904F8}.Debug\|Any CPU.Build.0 = Debug\|Any CPU....{99772D98-3865-4E8D-BB02-A855950904F8}.Debug\|x64.ActiveCfg = Debug\|Any CPU....{99772D98-3865-4E8D-BB02-A855950904F8}.Debug\|x64.Build.0 = Debug\|Any CPU....{99772D98-3865-4E8D-BB02-A855950904F8}.Release\|Any CPU.ActiveCfg = Releas

C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\CEPluginLibrary.csproj (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2926
Entropy (8bit):	5.296204236636278
Encrypted:	false
SSDEEP:	48:3rYSjNJpu5z2fBZi43iqcscr14H1xmH/14H1BA6B6Kv6tH6T626HZ6sM6l6a6A3E:7YWnpu5CZi4ncsZxm4GE5vsHSBCHMOVo
MD5:	BD4AB4CC0D5BED5FBC5228F4035A191D
SHA1:	AE2B589B7342B9C2D30BDBE3575509F6C3DB5D47
SHA-256:	65121FFC91A1EEF66A3281ACFF99C3014DB81FF143A47B02ED6953710CFCAFD5
SHA-512:	81C9CCC18BB5BD0A0F714CB625E1EF0FB62EE20106A3386D812E343D322B7BCE435D5C61D575AE68DA26504B39131D5FBCF405524ADD8233A0D0E4E4405811AF
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">.. <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />.. <PropertyGroup>.. <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>.. <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>.. <ProjectGuid>{99772D98-3865-4E8D-BB02-A855950904F8}</ProjectGuid>.. <OutputType>Library</OutputType>.. <AppDesignerFolder>Properties</AppDesignerFolder>.. <RootNamespace>CEPluginLibrary</RootNamespace>.. <AssemblyName>CEPluginExample</AssemblyName>.. <TargetFrameworkVersion>v4.6.1</TargetFrameworkVersion>.. <FileAlignment>512</FileAlignment>.. <Deterministic>true</Deterministic>.. </PropertyGroup>.. <PropertyGroup Condition=" '$(Configuration)\|$(Platform)' == 'Debug\|AnyCPU' ">..

C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\PluginExample.cs (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4778
Entropy (8bit):	4.4952095990499785
Encrypted:	false
SSDEEP:	96:Jo4h2nXV0VgqojlWXS+vx+FvDVfv6nEbvFUG7Fnm4Auzsq8tdlvuO4BVNT:9UF4ajlWXS+vx+FvDVfv6WdUGBnm4Au9
MD5:	B45C3E2829EED1BEB58ED85D8E27362B
SHA1:	9AFF1824269B8829B4903AC0DC53E7B314CAD5D0
SHA-256:	B16C0C45DCD137B01C6BB2ED3BBB7DECB406FDEC3D4AEBBF1F6EEB44E9039397
SHA-512:	771506912072FE9EB3500C9CCC9D02236B1DB579E02ECE9ABE538548B5F2FC0AD312EDF576DFCDE97F64E573D7B70B6CD73452BA426AAB1E8F31A9431942CC89
Malicious:	false
Preview:	.using System;..using System.Collections.Generic;..using System.Linq;..using System.Text;..using System.Threading;..using System.Threading.Tasks;..using System.Windows.Forms;..using CESDK;....namespace CEPluginLibrary..{.. class PluginExample : CESDKPluginClass.. {.. public override string GetPluginName().. {.. return "C# Plugin Template for Cheat Engine 7.1+";.. }.... public override bool DisablePlugin() //called when disabled.. {.. .. return true;.. }.. .. public override bool EnablePlugin() //called when enabled.. {.. //you can use sdk here.. //sdk.lua.dostring("print('I am alive')");.. .... sdk.lua.Register("pluginexample1", MyFunction);.. sdk.lua.Register("pluginexample2", MyFunction2);.. sdk.lua.Register("pluginexample3", MyFunction3);.. sdk.lua.Register("pluginexample4", MyFunction4);.. sdk

C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\PluginExampleForm.Designer.cs (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	9887
Entropy (8bit):	4.5923744109984925
Encrypted:	false
SSDEEP:	192:Jwa+UHCXRQbXVkmGqYnowGCo0Q3fHRlsc5guLWoeU80bklzg8:Jw1UHqRQbXAoLCtQPHbsc5guLWD0bmh
MD5:	48A54615FB62B5964D621D88ABFF8C98
SHA1:	8131BA02B49DF23D592EF8FD24B1C9BED5BA0B94
SHA-256:	8E4B2FFFDA394E6F9376A930C3B0F1BAEFAF69CE68FA17C0A80A5B49D22633D0
SHA-512:	A433DD6D692263B3C190F1B1113962BEDCF68C0C947B1CD4C7BFD32755A397B9DBA02E3E668F7B548CB21C869E8D2183FDDCC2519D9D15082AA2C664CB0DF902
Malicious:	false
Preview:	.namespace CEPluginLibrary..{.. partial class PluginExampleForm.. {.. /// <summary>.. /// Required designer variable... /// </summary>.. private System.ComponentModel.IContainer components = null;.... /// <summary>.. /// Clean up any resources being used... /// </summary>.. /// <param name="disposing">true if managed resources should be disposed; otherwise, false.</param>.. protected override void Dispose(bool disposing).. {.. if (disposing && (components != null)).. {.. components.Dispose();.. }.. base.Dispose(disposing);.. }.... #region Windows Form Designer generated code.... /// <summary>.. /// Required method for Designer support - do not modify.. /// the contents of this method with the code editor... /// </summary>.. private void InitializeComponent().. {.. this.button1 = new Sy

C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\PluginExampleForm.cs (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5253
Entropy (8bit):	4.220186376885213
Encrypted:	false
SSDEEP:	96:Jo4h4Dcz02nXVgqQUmzIxT1Y7wx7F74GwPgVK5z536uChJYqt+9UYNY:9KGpFDy7C7FwPgVcqu1NY
MD5:	D6A1CE4FE7D7E9321C47B5BA48BB0675
SHA1:	D2F7178B9607765FDBFC869EF2F3F25405E9D2E4
SHA-256:	F47E49AB8E84189B6C1DD2B4A018C43992B34B5E2C025B09CCE8BE9D60C58B6B
SHA-512:	9F4428E86FDF025D94BA897CC68B91056FF28A4BD2ED12DE2B9FEDE00D4396F3F53D05E4115D8CFD8F50B83891A7994001ED359E3A01C53C8578CD89DE5CC338
Malicious:	false
Preview:	.using System;..using System.Collections.Generic;..using System.ComponentModel;..using System.Data;..using System.Drawing;..using System.Linq;..using System.Text;..using System.Threading.Tasks;..using System.Windows.Forms;..using CESDK;....namespace CEPluginLibrary..{.. public partial class PluginExampleForm : Form.. {.. MemScan ms;.. FoundList fl;.... public PluginExampleForm().. {.. InitializeComponent();.. }.... private void button1_Click(object sender, EventArgs e).. { .. MessageBox.Show("WEEEEEEE");.. GC.Collect();.. }.... .... private void MemScanDone(object sender).. {.. //called from CE's main UI thread. Problematic if the form was created using a new thread.. if (this.InvokeRequired).. { .. this.BeginInvoke(((MemScan)sender).OnScanDone,sender);.. }.. else..

C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\PluginExampleForm.resx (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5817
Entropy (8bit):	4.7214047966009245
Encrypted:	false
SSDEEP:	96:fijrkiK5k5LPXbac9m5Lv6FzSvd4gIRjETUT2+0qSdvabvDBwbjBu3FqvuFZ:KjrbLPD9sLvIzSvKgIqUyahFZ
MD5:	4EB5913A0E5AA842250F7419538FA230
SHA1:	31FB76E5D9BABE97A11FEA041081F96CE426107A
SHA-256:	4363CD7D5B8671C72442CE1A1BFC10D64EBD24B2D718B54BD4FCD025E4967298
SHA-512:	846207F9DB4C05D2070482C27AF72C50B8F423AC1C7EFB5266B059F6A41362704E9F5A590E428F4AEFD791EDD2E21C1B34473361911CBEEA2CFCAF741B5BEBFF
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<root>.. .. Microsoft ResX Schema .. .. Version 2.0.. .. The primary goals of this format is to allow a simple XML format .. that is mostly human readable. The generation and parsing of the .. various data types are done through the TypeConverter classes .. associated with the data types... .. Example:.. .. ... ado.net/XML headers & schema ..... <resheader name="resmimetype">text/microsoft-resx</resheader>.. <resheader name="version">2.0</resheader>.. <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>.. <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>.. <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>.. <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>.. <data name="Bitmap1" mimetype="application/x-microsoft

C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\Properties\AssemblyInfo.cs (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1437
Entropy (8bit):	5.076090513105922
Encrypted:	false
SSDEEP:	24:JINebtJwLK0YRr/h+K+BPG/+W+t7kn5e3rmXeYhQ7MJnYUc:Jwebt+LKJRr/hp+PG/j+hk5eCuYh/5YF
MD5:	62142985D98CA0708215AACD89AEB34D
SHA1:	98382B9A288905D9A38B013122A22A6118990FD7
SHA-256:	B308630E16DAAE770982D45A64A9AC63136921A1F174CBC0A645E36142DB2128
SHA-512:	BAEC8A5EDBD21140A8424721D7E16F16FDDB61D9E4EC026A5C10C22B52FA389F98A1756928FA0967959CB4B1EBC22ACF48A11F5C308E256BCF74037F637E817E
Malicious:	false
Preview:	.using System.Reflection;..using System.Runtime.CompilerServices;..using System.Runtime.InteropServices;....// General Information about an assembly is controlled through the following..// set of attributes. Change these attribute values to modify the information..// associated with an assembly...[assembly: AssemblyTitle("CEPluginLibrary")]..[assembly: AssemblyDescription("")]..[assembly: AssemblyConfiguration("")]..[assembly: AssemblyCompany("")]..[assembly: AssemblyProduct("CEPluginLibrary")]..[assembly: AssemblyCopyright("Copyright . 2020")]..[assembly: AssemblyTrademark("")]..[assembly: AssemblyCulture("")]....// Setting ComVisible to false makes the types in this assembly not visible..// to COM components. If you need to access a type in this assembly from..// COM, set the ComVisible attribute to true on that type...[assembly: ComVisible(false)]....// The following GUID is for the ID of the typelib if this project is exposed to COM..[assembly: Guid("99772d98-3865-4e8d-bb02-a8

C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\Properties\is-CEIJS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1437
Entropy (8bit):	5.076090513105922
Encrypted:	false
SSDEEP:	24:JINebtJwLK0YRr/h+K+BPG/+W+t7kn5e3rmXeYhQ7MJnYUc:Jwebt+LKJRr/hp+PG/j+hk5eCuYh/5YF
MD5:	62142985D98CA0708215AACD89AEB34D
SHA1:	98382B9A288905D9A38B013122A22A6118990FD7
SHA-256:	B308630E16DAAE770982D45A64A9AC63136921A1F174CBC0A645E36142DB2128
SHA-512:	BAEC8A5EDBD21140A8424721D7E16F16FDDB61D9E4EC026A5C10C22B52FA389F98A1756928FA0967959CB4B1EBC22ACF48A11F5C308E256BCF74037F637E817E
Malicious:	false
Preview:	.using System.Reflection;..using System.Runtime.CompilerServices;..using System.Runtime.InteropServices;....// General Information about an assembly is controlled through the following..// set of attributes. Change these attribute values to modify the information..// associated with an assembly...[assembly: AssemblyTitle("CEPluginLibrary")]..[assembly: AssemblyDescription("")]..[assembly: AssemblyConfiguration("")]..[assembly: AssemblyCompany("")]..[assembly: AssemblyProduct("CEPluginLibrary")]..[assembly: AssemblyCopyright("Copyright . 2020")]..[assembly: AssemblyTrademark("")]..[assembly: AssemblyCulture("")]....// Setting ComVisible to false makes the types in this assembly not visible..// to COM components. If you need to access a type in this assembly from..// COM, set the ComVisible attribute to true on that type...[assembly: ComVisible(false)]....// The following GUID is for the ID of the typelib if this project is exposed to COM..[assembly: Guid("99772d98-3865-4e8d-bb02-a8

C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\CEObjectWrapper.cs (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	982
Entropy (8bit):	4.435515760549183
Encrypted:	false
SSDEEP:	24:Jo4KM2nkqVp3gqI6BkUSx2n1TY6yhdRcAv1iY:Jo4h2nXVGqI6GU5dyFxiY
MD5:	5D0DEB0B6B7C873B5F56BCEDA264B77F
SHA1:	49EE6163658B643F4368471239A0E0D196DD714D
SHA-256:	AD5E1FC96B40B64A65C5901006BD4823FF71B5D846856DB89115D667D112ED6A
SHA-512:	F5322FE291655663EB3D2817AD17C3CFF4ABF6A9D2F9B85B93060DB782BA63E82B7A1B5969849B9CEF25552F5F0E35EFE1572C0A48AB4869F54B304524C1565A
Malicious:	false
Preview:	.using System;..using System.Collections.Generic;..using System.Linq;..using System.Text;..using System.Threading.Tasks;....namespace CESDK..{.. /// <summary>.. /// Base class for implementing objects inherited from TObject (just a destructor in this case).. /// </summary>.. class CEObjectWrapper.. { .. protected CESDKLua lua = CESDK.currentPlugin.sdk.lua;.. protected IntPtr CEObject;.. public IntPtr obj { get { return CEObject; } }........ ~CEObjectWrapper().. {.. if (CEObject != IntPtr.Zero).. {.. lua.PushCEObject(CEObject);.. lua.PushString("destroy");.. lua.GetTable(-2);.... if (lua.IsFunction(-1)).. {.. lua.PCall(0, 0);.. }.. else.. throw new System.ApplicationException("Object without a destroy method");.. }.. }.. }..}..

C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\CESDK.cs (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	6763
Entropy (8bit):	4.595472479915153
Encrypted:	false
SSDEEP:	192:9UbHGZa1JsDzbH6eHpRHQHOHLOGNQfzN8fWsZEPjR2uTDKIuj1JK+Kz:9ksD7wurO9zjsu1rTuS
MD5:	AB17C7A5C7A57BA82912E2D05D1CE525
SHA1:	A32917633EB47144520E2DCA14E15F5F46643A4E
SHA-256:	545F6394AAE6C7DE8DF94DB797BBE09EB87AAAED2A5A22410BD42618F7F61999
SHA-512:	8B0F2C787BB79F6A40628AF3AB9D16A08A15128EE4D79E4F9DFBEA663200C00C5391C6CF965DE502F79E5927283FC42E700B9AA3664A78DB4404046AB9D81251
Malicious:	false
Preview:	.using System;..using System.Collections.Generic;..using System.Linq;..using System.Runtime.InteropServices;..using System.Text;..using System.Threading.Tasks;..using System.Reflection;......//CE SDK wrapper. You usually don't need to be here, so close your eyes and walk away....namespace CESDK..{.. .. public abstract class CESDKPluginClass.. {.. public CESDK sdk;.. public abstract String GetPluginName();.. public abstract Boolean EnablePlugin();.. public abstract Boolean DisablePlugin();.. }.... [StructLayout(LayoutKind.Sequential)].. public struct TExportedFunctions.. {.. public int sizeofExportedFunctions;.. public IntPtr GetLuaState;.. public IntPtr LuaRegister;.. public IntPtr LuaPushClassInstance;.. public IntPtr ProcessMessages;.. public IntPtr CheckSynchronize;.. }.... public class CESDK.. {.. public static CESDKPluginClass currentPlugin;.. public CESDKLua lua;..

C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\CESDKLua.cs (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	23899
Entropy (8bit):	4.746150555809051
Encrypted:	false
SSDEEP:	384:48k5CqoQyEIC9hgEcxmae6QtCJBn/wbvQN3cPcsq4FxNUjrbqXEozS/q/hQXb6mV:WUq5QXey
MD5:	2B831125B3F0573EC8B12FDB91DA2FD3
SHA1:	E6AEDE01D2EA3D05D825A8D04D0DD9E3831EEA84
SHA-256:	7E625FFA7E5F39351AA558021886075A251A24C111AE3C67AB75A2487EEF6689
SHA-512:	E811D11FB8C2F24AE9A6893989702E9ECF674C977704D29733FCA44491FF793CB3E8A4DD99D699145AAE92EFAB0F64CC63615EA3108953024516CB95EB927D35
Malicious:	false
Preview:	.//Copyright Cheat Engine 2020..using System;..using System.Collections.Generic;..using System.Linq;..using System.Text;..using System.Threading.Tasks;..using System.Runtime.InteropServices;....namespace CESDK..{.. public class CESDKLua.. {.. private const int LUA_TNONE = -1;.. private const int LUA_TNIL = 0;.. private const int LUA_TBOOLEAN = 1;.. private const int LUA_TLIGHTUSERDATA = 2;.. private const int LUA_TNUMBER = 3;.. private const int LUA_TSTRING = 4;.. private const int LUA_TTABLE = 5;.. private const int LUA_TFUNCTION = 6;.. private const int LUA_TUSERDATA = 7;.. private const int LUA_TTHREAD = 8; .... [DllImport("kernel32", SetLastError = true, CharSet = CharSet.Ansi)].. static extern IntPtr LoadLibraryA([MarshalAs(UnmanagedType.LPStr)]string lpFileName);.... [DllImport("kernel32.dll", SetLastError = true, Cha

C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\FoundList.cs (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3404
Entropy (8bit):	3.9340216921200066
Encrypted:	false
SSDEEP:	96:Jo4h2nXVG6n6cbwhwGICIIAIwhICIIA9jx5J:9UFL6PIfIz
MD5:	1DD2F4D1FACD43BB2CA69C75FEA92A5B
SHA1:	E9B62F784A2BB86A26A31D6F82679DFC483FFB58
SHA-256:	6B412B63F5B15B7B247A191D4D76F4B9F4F3F135DA44E46A31CE1C801DDBDA4C
SHA-512:	A09A38C925F5CB3043CCFF4C4A07715DFEA6666B116DA6120F21FF53C2A201A841C936639E3A9A58ABE4E320FE12155936E9890F5DB7CBD1128D93110AECB26B
Malicious:	false
Preview:	.using System;..using System.Collections.Generic;..using System.Linq;..using System.Text;..using System.Threading.Tasks;....namespace CESDK..{.. //Not much of an SDK but more an example of how to wrap the exposed classes by CE into C# classes. Learn from this and implement the other features you like...... class FoundList :CEObjectWrapper.. {.. public int Count { get { return GetCount(); } }.... int GetCount().. {.. try.. {.. lua.PushCEObject(CEObject);.. lua.PushString("Count");.. lua.GetTable(-2);.... return (int)lua.ToInteger(-1);.. }.. finally.. {.. lua.SetTop(0);.. } .. }.... public string GetAddress(int i).. {.. .. try.. {.. lua.PushCEObject(CEObject);.. lua.PushString("Address");.. lua.GetTable(-2

C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\MemScan.cs (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	8480
Entropy (8bit):	4.327578339834133
Encrypted:	false
SSDEEP:	96:Jo4h2nXVG6ncxU750WM5Eo7F1MF1F8S+sY7wxhJ0wxLnwgcLiBsl6qRRt0txt5qX:9UFLcxU90WCnx7eLOLkiL1L327mDl
MD5:	8570870BDF281AA6FE801B53CB4647DE
SHA1:	0A6F0EAE1BAD8AE9BA42CA49CE963C1EC6758522
SHA-256:	2B3F24397889FEF6B449D252A8929C57C6765C73D93A717902F6F5E63DFBDDC2
SHA-512:	86E436029AF6968289B54204A8F008ABD50ACECC889C1A6773BF2C3073196F366203A2D506BEC85AF3CC580CD71C3806708AD745DD65D18A2AE0D02AA4F5F1E1
Malicious:	false
Preview:	.using System;..using System.Collections.Generic;..using System.Linq;..using System.Text;..using System.Threading.Tasks;....namespace CESDK..{.. //Not much of an SDK but more an example of how to wrap the exposed classes by CE into C# classes. Learn from this and implement the other features you like.... public enum ScanOptions.. {.. soUnknownValue = 0,.. soExactValue = 1,.. soValueBetween = 2,.. soBiggerThan = 3,.. soSmallerThan = 4,.. soIncreasedValue = 5,.. soIncreasedValueBy = 6,.. soDecreasedValue = 7,.. soDecreasedValueBy = 8,.. soChanged = 9,.. soUnchanged = 10.. }.... public enum VarTypes.. {.. vtByte = 0,.. vtWord = 1,.. vtDword = 2,.. vtQword = 3,.. vtSingle = 4,.. vtDouble = 5,.. vtString = 6,.. vtUnicodeString = 7, //--Only used by autoguess.. vtWideString = 7,.. vtByteArray = 8,.. vtBinary = 9,..

C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-1VL61.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	6763
Entropy (8bit):	4.595472479915153
Encrypted:	false
SSDEEP:	192:9UbHGZa1JsDzbH6eHpRHQHOHLOGNQfzN8fWsZEPjR2uTDKIuj1JK+Kz:9ksD7wurO9zjsu1rTuS
MD5:	AB17C7A5C7A57BA82912E2D05D1CE525
SHA1:	A32917633EB47144520E2DCA14E15F5F46643A4E
SHA-256:	545F6394AAE6C7DE8DF94DB797BBE09EB87AAAED2A5A22410BD42618F7F61999
SHA-512:	8B0F2C787BB79F6A40628AF3AB9D16A08A15128EE4D79E4F9DFBEA663200C00C5391C6CF965DE502F79E5927283FC42E700B9AA3664A78DB4404046AB9D81251
Malicious:	false
Preview:	.using System;..using System.Collections.Generic;..using System.Linq;..using System.Runtime.InteropServices;..using System.Text;..using System.Threading.Tasks;..using System.Reflection;......//CE SDK wrapper. You usually don't need to be here, so close your eyes and walk away....namespace CESDK..{.. .. public abstract class CESDKPluginClass.. {.. public CESDK sdk;.. public abstract String GetPluginName();.. public abstract Boolean EnablePlugin();.. public abstract Boolean DisablePlugin();.. }.... [StructLayout(LayoutKind.Sequential)].. public struct TExportedFunctions.. {.. public int sizeofExportedFunctions;.. public IntPtr GetLuaState;.. public IntPtr LuaRegister;.. public IntPtr LuaPushClassInstance;.. public IntPtr ProcessMessages;.. public IntPtr CheckSynchronize;.. }.... public class CESDK.. {.. public static CESDKPluginClass currentPlugin;.. public CESDKLua lua;..

C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-7HB6K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	982
Entropy (8bit):	4.435515760549183
Encrypted:	false
SSDEEP:	24:Jo4KM2nkqVp3gqI6BkUSx2n1TY6yhdRcAv1iY:Jo4h2nXVGqI6GU5dyFxiY
MD5:	5D0DEB0B6B7C873B5F56BCEDA264B77F
SHA1:	49EE6163658B643F4368471239A0E0D196DD714D
SHA-256:	AD5E1FC96B40B64A65C5901006BD4823FF71B5D846856DB89115D667D112ED6A
SHA-512:	F5322FE291655663EB3D2817AD17C3CFF4ABF6A9D2F9B85B93060DB782BA63E82B7A1B5969849B9CEF25552F5F0E35EFE1572C0A48AB4869F54B304524C1565A
Malicious:	false
Preview:	.using System;..using System.Collections.Generic;..using System.Linq;..using System.Text;..using System.Threading.Tasks;....namespace CESDK..{.. /// <summary>.. /// Base class for implementing objects inherited from TObject (just a destructor in this case).. /// </summary>.. class CEObjectWrapper.. { .. protected CESDKLua lua = CESDK.currentPlugin.sdk.lua;.. protected IntPtr CEObject;.. public IntPtr obj { get { return CEObject; } }........ ~CEObjectWrapper().. {.. if (CEObject != IntPtr.Zero).. {.. lua.PushCEObject(CEObject);.. lua.PushString("destroy");.. lua.GetTable(-2);.... if (lua.IsFunction(-1)).. {.. lua.PCall(0, 0);.. }.. else.. throw new System.ApplicationException("Object without a destroy method");.. }.. }.. }..}..

C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-GJETC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	23899
Entropy (8bit):	4.746150555809051
Encrypted:	false
SSDEEP:	384:48k5CqoQyEIC9hgEcxmae6QtCJBn/wbvQN3cPcsq4FxNUjrbqXEozS/q/hQXb6mV:WUq5QXey
MD5:	2B831125B3F0573EC8B12FDB91DA2FD3
SHA1:	E6AEDE01D2EA3D05D825A8D04D0DD9E3831EEA84
SHA-256:	7E625FFA7E5F39351AA558021886075A251A24C111AE3C67AB75A2487EEF6689
SHA-512:	E811D11FB8C2F24AE9A6893989702E9ECF674C977704D29733FCA44491FF793CB3E8A4DD99D699145AAE92EFAB0F64CC63615EA3108953024516CB95EB927D35
Malicious:	false
Preview:	.//Copyright Cheat Engine 2020..using System;..using System.Collections.Generic;..using System.Linq;..using System.Text;..using System.Threading.Tasks;..using System.Runtime.InteropServices;....namespace CESDK..{.. public class CESDKLua.. {.. private const int LUA_TNONE = -1;.. private const int LUA_TNIL = 0;.. private const int LUA_TBOOLEAN = 1;.. private const int LUA_TLIGHTUSERDATA = 2;.. private const int LUA_TNUMBER = 3;.. private const int LUA_TSTRING = 4;.. private const int LUA_TTABLE = 5;.. private const int LUA_TFUNCTION = 6;.. private const int LUA_TUSERDATA = 7;.. private const int LUA_TTHREAD = 8; .... [DllImport("kernel32", SetLastError = true, CharSet = CharSet.Ansi)].. static extern IntPtr LoadLibraryA([MarshalAs(UnmanagedType.LPStr)]string lpFileName);.... [DllImport("kernel32.dll", SetLastError = true, Cha

C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-MNOFM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3404
Entropy (8bit):	3.9340216921200066
Encrypted:	false
SSDEEP:	96:Jo4h2nXVG6n6cbwhwGICIIAIwhICIIA9jx5J:9UFL6PIfIz
MD5:	1DD2F4D1FACD43BB2CA69C75FEA92A5B
SHA1:	E9B62F784A2BB86A26A31D6F82679DFC483FFB58
SHA-256:	6B412B63F5B15B7B247A191D4D76F4B9F4F3F135DA44E46A31CE1C801DDBDA4C
SHA-512:	A09A38C925F5CB3043CCFF4C4A07715DFEA6666B116DA6120F21FF53C2A201A841C936639E3A9A58ABE4E320FE12155936E9890F5DB7CBD1128D93110AECB26B
Malicious:	false
Preview:	.using System;..using System.Collections.Generic;..using System.Linq;..using System.Text;..using System.Threading.Tasks;....namespace CESDK..{.. //Not much of an SDK but more an example of how to wrap the exposed classes by CE into C# classes. Learn from this and implement the other features you like...... class FoundList :CEObjectWrapper.. {.. public int Count { get { return GetCount(); } }.... int GetCount().. {.. try.. {.. lua.PushCEObject(CEObject);.. lua.PushString("Count");.. lua.GetTable(-2);.... return (int)lua.ToInteger(-1);.. }.. finally.. {.. lua.SetTop(0);.. } .. }.... public string GetAddress(int i).. {.. .. try.. {.. lua.PushCEObject(CEObject);.. lua.PushString("Address");.. lua.GetTable(-2

C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\SDK\is-N4S80.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	8480
Entropy (8bit):	4.327578339834133
Encrypted:	false
SSDEEP:	96:Jo4h2nXVG6ncxU750WM5Eo7F1MF1F8S+sY7wxhJ0wxLnwgcLiBsl6qRRt0txt5qX:9UFLcxU90WCnx7eLOLkiL1L327mDl
MD5:	8570870BDF281AA6FE801B53CB4647DE
SHA1:	0A6F0EAE1BAD8AE9BA42CA49CE963C1EC6758522
SHA-256:	2B3F24397889FEF6B449D252A8929C57C6765C73D93A717902F6F5E63DFBDDC2
SHA-512:	86E436029AF6968289B54204A8F008ABD50ACECC889C1A6773BF2C3073196F366203A2D506BEC85AF3CC580CD71C3806708AD745DD65D18A2AE0D02AA4F5F1E1
Malicious:	false
Preview:	.using System;..using System.Collections.Generic;..using System.Linq;..using System.Text;..using System.Threading.Tasks;....namespace CESDK..{.. //Not much of an SDK but more an example of how to wrap the exposed classes by CE into C# classes. Learn from this and implement the other features you like.... public enum ScanOptions.. {.. soUnknownValue = 0,.. soExactValue = 1,.. soValueBetween = 2,.. soBiggerThan = 3,.. soSmallerThan = 4,.. soIncreasedValue = 5,.. soIncreasedValueBy = 6,.. soDecreasedValue = 7,.. soDecreasedValueBy = 8,.. soChanged = 9,.. soUnchanged = 10.. }.... public enum VarTypes.. {.. vtByte = 0,.. vtWord = 1,.. vtDword = 2,.. vtQword = 3,.. vtSingle = 4,.. vtDouble = 5,.. vtString = 6,.. vtUnicodeString = 7, //--Only used by autoguess.. vtWideString = 7,.. vtByteArray = 8,.. vtBinary = 9,..

C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\bin\Release\CEPluginExample.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	5.226890017930093
Encrypted:	false
SSDEEP:	768:o59YiDgzS3ejrtGtl1Ym+l+rZz4Awdewwwwd2d+e5R777N1HVM7gbvIVBlGiezFM:PmgeujrtGt7Ym+AZxwdewwwwcd+e5RPa
MD5:	2DF506F3E3969F3DDA3EF32D21F8B210
SHA1:	77391130A4C3853315882FEA9877B5A0132E737F
SHA-256:	C49E654839B293C1D1E6D5F245E49A8CAD787E70B3D0EB2659024E6D6ED44BC5
SHA-512:	22F7F01EBE710423548015C3C87F758F07AEEC93FEFECE5ED6C2AAE8C3D6BAF26D60678E382A0C97B7C8942F2163140146C002D72ABF3014708A4147B654F410
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...]............" ..0.................. ........... ....................................`.....................................O......................................8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........D..\|d..........8.................................................(....2.{....o....6.{.....o....R.~....}......}......0..y.........}......q....}.....{....-...\|....{....(...+}.....{....-...\|....{....(...+}.....{....-...so...}....~.....}....~....o.....~....o......(............s....}............s....}............s....}......0..........~....-.s.........~....(....-k.....(....o....o.......+,........(....o....,....(....t.........+...X...(...+2.~....-..~....o....(.....

C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\bin\Release\is-QAU98.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	5.226890017930093
Encrypted:	false
SSDEEP:	768:o59YiDgzS3ejrtGtl1Ym+l+rZz4Awdewwwwd2d+e5R777N1HVM7gbvIVBlGiezFM:PmgeujrtGt7Ym+AZxwdewwwwcd+e5RPa
MD5:	2DF506F3E3969F3DDA3EF32D21F8B210
SHA1:	77391130A4C3853315882FEA9877B5A0132E737F
SHA-256:	C49E654839B293C1D1E6D5F245E49A8CAD787E70B3D0EB2659024E6D6ED44BC5
SHA-512:	22F7F01EBE710423548015C3C87F758F07AEEC93FEFECE5ED6C2AAE8C3D6BAF26D60678E382A0C97B7C8942F2163140146C002D72ABF3014708A4147B654F410
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...]............" ..0.................. ........... ....................................`.....................................O......................................8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........D..\|d..........8.................................................(....2.{....o....6.{.....o....R.~....}......}......0..y.........}......q....}.....{....-...\|....{....(...+}.....{....-...\|....{....(...+}.....{....-...so...}....~.....}....~....o.....~....o......(............s....}............s....}............s....}......0..........~....-.s.........~....(....-k.....(....o....o.......+,........(....o....,....(....t.........+...X...(...+2.~....-..~....o....(.....

C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-ILHTP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5817
Entropy (8bit):	4.7214047966009245
Encrypted:	false
SSDEEP:	96:fijrkiK5k5LPXbac9m5Lv6FzSvd4gIRjETUT2+0qSdvabvDBwbjBu3FqvuFZ:KjrbLPD9sLvIzSvKgIqUyahFZ
MD5:	4EB5913A0E5AA842250F7419538FA230
SHA1:	31FB76E5D9BABE97A11FEA041081F96CE426107A
SHA-256:	4363CD7D5B8671C72442CE1A1BFC10D64EBD24B2D718B54BD4FCD025E4967298
SHA-512:	846207F9DB4C05D2070482C27AF72C50B8F423AC1C7EFB5266B059F6A41362704E9F5A590E428F4AEFD791EDD2E21C1B34473361911CBEEA2CFCAF741B5BEBFF
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<root>.. .. Microsoft ResX Schema .. .. Version 2.0.. .. The primary goals of this format is to allow a simple XML format .. that is mostly human readable. The generation and parsing of the .. various data types are done through the TypeConverter classes .. associated with the data types... .. Example:.. .. ... ado.net/XML headers & schema ..... <resheader name="resmimetype">text/microsoft-resx</resheader>.. <resheader name="version">2.0</resheader>.. <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>.. <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>.. <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>.. <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>.. <data name="Bitmap1" mimetype="application/x-microsoft

C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-J74FA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	9887
Entropy (8bit):	4.5923744109984925
Encrypted:	false
SSDEEP:	192:Jwa+UHCXRQbXVkmGqYnowGCo0Q3fHRlsc5guLWoeU80bklzg8:Jw1UHqRQbXAoLCtQPHbsc5guLWD0bmh
MD5:	48A54615FB62B5964D621D88ABFF8C98
SHA1:	8131BA02B49DF23D592EF8FD24B1C9BED5BA0B94
SHA-256:	8E4B2FFFDA394E6F9376A930C3B0F1BAEFAF69CE68FA17C0A80A5B49D22633D0
SHA-512:	A433DD6D692263B3C190F1B1113962BEDCF68C0C947B1CD4C7BFD32755A397B9DBA02E3E668F7B548CB21C869E8D2183FDDCC2519D9D15082AA2C664CB0DF902
Malicious:	false
Preview:	.namespace CEPluginLibrary..{.. partial class PluginExampleForm.. {.. /// <summary>.. /// Required designer variable... /// </summary>.. private System.ComponentModel.IContainer components = null;.... /// <summary>.. /// Clean up any resources being used... /// </summary>.. /// <param name="disposing">true if managed resources should be disposed; otherwise, false.</param>.. protected override void Dispose(bool disposing).. {.. if (disposing && (components != null)).. {.. components.Dispose();.. }.. base.Dispose(disposing);.. }.... #region Windows Form Designer generated code.... /// <summary>.. /// Required method for Designer support - do not modify.. /// the contents of this method with the code editor... /// </summary>.. private void InitializeComponent().. {.. this.button1 = new Sy

C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-OOK6A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4778
Entropy (8bit):	4.4952095990499785
Encrypted:	false
SSDEEP:	96:Jo4h2nXV0VgqojlWXS+vx+FvDVfv6nEbvFUG7Fnm4Auzsq8tdlvuO4BVNT:9UF4ajlWXS+vx+FvDVfv6WdUGBnm4Au9
MD5:	B45C3E2829EED1BEB58ED85D8E27362B
SHA1:	9AFF1824269B8829B4903AC0DC53E7B314CAD5D0
SHA-256:	B16C0C45DCD137B01C6BB2ED3BBB7DECB406FDEC3D4AEBBF1F6EEB44E9039397
SHA-512:	771506912072FE9EB3500C9CCC9D02236B1DB579E02ECE9ABE538548B5F2FC0AD312EDF576DFCDE97F64E573D7B70B6CD73452BA426AAB1E8F31A9431942CC89
Malicious:	false
Preview:	.using System;..using System.Collections.Generic;..using System.Linq;..using System.Text;..using System.Threading;..using System.Threading.Tasks;..using System.Windows.Forms;..using CESDK;....namespace CEPluginLibrary..{.. class PluginExample : CESDKPluginClass.. {.. public override string GetPluginName().. {.. return "C# Plugin Template for Cheat Engine 7.1+";.. }.... public override bool DisablePlugin() //called when disabled.. {.. .. return true;.. }.. .. public override bool EnablePlugin() //called when enabled.. {.. //you can use sdk here.. //sdk.lua.dostring("print('I am alive')");.. .... sdk.lua.Register("pluginexample1", MyFunction);.. sdk.lua.Register("pluginexample2", MyFunction2);.. sdk.lua.Register("pluginexample3", MyFunction3);.. sdk.lua.Register("pluginexample4", MyFunction4);.. sdk

C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-RN0P9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	5253
Entropy (8bit):	4.220186376885213
Encrypted:	false
SSDEEP:	96:Jo4h4Dcz02nXVgqQUmzIxT1Y7wx7F74GwPgVK5z536uChJYqt+9UYNY:9KGpFDy7C7FwPgVcqu1NY
MD5:	D6A1CE4FE7D7E9321C47B5BA48BB0675
SHA1:	D2F7178B9607765FDBFC869EF2F3F25405E9D2E4
SHA-256:	F47E49AB8E84189B6C1DD2B4A018C43992B34B5E2C025B09CCE8BE9D60C58B6B
SHA-512:	9F4428E86FDF025D94BA897CC68B91056FF28A4BD2ED12DE2B9FEDE00D4396F3F53D05E4115D8CFD8F50B83891A7994001ED359E3A01C53C8578CD89DE5CC338
Malicious:	false
Preview:	.using System;..using System.Collections.Generic;..using System.ComponentModel;..using System.Data;..using System.Drawing;..using System.Linq;..using System.Text;..using System.Threading.Tasks;..using System.Windows.Forms;..using CESDK;....namespace CEPluginLibrary..{.. public partial class PluginExampleForm : Form.. {.. MemScan ms;.. FoundList fl;.... public PluginExampleForm().. {.. InitializeComponent();.. }.... private void button1_Click(object sender, EventArgs e).. { .. MessageBox.Show("WEEEEEEE");.. GC.Collect();.. }.... .... private void MemScanDone(object sender).. {.. //called from CE's main UI thread. Problematic if the form was created using a new thread.. if (this.InvokeRequired).. { .. this.BeginInvoke(((MemScan)sender).OnScanDone,sender);.. }.. else..

C:\Program Files\Cheat Engine 7.5\plugins\c# template\CEPluginLibrary\is-RUQFN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2926
Entropy (8bit):	5.296204236636278
Encrypted:	false
SSDEEP:	48:3rYSjNJpu5z2fBZi43iqcscr14H1xmH/14H1BA6B6Kv6tH6T626HZ6sM6l6a6A3E:7YWnpu5CZi4ncsZxm4GE5vsHSBCHMOVo
MD5:	BD4AB4CC0D5BED5FBC5228F4035A191D
SHA1:	AE2B589B7342B9C2D30BDBE3575509F6C3DB5D47
SHA-256:	65121FFC91A1EEF66A3281ACFF99C3014DB81FF143A47B02ED6953710CFCAFD5
SHA-512:	81C9CCC18BB5BD0A0F714CB625E1EF0FB62EE20106A3386D812E343D322B7BCE435D5C61D575AE68DA26504B39131D5FBCF405524ADD8233A0D0E4E4405811AF
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">.. <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />.. <PropertyGroup>.. <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>.. <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>.. <ProjectGuid>{99772D98-3865-4E8D-BB02-A855950904F8}</ProjectGuid>.. <OutputType>Library</OutputType>.. <AppDesignerFolder>Properties</AppDesignerFolder>.. <RootNamespace>CEPluginLibrary</RootNamespace>.. <AssemblyName>CEPluginExample</AssemblyName>.. <TargetFrameworkVersion>v4.6.1</TargetFrameworkVersion>.. <FileAlignment>512</FileAlignment>.. <Deterministic>true</Deterministic>.. </PropertyGroup>.. <PropertyGroup Condition=" '$(Configuration)\|$(Platform)' == 'Debug\|AnyCPU' ">..

C:\Program Files\Cheat Engine 7.5\plugins\c# template\is-RCCJA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1513
Entropy (8bit):	5.570853751982549
Encrypted:	false
SSDEEP:	24:pPEkvanEc5GgSyTA8VffAa6iAoPARiA2PAo6kA68IAvkAU8TlzbBW:pP0EmdSy8ZLlHRl19DPXvDxts
MD5:	8E1EECB2D6B4F579A7FE4B11361E1D96
SHA1:	647911F537437A80F06C1324AC9AF5843BFCFA01
SHA-256:	37DAA1B4FB9966A0EED6DAEBB98FAE863C92F433D97CEA90DD95107FA7F14A1A
SHA-512:	1BE14802B7B2C13DCAEDBFB8814C7DF011A48C27D83C249EE5C074ACD0AF2070595D8809EC1EF92A6DE1FF4BFA55B3D393A9E5390C04EEF72FD1F1952DA2CCAE
Malicious:	false
Preview:	...Microsoft Visual Studio Solution File, Format Version 12.00..# Visual Studio 15..VisualStudioVersion = 15.0.28307.489..MinimumVisualStudioVersion = 10.0.40219.1..Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "CEPluginLibrary", "CEPluginLibrary\CEPluginLibrary.csproj", "{99772D98-3865-4E8D-BB02-A855950904F8}"..EndProject..Global...GlobalSection(SolutionConfigurationPlatforms) = preSolution....Debug\|Any CPU = Debug\|Any CPU....Debug\|x64 = Debug\|x64....Release\|Any CPU = Release\|Any CPU....Release\|x64 = Release\|x64...EndGlobalSection...GlobalSection(ProjectConfigurationPlatforms) = postSolution....{99772D98-3865-4E8D-BB02-A855950904F8}.Debug\|Any CPU.ActiveCfg = Debug\|Any CPU....{99772D98-3865-4E8D-BB02-A855950904F8}.Debug\|Any CPU.Build.0 = Debug\|Any CPU....{99772D98-3865-4E8D-BB02-A855950904F8}.Debug\|x64.ActiveCfg = Debug\|Any CPU....{99772D98-3865-4E8D-BB02-A855950904F8}.Debug\|x64.Build.0 = Debug\|Any CPU....{99772D98-3865-4E8D-BB02-A855950904F8}.Release\|Any CPU.ActiveCfg = Releas

C:\Program Files\Cheat Engine 7.5\plugins\cepluginsdk.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	21249
Entropy (8bit):	5.473071232947375
Encrypted:	false
SSDEEP:	384:MxdQ1dn5s8SJRF6A64O0pgwzG1AXQpmwpN6NnES1sq9X5T:Mxu5s8Kq0pgh1AXKbcnEMT
MD5:	E4FFD1E2C206AEB1FC1B8ACB2D2FFC38
SHA1:	A13B6AEF7AA457D47F2745924D4808DAAAB7A809
SHA-256:	B6500DF1E94D7BB011B38E173B2603197B7A1F304496D751EDE82E57E36E532F
SHA-512:	25BAC2C4782B15B86BD5940232B91A1227C286979B93E2F5A8129814AFC619AB6A57B8EF6EA60E92B78B16CDEE39098E8CD0129020E73D3A8872AA2421834833
Malicious:	false
Preview:	/.. cepluginsdk.h.. Updated July 4, 2017.... v5.0.0../..#ifndef CEPLUGINSDK_H..#define CEPLUGINSDK_H....#include <windows.h>..#include "lua.h"..#include "lualib.h"..#include "lauxlib.h"......#define CESDK_VERSION 6....typedef enum {ptAddressList=0, ptMemoryView=1, ptOnDebugEvent=2, ptProcesswatcherEvent=3, ptFunctionPointerchange=4, ptMainMenu=5, ptDisassemblerContext=6, ptDisassemblerRenderLine=7, ptAutoAssembler=8} PluginType;..typedef enum {aaInitialize=0, aaPhase1=1, aaPhase2=2, aaFinalize=3} AutoAssemblerPhase;....typedef struct _PluginVersion..{.. unsigned int version; //write here the minimum version this dll is compatible with (Current supported version: 1 and 2: this SDK only describes 2).. char pluginname; //make this point to a 0-terminated string (allocated memory or static addressin your dll, not stack)..} PluginVersion, PPluginVersion;....typedef struct _PLUGINTYPE0_RECORD..{.. char *interpretedaddress; //pointer to a 255 bytes long string (0 terminated).. UINT_P

C:\Program Files\Cheat Engine 7.5\plugins\cepluginsdk.pas (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20820
Entropy (8bit):	4.9478688580965615
Encrypted:	false
SSDEEP:	384:BxYxU2LDxW7ZTDfKZeiH22CT3oQf/JQeYX9L:BxYxUauZICT4Qf/JQewL
MD5:	940913A8A7D44DFAD443E831137C8E56
SHA1:	4D0BFF7E0F6D917A5DAEBAF092B81BD8BD1C796D
SHA-256:	CDA5269F441120E5A3BFF2F87E289CD71DE9158CA2A619C7D0A734EB98EE6052
SHA-512:	3A74F73FD1CEFD89303689AA1907539377D1AAA4D94761FE4EDBBFB9FF08359733A08C388036A8D4452CE10AB8DA80D87A76816030170C2E0B4E9CF4788CA849
Malicious:	false
Preview:	unit cepluginsdk; //more an api than sdk....{$MODE Delphi}....interface....uses windows, sysutils;....type.. TColor=dword;.. PColor=^TColor;....{$ifndef fpc}..//if old delphi then define the ptruint type..type ptruint=dword;..type pptruint=^ptruint'..{$endif}....const PluginVersionSDK=6;....type TAutoAssemblerPhase=(aaInitialize=0, aaPhase1=1, aaPhase2=2, aaFinalize=3);..type TPluginType=(ptAddressList=0, ptMemoryView=1, ptOnDebugEvent=2, ptProcesswatcherEvent=3, ptFunctionPointerchange=4, ptMainMenu=5, ptDisassemblerContext=6, ptDisassemblerRenderLine=7, ptAutoAssembler=8);....type TDWordArray = array[0..0] of DWord;.. PDWordArray = ^TDWordArray;....type.. TContinueOption = (co_run=0, co_stepinto=1, co_stepover=2, co_runtill=3);....type.. TBreakpointMethod = (bpmInt3, bpmDebugRegister);....type.. TBreakOption = (bo_Break = 0, bo_ChangeRegister = 1, bo_FindCode = 2, bo_FindWhatCodeAccesses = 3, bo_BreakAndTrace=4);.. TBreakPointAction = TBreakOption;....type.. TBreakp

C:\Program Files\Cheat Engine 7.5\plugins\example-c\bla.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.1648042349100605
Encrypted:	false
SSDEEP:	3:UydlFeWIH9y+SNf69JEfo7PKy:U/Xw+SNf6rEMKy
MD5:	A5D7FBE6A1C5EE5C9B8CC1DD85195A4B
SHA1:	F755644CD5430ECDBC20BD52A79E1D503694D223
SHA-256:	49848186572123D3E61B289BD7651DBAB6F130B71C820B3472A2F896B39BB15F
SHA-512:	AD51E7400AB2AFAE7CC118D859EF623C47D92B81622F05CA1C1BA6D4DF3693B664F52A7F80AF3B7A96119658000B10187F62F0D483A263786C2992363ED1770B
Malicious:	false
Preview:	/..class weee {.. public:... int abc;.... private:... int bla;....};/..

C:\Program Files\Cheat Engine 7.5\plugins\example-c\example-c.c (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6621
Entropy (8bit):	5.329177353184485
Encrypted:	false
SSDEEP:	192:yRhA+IF/NIkm/SM1AnPqLxFohmeZEAdyaWWFVTc7dEug67ok:yRaPeSPACmyTyxxr
MD5:	9B4403AD7DFC92D6E7D8BE8A4F9C6D76
SHA1:	55F4E162DC4353B157A94071ED4387646265FE8B
SHA-256:	A7E319FF2484A156A3B027AC3A0A687EF19F878BE7CC07C06D3A98CD2F16F48F
SHA-512:	1D77505357B8FE48A6FBF6BE560A33F8FF31353E521D449EBE714A77320D3D98BB3111956AE29C1FE37CD4D5A8FDE2462A7F1F7476D09436730A0F218DBE97ED
Malicious:	false
Preview:	// example-c.cpp : Defines the entry point for the DLL application...//....//#define WIN32_LEAN_AND_MEAN..// Exclude rarely-used stuff from Windows headers..// Windows Header Files:......#include <windows.h>..#include <stdio.h>..#include "cepluginsdk.h"..#include "bla.h"....int selfid;..int memorybrowserpluginid=-1; //initialize it to -1 to indicate failure (used by the DisablePlugin routine)..int addresslistPluginID=-1;..int debugpluginID=-1;..int ProcesswatchpluginID=-1;..int PointerReassignmentPluginID=-1;..int MainMenuPluginID=-1;....ExportedFunctions Exported;........void __stdcall mainmenuplugin(void)..{...Exported.ShowMessage("Main menu plugin");...return;..}....void __stdcall PointersReassigned(int reserved)..{...//Check the "Pointer to pointer" objects and decide if you want to redirect them to your own routine, or not...//Usefull for implementing your own read process memory and overriding user choises ...//(e.g when they pick read physical memory and you want to focus on onl

C:\Program Files\Cheat Engine 7.5\plugins\example-c\example-c.def (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	123
Entropy (8bit):	4.811779479994327
Encrypted:	false
SSDEEP:	3:T8OEUpBiFc/v1JQChi02V/X1JQChsLZmQLf4lFX1JQChhXT6fW:TeyiF8tJXPKlJXcelJX3jt
MD5:	16E7BC7FC630EBC06C84FC437CC784AF
SHA1:	73EBEAE9140D391B8FC8C2A323B0DDEC2E09834F
SHA-256:	D8882065B6EF9E9A4B544AB301D7C1305B989C2E6DA72769F547781B5642A367
SHA-512:	7EA5115CFCB40DF766F98B0B19C6C7F91B29F70D76B8BF0BE86344298E22F45E46C491DDD3554ECB9C49340F778D1D1D8141351BD48EA01ECB7FCF158B0D6DED
Malicious:	false
Preview:	LIBRARY..Example-C..EXPORTS .. CEPlugin_GetVersion.@1.. CEPlugin_InitializePlugin @2.. CEPlugin_DisablePlugin @3

C:\Program Files\Cheat Engine 7.5\plugins\example-c\example-c.sln (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1312
Entropy (8bit):	5.515215172889527
Encrypted:	false
SSDEEP:	24:zPEkprjnOq3v5mq3a6cq3ovq3c3q3psq3w6Sq3S8mq3iRq3P88W:zPTrjTV75bMaflv37y0UZ
MD5:	0DC38E698FCA8775DDFC53EB9E2777CE
SHA1:	031F1563637D3980AC76E7E425B82FE97E4BF8CA
SHA-256:	4589682CFE7932386BB7E079C63A1303CE16204FAA26A1AD754C743273A30646
SHA-512:	336E5D3F693479282CC73EF5AD0B88A39554990251ED1587A488B591D7E26B9431B3EF79078A89480D9ECFF9512F3FF66F249983955E4B3657E10FBC3211FE10
Malicious:	false
Preview:	Microsoft Visual Studio Solution File, Format Version 12.00..# Visual Studio 2013..VisualStudioVersion = 12.0.40629.0..MinimumVisualStudioVersion = 10.0.40219.1..Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "example-c", "example-c.vcxproj", "{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}"..EndProject..Global...GlobalSection(SolutionConfigurationPlatforms) = preSolution....Debug\|Win32 = Debug\|Win32....Debug\|x64 = Debug\|x64....Release\|Win32 = Release\|Win32....Release\|x64 = Release\|x64...EndGlobalSection...GlobalSection(ProjectConfigurationPlatforms) = postSolution....{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}.Debug\|Win32.ActiveCfg = Debug\|Win32....{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}.Debug\|Win32.Build.0 = Debug\|Win32....{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}.Debug\|x64.ActiveCfg = Debug\|x64....{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}.Debug\|x64.Build.0 = Debug\|x64....{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}.Release\|Win32.ActiveCfg = Release\|Win32....{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}.Release\|

C:\Program Files\Cheat Engine 7.5\plugins\example-c\example-c.vcproj (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8651
Entropy (8bit):	5.1559669229373775
Encrypted:	false
SSDEEP:	96:Splq9zWlIHcHzp1o2q9zEa4HGE1oZq9znl/HcHzpcobq9z/a4HGEcooEtk6084bP:S+hW8SzpOhEXGEbhnFSzpWh/XGE1088
MD5:	EB57AF6CC5BE00BE4CCA68C11A9DD167
SHA1:	30766A046E9059200C7A1F834AD446413382EE8A
SHA-256:	58C62A39812F64D90A6B8A480E6BDCA9C42D285E77A6271F0E5F2F3E80DD668E
SHA-512:	B4E2D485DC6D4A4B7D2702AA62E737F136B64D3AC6DF134E04A2BB3DAEA3FB6AC7EF603B67CB14630D609A6D767BE0619F5B68A471426A8692A68FED6BA9AE16
Malicious:	false
Preview:	<?xml version="1.0" encoding="Windows-1252"?>..<VisualStudioProject...ProjectType="Visual C++"...Version="9.00"...Name="example-c"...ProjectGUID="{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}"...RootNamespace="example-c"...Keyword="Win32Proj"...TargetFrameworkVersion="131072"...>...<Platforms>....<Platform.....Name="Win32"..../>....<Platform.....Name="x64"..../>...</Platforms>...<ToolFiles>...</ToolFiles>...<Configurations>....<Configuration.....Name="Debug\|Win32".....OutputDirectory="Debug".....IntermediateDirectory="Debug".....ConfigurationType="2".....InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops".....CharacterSet="2".....>.....<Tool......Name="VCPreBuildEventTool"...../>.....<Tool......Name="VCCustomBuildTool"...../>.....<Tool......Name="VCXMLDataGeneratorTool"...../>.....<Tool......Name="VCWebServiceProxyGeneratorTool"...../>.....<Tool......Name="VCMIDLTool"...../>.....<Tool......Name="VCCLCompilerTool"......Optimization="0"......AdditionalIncludeDirec

C:\Program Files\Cheat Engine 7.5\plugins\example-c\example-c.vcxproj (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11635
Entropy (8bit):	5.284575044062978
Encrypted:	false
SSDEEP:	96:xY0/awSBAfNEVDyCyaL9CWyaL9CjyaL9CZyaL9CCmVurQaOnp6UTJAZpXWZAWpXP:xx/awoSuhE61pXSpXCVpX8ispX8Mj
MD5:	1E03374CF6182BEC5B87AD696B3B3D90
SHA1:	C197F285AFF272A818BB286AD06F09F7D82D41B0
SHA-256:	07EEC81F9ACD2497979520EE9F028735DD3BAB27312DD93ED6653B28255AA112
SHA-512:	E10C81E0A00C82D6C6E7582F7002484558FFD2B94D47AF69A898D4CFAC2978F23E41EDE0135ECF252B25534BBD192E0BC78788E9308C5B09E73DEC7EF6F10D82
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">.. <ItemGroup Label="ProjectConfigurations">.. <ProjectConfiguration Include="Debug\|Win32">.. <Configuration>Debug</Configuration>.. <Platform>Win32</Platform>.. </ProjectConfiguration>.. <ProjectConfiguration Include="Debug\|x64">.. <Configuration>Debug</Configuration>.. <Platform>x64</Platform>.. </ProjectConfiguration>.. <ProjectConfiguration Include="Release\|Win32">.. <Configuration>Release</Configuration>.. <Platform>Win32</Platform>.. </ProjectConfiguration>.. <ProjectConfiguration Include="Release\|x64">.. <Configuration>Release</Configuration>.. <Platform>x64</Platform>.. </ProjectConfiguration>.. </ItemGroup>.. <PropertyGroup Label="Globals">.. <ProjectGuid>{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}</ProjectGuid>.. <RootNamespace>example-c</RootNamespace>..

C:\Program Files\Cheat Engine 7.5\plugins\example-c\example-c.vcxproj.filters (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	5.096113834015664
Encrypted:	false
SSDEEP:	24:JdS4+lOFKMz4DFA5glIFXZ/ZaO0v1ZThRGBv3505Z9FJx3505Z9n93505Z94v355:3Qlo4aunNbR2hW/kbhE/K
MD5:	9740E73E7CDBD769A46179A035F59FDB
SHA1:	C923A13EBCD12F98BB4610AF25C833D3D2F6EC30
SHA-256:	DDAF1810F761922EBCC88D654AE05149C26A9A72CC6FFF0876A8BADBFA59F2B8
SHA-512:	3DC1CFCF7B7DAB45935E0249AA4566B68AE573A32A5987854E32C168547FB8452E0179DD7465A1BDA780E4AE416C74D4B0885C2F3DC066133D81172BFF575B53
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">.. <ItemGroup>.. <Filter Include="Source Files">.. <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>.. <Extensions>cpp;c;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>.. </Filter>.. <Filter Include="Header Files">.. <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>.. <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>.. </Filter>.. <Filter Include="Resource Files">.. <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>.. <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx</Extensions>.. </Filter>.. </ItemGroup>.. <ItemGroup>.. <ClCompile Include="bla.cpp">.. <Filter>Source Files</Filter>.. </ClCompile>.. <ClCompile Include="example-c.c">.. <Filter>Source Files</Filter>.. </ClCompile>.. </ItemGroup

C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-DAA8Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6621
Entropy (8bit):	5.329177353184485
Encrypted:	false
SSDEEP:	192:yRhA+IF/NIkm/SM1AnPqLxFohmeZEAdyaWWFVTc7dEug67ok:yRaPeSPACmyTyxxr
MD5:	9B4403AD7DFC92D6E7D8BE8A4F9C6D76
SHA1:	55F4E162DC4353B157A94071ED4387646265FE8B
SHA-256:	A7E319FF2484A156A3B027AC3A0A687EF19F878BE7CC07C06D3A98CD2F16F48F
SHA-512:	1D77505357B8FE48A6FBF6BE560A33F8FF31353E521D449EBE714A77320D3D98BB3111956AE29C1FE37CD4D5A8FDE2462A7F1F7476D09436730A0F218DBE97ED
Malicious:	false
Preview:	// example-c.cpp : Defines the entry point for the DLL application...//....//#define WIN32_LEAN_AND_MEAN..// Exclude rarely-used stuff from Windows headers..// Windows Header Files:......#include <windows.h>..#include <stdio.h>..#include "cepluginsdk.h"..#include "bla.h"....int selfid;..int memorybrowserpluginid=-1; //initialize it to -1 to indicate failure (used by the DisablePlugin routine)..int addresslistPluginID=-1;..int debugpluginID=-1;..int ProcesswatchpluginID=-1;..int PointerReassignmentPluginID=-1;..int MainMenuPluginID=-1;....ExportedFunctions Exported;........void __stdcall mainmenuplugin(void)..{...Exported.ShowMessage("Main menu plugin");...return;..}....void __stdcall PointersReassigned(int reserved)..{...//Check the "Pointer to pointer" objects and decide if you want to redirect them to your own routine, or not...//Usefull for implementing your own read process memory and overriding user choises ...//(e.g when they pick read physical memory and you want to focus on onl

C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-NBF0F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C++ source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.1648042349100605
Encrypted:	false
SSDEEP:	3:UydlFeWIH9y+SNf69JEfo7PKy:U/Xw+SNf6rEMKy
MD5:	A5D7FBE6A1C5EE5C9B8CC1DD85195A4B
SHA1:	F755644CD5430ECDBC20BD52A79E1D503694D223
SHA-256:	49848186572123D3E61B289BD7651DBAB6F130B71C820B3472A2F896B39BB15F
SHA-512:	AD51E7400AB2AFAE7CC118D859EF623C47D92B81622F05CA1C1BA6D4DF3693B664F52A7F80AF3B7A96119658000B10187F62F0D483A263786C2992363ED1770B
Malicious:	false
Preview:	/..class weee {.. public:... int abc;.... private:... int bla;....};/..

C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-PMDDR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	123
Entropy (8bit):	4.811779479994327
Encrypted:	false
SSDEEP:	3:T8OEUpBiFc/v1JQChi02V/X1JQChsLZmQLf4lFX1JQChhXT6fW:TeyiF8tJXPKlJXcelJX3jt
MD5:	16E7BC7FC630EBC06C84FC437CC784AF
SHA1:	73EBEAE9140D391B8FC8C2A323B0DDEC2E09834F
SHA-256:	D8882065B6EF9E9A4B544AB301D7C1305B989C2E6DA72769F547781B5642A367
SHA-512:	7EA5115CFCB40DF766F98B0B19C6C7F91B29F70D76B8BF0BE86344298E22F45E46C491DDD3554ECB9C49340F778D1D1D8141351BD48EA01ECB7FCF158B0D6DED
Malicious:	false
Preview:	LIBRARY..Example-C..EXPORTS .. CEPlugin_GetVersion.@1.. CEPlugin_InitializePlugin @2.. CEPlugin_DisablePlugin @3

C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-TD7IO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1312
Entropy (8bit):	5.515215172889527
Encrypted:	false
SSDEEP:	24:zPEkprjnOq3v5mq3a6cq3ovq3c3q3psq3w6Sq3S8mq3iRq3P88W:zPTrjTV75bMaflv37y0UZ
MD5:	0DC38E698FCA8775DDFC53EB9E2777CE
SHA1:	031F1563637D3980AC76E7E425B82FE97E4BF8CA
SHA-256:	4589682CFE7932386BB7E079C63A1303CE16204FAA26A1AD754C743273A30646
SHA-512:	336E5D3F693479282CC73EF5AD0B88A39554990251ED1587A488B591D7E26B9431B3EF79078A89480D9ECFF9512F3FF66F249983955E4B3657E10FBC3211FE10
Malicious:	false
Preview:	Microsoft Visual Studio Solution File, Format Version 12.00..# Visual Studio 2013..VisualStudioVersion = 12.0.40629.0..MinimumVisualStudioVersion = 10.0.40219.1..Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "example-c", "example-c.vcxproj", "{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}"..EndProject..Global...GlobalSection(SolutionConfigurationPlatforms) = preSolution....Debug\|Win32 = Debug\|Win32....Debug\|x64 = Debug\|x64....Release\|Win32 = Release\|Win32....Release\|x64 = Release\|x64...EndGlobalSection...GlobalSection(ProjectConfigurationPlatforms) = postSolution....{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}.Debug\|Win32.ActiveCfg = Debug\|Win32....{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}.Debug\|Win32.Build.0 = Debug\|Win32....{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}.Debug\|x64.ActiveCfg = Debug\|x64....{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}.Debug\|x64.Build.0 = Debug\|x64....{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}.Release\|Win32.ActiveCfg = Release\|Win32....{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}.Release\|

C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-TIQC2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	5.096113834015664
Encrypted:	false
SSDEEP:	24:JdS4+lOFKMz4DFA5glIFXZ/ZaO0v1ZThRGBv3505Z9FJx3505Z9n93505Z94v355:3Qlo4aunNbR2hW/kbhE/K
MD5:	9740E73E7CDBD769A46179A035F59FDB
SHA1:	C923A13EBCD12F98BB4610AF25C833D3D2F6EC30
SHA-256:	DDAF1810F761922EBCC88D654AE05149C26A9A72CC6FFF0876A8BADBFA59F2B8
SHA-512:	3DC1CFCF7B7DAB45935E0249AA4566B68AE573A32A5987854E32C168547FB8452E0179DD7465A1BDA780E4AE416C74D4B0885C2F3DC066133D81172BFF575B53
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">.. <ItemGroup>.. <Filter Include="Source Files">.. <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>.. <Extensions>cpp;c;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>.. </Filter>.. <Filter Include="Header Files">.. <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>.. <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>.. </Filter>.. <Filter Include="Resource Files">.. <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>.. <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx</Extensions>.. </Filter>.. </ItemGroup>.. <ItemGroup>.. <ClCompile Include="bla.cpp">.. <Filter>Source Files</Filter>.. </ClCompile>.. <ClCompile Include="example-c.c">.. <Filter>Source Files</Filter>.. </ClCompile>.. </ItemGroup

C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-VQTQI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	11635
Entropy (8bit):	5.284575044062978
Encrypted:	false
SSDEEP:	96:xY0/awSBAfNEVDyCyaL9CWyaL9CjyaL9CZyaL9CCmVurQaOnp6UTJAZpXWZAWpXP:xx/awoSuhE61pXSpXCVpX8ispX8Mj
MD5:	1E03374CF6182BEC5B87AD696B3B3D90
SHA1:	C197F285AFF272A818BB286AD06F09F7D82D41B0
SHA-256:	07EEC81F9ACD2497979520EE9F028735DD3BAB27312DD93ED6653B28255AA112
SHA-512:	E10C81E0A00C82D6C6E7582F7002484558FFD2B94D47AF69A898D4CFAC2978F23E41EDE0135ECF252B25534BBD192E0BC78788E9308C5B09E73DEC7EF6F10D82
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<Project DefaultTargets="Build" ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">.. <ItemGroup Label="ProjectConfigurations">.. <ProjectConfiguration Include="Debug\|Win32">.. <Configuration>Debug</Configuration>.. <Platform>Win32</Platform>.. </ProjectConfiguration>.. <ProjectConfiguration Include="Debug\|x64">.. <Configuration>Debug</Configuration>.. <Platform>x64</Platform>.. </ProjectConfiguration>.. <ProjectConfiguration Include="Release\|Win32">.. <Configuration>Release</Configuration>.. <Platform>Win32</Platform>.. </ProjectConfiguration>.. <ProjectConfiguration Include="Release\|x64">.. <Configuration>Release</Configuration>.. <Platform>x64</Platform>.. </ProjectConfiguration>.. </ItemGroup>.. <PropertyGroup Label="Globals">.. <ProjectGuid>{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}</ProjectGuid>.. <RootNamespace>example-c</RootNamespace>..

C:\Program Files\Cheat Engine 7.5\plugins\example-c\is-VT36S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8651
Entropy (8bit):	5.1559669229373775
Encrypted:	false
SSDEEP:	96:Splq9zWlIHcHzp1o2q9zEa4HGE1oZq9znl/HcHzpcobq9z/a4HGEcooEtk6084bP:S+hW8SzpOhEXGEbhnFSzpWh/XGE1088
MD5:	EB57AF6CC5BE00BE4CCA68C11A9DD167
SHA1:	30766A046E9059200C7A1F834AD446413382EE8A
SHA-256:	58C62A39812F64D90A6B8A480E6BDCA9C42D285E77A6271F0E5F2F3E80DD668E
SHA-512:	B4E2D485DC6D4A4B7D2702AA62E737F136B64D3AC6DF134E04A2BB3DAEA3FB6AC7EF603B67CB14630D609A6D767BE0619F5B68A471426A8692A68FED6BA9AE16
Malicious:	false
Preview:	<?xml version="1.0" encoding="Windows-1252"?>..<VisualStudioProject...ProjectType="Visual C++"...Version="9.00"...Name="example-c"...ProjectGUID="{3A688B63-7CE8-4993-BEC5-E7FE48B73F03}"...RootNamespace="example-c"...Keyword="Win32Proj"...TargetFrameworkVersion="131072"...>...<Platforms>....<Platform.....Name="Win32"..../>....<Platform.....Name="x64"..../>...</Platforms>...<ToolFiles>...</ToolFiles>...<Configurations>....<Configuration.....Name="Debug\|Win32".....OutputDirectory="Debug".....IntermediateDirectory="Debug".....ConfigurationType="2".....InheritedPropertySheets="$(VCInstallDir)VCProjectDefaults\UpgradeFromVC71.vsprops".....CharacterSet="2".....>.....<Tool......Name="VCPreBuildEventTool"...../>.....<Tool......Name="VCCustomBuildTool"...../>.....<Tool......Name="VCXMLDataGeneratorTool"...../>.....<Tool......Name="VCWebServiceProxyGeneratorTool"...../>.....<Tool......Name="VCMIDLTool"...../>.....<Tool......Name="VCCLCompilerTool"......Optimization="0"......AdditionalIncludeDirec

C:\Program Files\Cheat Engine 7.5\plugins\is-1DI29.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.66236463636852
Encrypted:	false
SSDEEP:	6:jVVr02QbOwsrQl+EEKu/OrxReAEiMlAEgrlAQ0l:jVxxQCJZECueAEdlAEgrlAQy
MD5:	5D2DD4FF9F4C38D14220BB0E425B796C
SHA1:	2FD297C467FFCD72CF9CD21450E5BEAD0AE23962
SHA-256:	A7A47CE4CD19F703B8025696F0631C09A664D54CFA831BE4538D10441AEBB48D
SHA-512:	C84EC5C6F867DF99C9C8C4F57AF4795E2FACA7D81F111F7AECC568CD5A28DE3971A1BFCFEF9950181FF2FA67B82542840488DE718D95F87877F51B0709CE10D6
Malicious:	false
Preview:	// lua.hpp..// Lua header files for C++..// <<extern "C">> not supplied automatically because Lua also compiles as C++....extern "C" {..#include "lua.h"..#include "lualib.h"..#include "lauxlib.h"..}..

C:\Program Files\Cheat Engine 7.5\plugins\is-9GQEE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	21249
Entropy (8bit):	5.473071232947375
Encrypted:	false
SSDEEP:	384:MxdQ1dn5s8SJRF6A64O0pgwzG1AXQpmwpN6NnES1sq9X5T:Mxu5s8Kq0pgh1AXKbcnEMT
MD5:	E4FFD1E2C206AEB1FC1B8ACB2D2FFC38
SHA1:	A13B6AEF7AA457D47F2745924D4808DAAAB7A809
SHA-256:	B6500DF1E94D7BB011B38E173B2603197B7A1F304496D751EDE82E57E36E532F
SHA-512:	25BAC2C4782B15B86BD5940232B91A1227C286979B93E2F5A8129814AFC619AB6A57B8EF6EA60E92B78B16CDEE39098E8CD0129020E73D3A8872AA2421834833
Malicious:	false
Preview:	/.. cepluginsdk.h.. Updated July 4, 2017.... v5.0.0../..#ifndef CEPLUGINSDK_H..#define CEPLUGINSDK_H....#include <windows.h>..#include "lua.h"..#include "lualib.h"..#include "lauxlib.h"......#define CESDK_VERSION 6....typedef enum {ptAddressList=0, ptMemoryView=1, ptOnDebugEvent=2, ptProcesswatcherEvent=3, ptFunctionPointerchange=4, ptMainMenu=5, ptDisassemblerContext=6, ptDisassemblerRenderLine=7, ptAutoAssembler=8} PluginType;..typedef enum {aaInitialize=0, aaPhase1=1, aaPhase2=2, aaFinalize=3} AutoAssemblerPhase;....typedef struct _PluginVersion..{.. unsigned int version; //write here the minimum version this dll is compatible with (Current supported version: 1 and 2: this SDK only describes 2).. char pluginname; //make this point to a 0-terminated string (allocated memory or static addressin your dll, not stack)..} PluginVersion, PPluginVersion;....typedef struct _PLUGINTYPE0_RECORD..{.. char *interpretedaddress; //pointer to a 255 bytes long string (0 terminated).. UINT_P

C:\Program Files\Cheat Engine 7.5\plugins\is-BRK2U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8689
Entropy (8bit):	5.0154559813237505
Encrypted:	false
SSDEEP:	192:AG3SKmwE5ZD7lq4TJpTPx9W1HPHthPRHroDAtZdJ3/L:AnfEvGAr
MD5:	414752BF38E58BD6C662587CA7B4291A
SHA1:	5A82403A8D90D09E9B487AF738ECBCBC0FEEE297
SHA-256:	1A47911AB8C28536B35B83E9887729B06B00E10DED9C1BDB417ECE7657A6C73A
SHA-512:	1DC2A3C45C7FC8F8A1C5A59D6907BB03CCE53EA1E24225118190873AE8C3D28A7C4E287505D6BEEC9BB5AC28077576CEAEF04A1E2C48A0E6CBAD8DDFE8FC71D2
Malicious:	false
Preview:	/..* $Id: lauxlib.h,v 1.128 2014/10/29 16:11:17 roberto Exp $.. Auxiliary functions for building Lua libraries.. See Copyright Notice in lua.h../......#ifndef lauxlib_h..#define lauxlib_h......#include <stddef.h>..#include <stdio.h>....#include "lua.h"......../ extra error code for 'luaL_load' /..#define LUA_ERRFILE (LUA_ERRERR+1)......typedef struct luaL_Reg {.. const char name;.. lua_CFunction func;..} luaL_Reg;......#define LUAL_NUMSIZES.(sizeof(lua_Integer)16 + sizeof(lua_Number))....LUALIB_API void (luaL_checkversion_) (lua_State L, lua_Number ver, size_t sz);..#define luaL_checkversion(L) \... luaL_checkversion_(L, LUA_VERSION_NUM, LUAL_NUMSIZES)....LUALIB_API int (luaL_getmetafield) (lua_State L, int obj, const char e);..LUALIB_API int (luaL_callmeta) (lua_State L, int obj, const char e);..LUALIB_API const char (luaL_tolstring) (lua_State L, int idx, size_t len);..LUALIB_API int (luaL_argerror) (lua_State L, int arg, const char *extramsg);..LUALIB_API

C:\Program Files\Cheat Engine 7.5\plugins\is-FKENA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	21043
Entropy (8bit):	5.394919695008515
Encrypted:	false
SSDEEP:	384:AmA+N/G+woUL8m7ETjv68AaMNZjXrQvLXF2ZsgcoGkR3lY6TKhaokMC5:++zbTr68AaMNZjXrQvLXF2ZsgcoGkR3T
MD5:	FE4F0BA514434B7F01983B97F6E517E0
SHA1:	7057FB0BCC204AC4E65AADDBDA350BF8F7488A3E
SHA-256:	0C5D09A7908F99B80377B3157A0BD37C6322CDC0AF437E99501AE746037408EC
SHA-512:	BEBB3A5C5384D0A08955A95970A40509D2ECE40FEEFB0A7C80BBFD4F9CF02E88AED69B5BF05BA6FFFABDD88D364BBB717AD4F59E3A1B6999BCD1CDEBDD410D53
Malicious:	false
Preview:	/..* $Id: luaconf.h,v 1.238 2014/12/29 13:27:55 roberto Exp $.. Configuration file for Lua.. See Copyright Notice in lua.h../......#ifndef luaconf_h..#define luaconf_h....#include <limits.h>..#include <stddef.h>....../.. ===================================================================.. Search for "@@" to find all configurable definitions...** ===================================================================../....../.. {====================================================================.. System Configuration: macros to adapt (if needed) Lua to some.. particular platform, for instance compiling it with 32-bit numbers or.. restricting it to C89...** =====================================================================../..../..@@ LUA_32BITS enables Lua with 32-bit integers and 32-bit floats. You.. can also define LUA_32BITS in the make file, but changing here you.. ensure that all software connected to Lua will be compiled with the..** same configurati

C:\Program Files\Cheat Engine 7.5\plugins\is-I51PG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	current ar archive
Category:	dropped
Size (bytes):	30522
Entropy (8bit):	4.730977794432752
Encrypted:	false
SSDEEP:	768:G+9VzUvXP24qb80klIfUYFXk6mN6O4teI0BhIan342:54V
MD5:	AAE95F62EAD4B09BAD0CDEBC9F68D8FC
SHA1:	6B8A2A943DEAC8E4F89E3985E04FD364B35065C8
SHA-256:	55B823D33C806BAAB879D3E8FD4D02253B719DCB9D4C7A74A1947AF0C99F7132
SHA-512:	0874A2A6D4F48EB9EBAF6FD4886ABF062EEA1F55FD2E8771B597C9EEE6666F74D44067D4074B52C5B453197D76DC575CE8608CA893F7377F9218345CBCA8BEE4
Malicious:	false
Preview:	!<arch>./ -1 0 6568 `....+..3...6...7@..p...p...p\|..p\|..j...j...W...W...\...\...f...f...Q...Q...Z...Z...O..O..\...\...P...P...Q:..Q:..kf..kf..Pj..Pj..Z...Z...]...]...M...M...j...j...iB..iB..e...e...e...e...d...d...hn..hn..g,..g,..i...i...g...g...W...W...Uj..Uj..O...O...c...c...cp..cp..c...c...T,..T,..R...R...VF..VF..Rx..Rx..aP..aP.._(.._(..]n..]n..]...]...^L..^L..b..b..`...`..._..._...^...^...`t..`t..`...`...nb..nb..n...n...o:..o:..l...l...dD..dD..m...m...lB..lB..m...m...m...m...k...k...N...N...L...L...b...b...Y...Y...Y@..Y@..X...X...Xh..Xh..W...W...p...p...o...o...a...a...O...O...fV..fV..j...j...V...V...LD..LD..qV..qV..M...M...q...q...M...M...?...?...D..D..A...A...H...H...A...A...IJ..IJ..D...D...G(..G(..J...J...B...B...;$..;$..@...@...CL..CL..Bn..Bn..B...B...Kp..Kp..Hv..Hv..:...:...:H..:H..9p..9p..H...H...G...G...9...9...8...8...F...F...En..En..;...;...FJ..FJ..<...<...E...E...<l..<l..;...;...>..>..=...=...=L..=L..>...>...J&..J&..I.

C:\Program Files\Cheat Engine 7.5\plugins\is-JAMT5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	20820
Entropy (8bit):	4.9478688580965615
Encrypted:	false
SSDEEP:	384:BxYxU2LDxW7ZTDfKZeiH22CT3oQf/JQeYX9L:BxYxUauZICT4Qf/JQewL
MD5:	940913A8A7D44DFAD443E831137C8E56
SHA1:	4D0BFF7E0F6D917A5DAEBAF092B81BD8BD1C796D
SHA-256:	CDA5269F441120E5A3BFF2F87E289CD71DE9158CA2A619C7D0A734EB98EE6052
SHA-512:	3A74F73FD1CEFD89303689AA1907539377D1AAA4D94761FE4EDBBFB9FF08359733A08C388036A8D4452CE10AB8DA80D87A76816030170C2E0B4E9CF4788CA849
Malicious:	false
Preview:	unit cepluginsdk; //more an api than sdk....{$MODE Delphi}....interface....uses windows, sysutils;....type.. TColor=dword;.. PColor=^TColor;....{$ifndef fpc}..//if old delphi then define the ptruint type..type ptruint=dword;..type pptruint=^ptruint'..{$endif}....const PluginVersionSDK=6;....type TAutoAssemblerPhase=(aaInitialize=0, aaPhase1=1, aaPhase2=2, aaFinalize=3);..type TPluginType=(ptAddressList=0, ptMemoryView=1, ptOnDebugEvent=2, ptProcesswatcherEvent=3, ptFunctionPointerchange=4, ptMainMenu=5, ptDisassemblerContext=6, ptDisassemblerRenderLine=7, ptAutoAssembler=8);....type TDWordArray = array[0..0] of DWord;.. PDWordArray = ^TDWordArray;....type.. TContinueOption = (co_run=0, co_stepinto=1, co_stepover=2, co_runtill=3);....type.. TBreakpointMethod = (bpmInt3, bpmDebugRegister);....type.. TBreakOption = (bo_Break = 0, bo_ChangeRegister = 1, bo_FindCode = 2, bo_FindWhatCodeAccesses = 3, bo_BreakAndTrace=4);.. TBreakPointAction = TBreakOption;....type.. TBreakp

C:\Program Files\Cheat Engine 7.5\plugins\is-Q5JOQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	5.27341352475105
Encrypted:	false
SSDEEP:	24:1i4ToLKs3cpb0gxTCLZKds9dk3kzVr4FiRok:Eaom3IVWiRok
MD5:	D763A23012A8DAFD2D76CE4A0609CC17
SHA1:	B7C2040F6EF844048A1B17E204658AD0F5C6957E
SHA-256:	3890F6CE73F70F6EB67EC42A74F7C8CEF40FA184659934906648C8ACADB53FBF
SHA-512:	9AC100782422E02809F5A63A42B9787F97C9FF292CC3EBB7E2DC39B5E40E671C566A74DEC8D1A748B7D4E8666499F045FDEE6ED4DDB0207FF7856145CBFD294E
Malicious:	false
Preview:	/..* $Id: lualib.h,v 1.44 2014/02/06 17:32:33 roberto Exp $.. Lua standard libraries.. See Copyright Notice in lua.h../......#ifndef lualib_h..#define lualib_h....#include "lua.h"........LUAMOD_API int (luaopen_base) (lua_State L);....#define LUA_COLIBNAME."coroutine"..LUAMOD_API int (luaopen_coroutine) (lua_State L);....#define LUA_TABLIBNAME."table"..LUAMOD_API int (luaopen_table) (lua_State L);....#define LUA_IOLIBNAME."io"..LUAMOD_API int (luaopen_io) (lua_State L);....#define LUA_OSLIBNAME."os"..LUAMOD_API int (luaopen_os) (lua_State L);....#define LUA_STRLIBNAME."string"..LUAMOD_API int (luaopen_string) (lua_State L);....#define LUA_UTF8LIBNAME."utf8"..LUAMOD_API int (luaopen_utf8) (lua_State L);....#define LUA_BITLIBNAME."bit32"..LUAMOD_API int (luaopen_bit32) (lua_State L);....#define LUA_MATHLIBNAME."math"..LUAMOD_API int (luaopen_math) (lua_State L);....#define LUA_DBLIBNAME."debug"..LUAMOD_API int (luaopen_debug) (lua_State *L);....#define LUA_LOADLIBNAME."pa

C:\Program Files\Cheat Engine 7.5\plugins\is-R1OD4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15219
Entropy (8bit):	5.2811147294549095
Encrypted:	false
SSDEEP:	192:e0NdvtffvT5GDazPCagC/3hJiOY4k1gN3glwkp7MYTG26nRRT46lQHTa:lf4Dg6agC/3h8OBk7wkJMYTG1Rxqa
MD5:	555A7140BBD46A1B5BFD5BAC4A9A9F10
SHA1:	457CEE5851A018909D1BC96824E99C0C775166EE
SHA-256:	8AEF3FA9669BDC5E7659389E276F31EC779CA4BDF96E2C9ADA07DD9458A47416
SHA-512:	34B85999AA982DE19630DFA2100C60618758A4247FE5CDB3320E04904415619AA437A72E97B5E67AD287E47C66E73C7FD04DA6786DC1FCFA981207541043F3FB
Malicious:	false
Preview:	/..* $Id: lua.h,v 1.325 2014/12/26 17:24:27 roberto Exp $.. Lua - A Scripting Language.. Lua.org, PUC-Rio, Brazil (http://www.lua.org)..** See Copyright Notice at the end of this file../......#ifndef lua_h..#define lua_h....#include <stdarg.h>..#include <stddef.h>......#include "luaconf.h"......#define LUA_VERSION_MAJOR."5"..#define LUA_VERSION_MINOR."3"..#define LUA_VERSION_NUM..503..#define LUA_VERSION_RELEASE."0"....#define LUA_VERSION."Lua " LUA_VERSION_MAJOR "." LUA_VERSION_MINOR..#define LUA_RELEASE.LUA_VERSION "." LUA_VERSION_RELEASE..#define LUA_COPYRIGHT.LUA_RELEASE " Copyright (C) 1994-2015 Lua.org, PUC-Rio"..#define LUA_AUTHORS."R. Ierusalimschy, L. H. de Figueiredo, W. Celes"....../ mark for precompiled code ('<esc>Lua') /..#define LUA_SIGNATURE."\x1bLua"..../ option for multiple returns in 'lua_pcall' and 'lua_call' /..#define LUA_MULTRET.(-1)....../..** pseudo-indices..*/..#define LUA_REGISTRYINDEX.LUAI_FIRSTPSEUDOIDX..#define lua_upvalueindex(i).(LUA_REGISTR

C:\Program Files\Cheat Engine 7.5\plugins\is-SJNR4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	current ar archive
Category:	dropped
Size (bytes):	51186
Entropy (8bit):	5.1687334046820474
Encrypted:	false
SSDEEP:	384:rJFHn1qrIxu38h8ZLE4aydYZs+1RnNqEk7/JNK2A26spyFAaNbghZGV4iwKWV8UN:/buA8ZLbYPncBQ5Rmychrr+W
MD5:	F22FF9845A888059D8B7F3581E43C098
SHA1:	766835B82B55B5254CD3CE03AF27C94CE98661AD
SHA-256:	CD7C6537C01CECF6CC4F71762D4D66092A51E5D99C7BA9C175988DE7308A85B9
SHA-512:	30A1A33B701928DD5AE8A9C7A9E2C3632E75195155936FE8D63EE26541BEBFE2F9219B6528F7E657D52DB1F6CDEB779D8FEE226B224253CED4D4EFAA349B8BD7
Malicious:	false
Preview:	!<arch>./ -1 0 14598 `....+..t...w...x@...X...X...........Z...Z...........t...t...v...v...z...z...........R...R...........,...,..........."..."...........,...,...........0...0...L...L...................d...d...........h...h...........r...r..................................."..."...........>...>...........B...B...........P...P...................p...p...................................................,...,...........2...2...........L...L...........f...f...........................T...T...........................t...t...................................n...n...........................~...~...d...d...........................................8...8...........................................f...f...:...:...........V...V...........@...@..."..."...................H...H..................\|...\|....@...@..{6..{6..~...~....J...J..................}...}.........................}v..}v.........................:...:...........P...P...........Z...Z............

C:\Program Files\Cheat Engine 7.5\plugins\lauxlib.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	8689
Entropy (8bit):	5.0154559813237505
Encrypted:	false
SSDEEP:	192:AG3SKmwE5ZD7lq4TJpTPx9W1HPHthPRHroDAtZdJ3/L:AnfEvGAr
MD5:	414752BF38E58BD6C662587CA7B4291A
SHA1:	5A82403A8D90D09E9B487AF738ECBCBC0FEEE297
SHA-256:	1A47911AB8C28536B35B83E9887729B06B00E10DED9C1BDB417ECE7657A6C73A
SHA-512:	1DC2A3C45C7FC8F8A1C5A59D6907BB03CCE53EA1E24225118190873AE8C3D28A7C4E287505D6BEEC9BB5AC28077576CEAEF04A1E2C48A0E6CBAD8DDFE8FC71D2
Malicious:	false
Preview:	/..* $Id: lauxlib.h,v 1.128 2014/10/29 16:11:17 roberto Exp $.. Auxiliary functions for building Lua libraries.. See Copyright Notice in lua.h../......#ifndef lauxlib_h..#define lauxlib_h......#include <stddef.h>..#include <stdio.h>....#include "lua.h"......../ extra error code for 'luaL_load' /..#define LUA_ERRFILE (LUA_ERRERR+1)......typedef struct luaL_Reg {.. const char name;.. lua_CFunction func;..} luaL_Reg;......#define LUAL_NUMSIZES.(sizeof(lua_Integer)16 + sizeof(lua_Number))....LUALIB_API void (luaL_checkversion_) (lua_State L, lua_Number ver, size_t sz);..#define luaL_checkversion(L) \... luaL_checkversion_(L, LUA_VERSION_NUM, LUAL_NUMSIZES)....LUALIB_API int (luaL_getmetafield) (lua_State L, int obj, const char e);..LUALIB_API int (luaL_callmeta) (lua_State L, int obj, const char e);..LUALIB_API const char (luaL_tolstring) (lua_State L, int idx, size_t len);..LUALIB_API int (luaL_argerror) (lua_State L, int arg, const char *extramsg);..LUALIB_API

C:\Program Files\Cheat Engine 7.5\plugins\lua.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15219
Entropy (8bit):	5.2811147294549095
Encrypted:	false
SSDEEP:	192:e0NdvtffvT5GDazPCagC/3hJiOY4k1gN3glwkp7MYTG26nRRT46lQHTa:lf4Dg6agC/3h8OBk7wkJMYTG1Rxqa
MD5:	555A7140BBD46A1B5BFD5BAC4A9A9F10
SHA1:	457CEE5851A018909D1BC96824E99C0C775166EE
SHA-256:	8AEF3FA9669BDC5E7659389E276F31EC779CA4BDF96E2C9ADA07DD9458A47416
SHA-512:	34B85999AA982DE19630DFA2100C60618758A4247FE5CDB3320E04904415619AA437A72E97B5E67AD287E47C66E73C7FD04DA6786DC1FCFA981207541043F3FB
Malicious:	false
Preview:	/..* $Id: lua.h,v 1.325 2014/12/26 17:24:27 roberto Exp $.. Lua - A Scripting Language.. Lua.org, PUC-Rio, Brazil (http://www.lua.org)..** See Copyright Notice at the end of this file../......#ifndef lua_h..#define lua_h....#include <stdarg.h>..#include <stddef.h>......#include "luaconf.h"......#define LUA_VERSION_MAJOR."5"..#define LUA_VERSION_MINOR."3"..#define LUA_VERSION_NUM..503..#define LUA_VERSION_RELEASE."0"....#define LUA_VERSION."Lua " LUA_VERSION_MAJOR "." LUA_VERSION_MINOR..#define LUA_RELEASE.LUA_VERSION "." LUA_VERSION_RELEASE..#define LUA_COPYRIGHT.LUA_RELEASE " Copyright (C) 1994-2015 Lua.org, PUC-Rio"..#define LUA_AUTHORS."R. Ierusalimschy, L. H. de Figueiredo, W. Celes"....../ mark for precompiled code ('<esc>Lua') /..#define LUA_SIGNATURE."\x1bLua"..../ option for multiple returns in 'lua_pcall' and 'lua_call' /..#define LUA_MULTRET.(-1)....../..** pseudo-indices..*/..#define LUA_REGISTRYINDEX.LUAI_FIRSTPSEUDOIDX..#define lua_upvalueindex(i).(LUA_REGISTR

C:\Program Files\Cheat Engine 7.5\plugins\lua.hpp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.66236463636852
Encrypted:	false
SSDEEP:	6:jVVr02QbOwsrQl+EEKu/OrxReAEiMlAEgrlAQ0l:jVxxQCJZECueAEdlAEgrlAQy
MD5:	5D2DD4FF9F4C38D14220BB0E425B796C
SHA1:	2FD297C467FFCD72CF9CD21450E5BEAD0AE23962
SHA-256:	A7A47CE4CD19F703B8025696F0631C09A664D54CFA831BE4538D10441AEBB48D
SHA-512:	C84EC5C6F867DF99C9C8C4F57AF4795E2FACA7D81F111F7AECC568CD5A28DE3971A1BFCFEF9950181FF2FA67B82542840488DE718D95F87877F51B0709CE10D6
Malicious:	false
Preview:	// lua.hpp..// Lua header files for C++..// <<extern "C">> not supplied automatically because Lua also compiles as C++....extern "C" {..#include "lua.h"..#include "lualib.h"..#include "lauxlib.h"..}..

C:\Program Files\Cheat Engine 7.5\plugins\lua53-32.lib (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	current ar archive
Category:	dropped
Size (bytes):	30522
Entropy (8bit):	4.730977794432752
Encrypted:	false
SSDEEP:	768:G+9VzUvXP24qb80klIfUYFXk6mN6O4teI0BhIan342:54V
MD5:	AAE95F62EAD4B09BAD0CDEBC9F68D8FC
SHA1:	6B8A2A943DEAC8E4F89E3985E04FD364B35065C8
SHA-256:	55B823D33C806BAAB879D3E8FD4D02253B719DCB9D4C7A74A1947AF0C99F7132
SHA-512:	0874A2A6D4F48EB9EBAF6FD4886ABF062EEA1F55FD2E8771B597C9EEE6666F74D44067D4074B52C5B453197D76DC575CE8608CA893F7377F9218345CBCA8BEE4
Malicious:	false
Preview:	!<arch>./ -1 0 6568 `....+..3...6...7@..p...p...p\|..p\|..j...j...W...W...\...\...f...f...Q...Q...Z...Z...O..O..\...\...P...P...Q:..Q:..kf..kf..Pj..Pj..Z...Z...]...]...M...M...j...j...iB..iB..e...e...e...e...d...d...hn..hn..g,..g,..i...i...g...g...W...W...Uj..Uj..O...O...c...c...cp..cp..c...c...T,..T,..R...R...VF..VF..Rx..Rx..aP..aP.._(.._(..]n..]n..]...]...^L..^L..b..b..`...`..._..._...^...^...`t..`t..`...`...nb..nb..n...n...o:..o:..l...l...dD..dD..m...m...lB..lB..m...m...m...m...k...k...N...N...L...L...b...b...Y...Y...Y@..Y@..X...X...Xh..Xh..W...W...p...p...o...o...a...a...O...O...fV..fV..j...j...V...V...LD..LD..qV..qV..M...M...q...q...M...M...?...?...D..D..A...A...H...H...A...A...IJ..IJ..D...D...G(..G(..J...J...B...B...;$..;$..@...@...CL..CL..Bn..Bn..B...B...Kp..Kp..Hv..Hv..:...:...:H..:H..9p..9p..H...H...G...G...9...9...8...8...F...F...En..En..;...;...FJ..FJ..<...<...E...E...<l..<l..;...;...>..>..=...=...=L..=L..>...>...J&..J&..I.

C:\Program Files\Cheat Engine 7.5\plugins\lua53-64.lib (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	current ar archive
Category:	dropped
Size (bytes):	51186
Entropy (8bit):	5.1687334046820474
Encrypted:	false
SSDEEP:	384:rJFHn1qrIxu38h8ZLE4aydYZs+1RnNqEk7/JNK2A26spyFAaNbghZGV4iwKWV8UN:/buA8ZLbYPncBQ5Rmychrr+W
MD5:	F22FF9845A888059D8B7F3581E43C098
SHA1:	766835B82B55B5254CD3CE03AF27C94CE98661AD
SHA-256:	CD7C6537C01CECF6CC4F71762D4D66092A51E5D99C7BA9C175988DE7308A85B9
SHA-512:	30A1A33B701928DD5AE8A9C7A9E2C3632E75195155936FE8D63EE26541BEBFE2F9219B6528F7E657D52DB1F6CDEB779D8FEE226B224253CED4D4EFAA349B8BD7
Malicious:	false
Preview:	!<arch>./ -1 0 14598 `....+..t...w...x@...X...X...........Z...Z...........t...t...v...v...z...z...........R...R...........,...,..........."..."...........,...,...........0...0...L...L...................d...d...........h...h...........r...r..................................."..."...........>...>...........B...B...........P...P...................p...p...................................................,...,...........2...2...........L...L...........f...f...........................T...T...........................t...t...................................n...n...........................~...~...d...d...........................................8...8...........................................f...f...:...:...........V...V...........@...@..."..."...................H...H..................\|...\|....@...@..{6..{6..~...~....J...J..................}...}.........................}v..}v.........................:...:...........P...P...........Z...Z............

C:\Program Files\Cheat Engine 7.5\plugins\luaconf.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	21043
Entropy (8bit):	5.394919695008515
Encrypted:	false
SSDEEP:	384:AmA+N/G+woUL8m7ETjv68AaMNZjXrQvLXF2ZsgcoGkR3lY6TKhaokMC5:++zbTr68AaMNZjXrQvLXF2ZsgcoGkR3T
MD5:	FE4F0BA514434B7F01983B97F6E517E0
SHA1:	7057FB0BCC204AC4E65AADDBDA350BF8F7488A3E
SHA-256:	0C5D09A7908F99B80377B3157A0BD37C6322CDC0AF437E99501AE746037408EC
SHA-512:	BEBB3A5C5384D0A08955A95970A40509D2ECE40FEEFB0A7C80BBFD4F9CF02E88AED69B5BF05BA6FFFABDD88D364BBB717AD4F59E3A1B6999BCD1CDEBDD410D53
Malicious:	false
Preview:	/..* $Id: luaconf.h,v 1.238 2014/12/29 13:27:55 roberto Exp $.. Configuration file for Lua.. See Copyright Notice in lua.h../......#ifndef luaconf_h..#define luaconf_h....#include <limits.h>..#include <stddef.h>....../.. ===================================================================.. Search for "@@" to find all configurable definitions...** ===================================================================../....../.. {====================================================================.. System Configuration: macros to adapt (if needed) Lua to some.. particular platform, for instance compiling it with 32-bit numbers or.. restricting it to C89...** =====================================================================../..../..@@ LUA_32BITS enables Lua with 32-bit integers and 32-bit floats. You.. can also define LUA_32BITS in the make file, but changing here you.. ensure that all software connected to Lua will be compiled with the..** same configurati

C:\Program Files\Cheat Engine 7.5\plugins\lualib.h (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	5.27341352475105
Encrypted:	false
SSDEEP:	24:1i4ToLKs3cpb0gxTCLZKds9dk3kzVr4FiRok:Eaom3IVWiRok
MD5:	D763A23012A8DAFD2D76CE4A0609CC17
SHA1:	B7C2040F6EF844048A1B17E204658AD0F5C6957E
SHA-256:	3890F6CE73F70F6EB67EC42A74F7C8CEF40FA184659934906648C8ACADB53FBF
SHA-512:	9AC100782422E02809F5A63A42B9787F97C9FF292CC3EBB7E2DC39B5E40E671C566A74DEC8D1A748B7D4E8666499F045FDEE6ED4DDB0207FF7856145CBFD294E
Malicious:	false
Preview:	/..* $Id: lualib.h,v 1.44 2014/02/06 17:32:33 roberto Exp $.. Lua standard libraries.. See Copyright Notice in lua.h../......#ifndef lualib_h..#define lualib_h....#include "lua.h"........LUAMOD_API int (luaopen_base) (lua_State L);....#define LUA_COLIBNAME."coroutine"..LUAMOD_API int (luaopen_coroutine) (lua_State L);....#define LUA_TABLIBNAME."table"..LUAMOD_API int (luaopen_table) (lua_State L);....#define LUA_IOLIBNAME."io"..LUAMOD_API int (luaopen_io) (lua_State L);....#define LUA_OSLIBNAME."os"..LUAMOD_API int (luaopen_os) (lua_State L);....#define LUA_STRLIBNAME."string"..LUAMOD_API int (luaopen_string) (lua_State L);....#define LUA_UTF8LIBNAME."utf8"..LUAMOD_API int (luaopen_utf8) (lua_State L);....#define LUA_BITLIBNAME."bit32"..LUAMOD_API int (luaopen_bit32) (lua_State L);....#define LUA_MATHLIBNAME."math"..LUAMOD_API int (luaopen_math) (lua_State L);....#define LUA_DBLIBNAME."debug"..LUAMOD_API int (luaopen_debug) (lua_State *L);....#define LUA_LOADLIBNAME."pa

C:\Program Files\Cheat Engine 7.5\speedhack-i386.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	205720
Entropy (8bit):	6.5406944146931805
Encrypted:	false
SSDEEP:	3072:KNyaW1Pg7kFtOp8+vRha0DAyheYn13qaIhRFXOucMEx33sOZrcOo:KNyal78m8+vRMEe4a4OEtTi
MD5:	6E00495955D4EFAAC2E1602EB47033EE
SHA1:	95C2998D35ADCF2814EC7C056BFBE0A0EB6A100C
SHA-256:	5E24A5FE17EC001CAB7118328A4BFF0F2577BD057206C6C886C3B7FB98E0D6D9
SHA-512:	2004D1DEF322B6DD7B129FE4FA7BBE5D42AB280B2E9E81DE806F54313A7ED7231F71B62B6138AC767288FEE796092F3397E5390E858E06E55A69B0D00F18B866
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#...G ........)...........0...............................@..........................................@.......P........................g......."......................................................h............................text... ........................... ..`.data........0......................@....rdata..._...P...`...*..............@..@.bss.....)...............................CRT................................@....idata..=...........................@....edata..@...........................@..@.reloc...".......$..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\speedhack-x86_64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	262552
Entropy (8bit):	6.029187209935358
Encrypted:	false
SSDEEP:	3072:JViiO5Ea9m3XJusq4opSm7Im9SC2w/iKhF58jfq65bgusSVIRZOl0vDoD4CfOMsj:JVZcWJusRPm7kCdKfkkApZt
MD5:	19B2050B660A4F9FCB71C93853F2E79C
SHA1:	5FFA886FA019FCD20008E8820A0939C09A62407A
SHA-256:	5421B570FBC1165D7794C08279E311672DC4F42CB7AE1CBDDCD7EEA0B1136FFF
SHA-512:	A93E47387AB0D327B71C3045B3964C7586D0E03DDDB2E692F6671FB99659E829591D5F23CE7A95683D82D239BA7D11FB5A123834629A53DE5CE5DBA6AA714A9A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...G O......h...`...............................................J^..................................................@.......P............`...-.......g..........................................................P................................text... O.......P.................. ..`.data........`.......T..............@....rdata..l............n..............@..@.pdata...-...`.......F..............@..@.bss....h................................CRT.................t..............@....idata...............v..............@....edata..@...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\standalonephase1.cepack (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	data
Category:	dropped
Size (bytes):	28924
Entropy (8bit):	7.991784495689372
Encrypted:	true
SSDEEP:	768:SSHnnhPVVYCzrpCuqOMWlPLe1uvY1R78Occgok:SSHnnJDXZY1RgOccK
MD5:	FE3637780172B207CB31BB3DC612CD34
SHA1:	B65FA4078DCB813EBBA16784C80BC7A0E71025DD
SHA-256:	080A0AE9634FB07F2E9B1DDEA31491564195865DCD2B6201E1A10A13E8CDD5E9
SHA-512:	8F1DA48E6F224B7E7E6EF26D11D3C484A254E9A335DA9E59B837A81F9B7DB501039F31EF9AD055A07BB139BC1147C114923742C3204156AE3371A0F225A433CC
Malicious:	false
Preview:	CEPACK......x.E.0..$.0I..`.........M......&...!.w...eC7.J .q.)Zq..u..^Y...z..+?.8C0!..T@A.k......0..s.g.......<....%.tuU.:u...SU..+...9.......3......./}...WS.....).{.Y....g..?....?...L...C9..Os..iN."w.O~..[..Rsc8~.u....3.....<s....L+s...+...3.3...............3s.{..^.s-..'.-0%r.n..2...%.F.R8.I..a.LxX..\|...=...ci...cb....&.v41@..t...gy..V.7..a.....r..\..k...\j...o..Z/.{..#..Xc......xPz..2...>.~.....:n5...7..x.....Z.....n..+.....h.....t............W....j.8..m.s.k/.e\..Jc}.. W......:8z....C.i[s..9..qz.........[Z6.~.k..7....!...Tk....u...;8m3.U....\|.y_.+x...A..f@6...p........I.....z..<.p.L.@.K?.a.0..O....... ..f..d0.w.>N-..E.w...L.-.b.g....{..K@.....gf.T (>.&.c..)o)7aQ#$.<.@2;.Y.......u.Wu.-....J.\hv.j..V..,.Kv.2.s.N...g.X......mf@P.....k....Q..../...Fj.5.........X{h............r...`.q+U.\.=..,Yf..).....dV..a..m.@..'iQVP....e..3.../v`@{ ..<C&...\|\|........3..7....<.)....u+6:2.V..{......B.]ibU.r.........H*.ea..M.E.ct.m.r.+}f..X2 . ...

C:\Program Files\Cheat Engine 7.5\standalonephase2.cepack (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	data
Category:	dropped
Size (bytes):	99199
Entropy (8bit):	7.9924368254113025
Encrypted:	true
SSDEEP:	1536:CGNxLS1cRzW1Dx15WXGNp7u4A3AP6ovMlJEyWYykDQdTkQRWMJv2kXWMFopxLZq5:QcFW1DdDrTP6o0jEyERskXepHqz9
MD5:	EC8679FCB11314E333F6518113F1D71E
SHA1:	F6642D2551238733324141810B12C964FFE3B518
SHA-256:	45CFE56AE9CBB58FC51700425A19771C87029F63CB1A96CB258AEBE6AEE9D37A
SHA-512:	71EF7CBACD90317D32B0E4E81F64B6A4BABF644A1391396E9FF6C000C902660CFE87E5A86DF456EF5FB2DE0E6688BBF0778AB917D98BC86FB81AEA658672B4DB
Malicious:	false
Preview:	CEPACK.....}}\|S.....m....B..k...U7.....Q.@..u.a...V.`...zz..6.~u..'.lCe...(i...2M)....dzK.F.m(.....4.....~....M..s...<.y.s.M.]>F.0..O,.0-..W.......?.....\......+.>..p].c.........9...@a......-\r...G.[......U....,c.R..1.>..O...53.fI)..7.2L..S..N..U.W..DD.\|..,~...SJcz....z.,.......4.Sz...t....lrb..G.P........}.....C..@.>..;t).......e...#.._..+.....c.i.....W......?.z..........-i.ui.U.......Z3....[.....O.b........I.....4..x.&n...h..4.bM.:M\|.&.@./..h.VM\|.&^.....Wk..h..i.k4....:M..o..5.:M.A.o....}.........fM\|.&.U...o..wh.-..nM.....4.x@.?...5..x.&~Z..5..M<...j..M<..3...9M...5q.&....h..5.BM......i...u..\|M\|.&^../....2M.B._............h.k5.5.u..S...Wk.u.x.&..&.......7k.[4..6M\|.&.C.oI..k./m\|s.o..9....%.(.Mu..N-b..s/..!1.V.).s<~\....d...U...m..((...\|._...{...y70/.A.X....b... ....@:..l3..tdT`....b...>Z..!......~.'....G:XF...H\."....%...T.+^x~.....?b.......}S...0........+.9UP.l...........v.O..].?...6.....g1.s.i...,.0..[...<.C.

C:\Program Files\Cheat Engine 7.5\tcc32-32-linux.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	386976
Entropy (8bit):	6.870368063282166
Encrypted:	false
SSDEEP:	6144:359aKWK/HqY5AXeWEfv6TBr4udWNrzJD10P9TQmxhAIXiCUXEC+Y4r/w2MGkTkm/:J9WsHse9fvcBrnd8rzZ10eMhEChC+Ygi
MD5:	486237BC5FA41DCE8C3022B9B6221FE5
SHA1:	C00BA51895DEAB2054C6F0F7DD3CF397E119C6FE
SHA-256:	4E2C87700CCDD3B34215C6BC64AE4582AC5FF373CFD3E93E8F7D2016960BA80D
SHA-512:	5F4010D8F9B0C865DE209E90625F178C8A7370AF1F7BE85552147EBD9EE7D033B01DD5A277FB646E2D289D2821462ADBB0959E507CD0A044CE79CB1C526A385B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*...y...y...y...x...y...x4..y...x...y./.y...y...x...y...x...y...x...y...x...y...y..y...x...y...x...y..1y...y...x...yRich...y........................PE..L...;.6c...........!.....f...N......D.....................................................@..........................B......$F..(....................\|...k.......7...8..p...........................p8..@...............D............................text...[d.......f.................. ..`.rdata..t............j..............@..@.data....E...P.......8..............@....rsrc................B..............@..@.reloc...7.......8...D..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\tcc32-32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	386976
Entropy (8bit):	6.870406853054738
Encrypted:	false
SSDEEP:	6144:e59aKWK/HqY5AXeWEfv6TBr4udWNrrJ710vFTAmJxQIfaCU/MC3O74r/wuMGFYsN:G9WsHse9fvcBrnd8rrR10WUxkCxC3O7S
MD5:	81633981057858F56BECB3BD316283E9
SHA1:	F6981034B1A5E23766BA4D40D451D784A1CFF83E
SHA-256:	4885754E6AC08304858383E47D3ADA425409988871BA6586151143D511488614
SHA-512:	99886CB451EAE690657AC848B63D58CD8B436849F6D073C5C073B624A6956397AC5AB6B636B1970C60DCE4EB5B3512372A4EC79FC28E9397AFE7D0791466D0A3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*...y...y...y...x...y...x4..y...x...y./.y...y...x...y...x...y...x...y...x...y...y..y...x...y...x...y..1y...y...x...yRich...y........................PE..L...0.6c...........!.....f...N......D.....................................................@.........................pB.......F..(....................\|...k.......7...8..p...........................p8..@...............D............................text...[d.......f.................. ..`.rdata..`............j..............@..@.data....E...P.......8..............@....rsrc................B..............@..@.reloc...7.......8...D..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\tcc64-32-linux.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	443296
Entropy (8bit):	6.630155817797785
Encrypted:	false
SSDEEP:	6144:bdQpG4IhjOSudLX4PGUGTdVwYr9ABfpMqYFOso5WMKYnTrLxWAld/wydfCigAA:apG4w5upwGTv9GWov1nlVAV
MD5:	0C7D89B75430A40824A5D7B79890324E
SHA1:	7E03E3D5386B1ED49104C3B35E44A545863BCBB9
SHA-256:	6B21B24279309F4117F8E39CDAF940F645C15D92442990A77655C8F898BB2227
SHA-512:	31453A2575FD7674AC7802DC8F740C79D357AD3464869F6EFD5E4A3892114EE9767715EBCA0D39E5B39CA8DA7BFED7E671D3EB24DBFB698C57ECA196D4FDFC85
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H.mD............i.......i.......i........K......^.......^.......^.......i...........R...................................Rich............PE..d...8.6c.........." ................ %..............................................`{....`.........................................`........!..(................1...X...k...... .......p............................................................................text............................... ..`.rdata...).......*..................@..@.data...RX...0......................@....pdata...1.......2..................@..@.rsrc................N..............@..@.reloc.. ............P..............@..B........................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\tcc64-32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	446368
Entropy (8bit):	6.635233277412147
Encrypted:	false
SSDEEP:	6144:aSn7zUunHkqypGYKKOyt8GMyKw0ORVdPpEPwkdRHhvOOZoU/wC/cQBi4Blb:nzU8E9GDWKMRPAZhvpoUOo
MD5:	069EC7832ADBF93BD04A91B07FF00D78
SHA1:	5ED84D13FFCEF487EB039CD75DE91294C25ED0CC
SHA-256:	8C8C608AE67F8B8A4E56DAF2EDEA1A92CBA6866D4F324BD0E5AD1284126849A7
SHA-512:	D9E9D40DE2509B112762ADE7EF0BB6DB91EB5687AE6EA9689ABD7A7AF8BA601297655587EEF34F7D1DAC62D77E5B586BE71B19F044EBF53028CFE90DDCE776F8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................................8...Fk...................................................S...........Rich...........................PE..d...=.6c.........." ......................................................................`..........................................'.......*..(................1...d...k..............p............................................................................text...`........................... ..`.rdata...3.......4..................@..@.data....X...@......................@....pdata...1.......2...(..............@..@.rsrc................Z..............@..@.reloc...............\..............@..B........................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\tcc64-64-linux.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	456096
Entropy (8bit):	6.635086574093954
Encrypted:	false
SSDEEP:	6144:tTaB+hAvavjZihpuXh9js6zMxfdKCXbRRUsQHoh3+KZ+a3cnldkEBX/zrMMZKUjo:haBtvavY6XhNrzSk2gxQ3Wn7kw3o
MD5:	AA97F366592E0FA41D2D2F61765CA7D5
SHA1:	BE85DAF3B07E66225CD4167F96ED6292CCE54E1E
SHA-256:	D63036771F21AE7E056F2211CB560BFCF79ADE356B59D8F462050B2DD840E86C
SHA-512:	F16D3F899504EF556D186BEBE1A526D9999454AB60697CDE221130720AB8154003543A62C4E53124C902E51FCF62B653C914B316DA0E3766DF5026E386DD47CC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......HJjD.+...+...+..iM...+..iM...+..iM...+.......+..^C...+..^C...+..^C...+..iM...+...+..S+...B...+...B...+...B...+...B...+..Rich.+..........................PE..d...3.6c.........." ................@P..............................................C.....`..........................................C......4G..(................3.......k......$... ...p............................................ ...............................text...p........................... ..`.rdata.../... ...0..................@..@.data...jX...P.......@..............@....pdata...3.......4...L..............@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\tcc64-64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	455072
Entropy (8bit):	6.627282046325032
Encrypted:	false
SSDEEP:	6144:8NqQopGY6gsnGubx5JbmZl2Wjm+9498RkaGlef/AYbAPrqEThN0dWI/mo1pdUMMe:fQoIfvxCc64fauA0lhydIo1AfDW
MD5:	E8DFC0D2D41483C7725E4EBB7E32D324
SHA1:	B2890C91EFBA390B68E481CD2EE311136B740EDE
SHA-256:	1172F2D7B1FB34408C8FFC248E3E719922843EA07BD5B409BE3405D1C300B3F7
SHA-512:	539A1BD18D4753D69756B9B7E6603DD6E7A3F354CA002DECE206F7E2F1E2792704F3D80F38B37C0C41F16A1FD9DE32CC4DD5873959D762C5AA13388715EE7803
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................................8...Fi...................................................Q...........Rich...........PE..d...5.6c.........." ................P5...............................................h....`..........................................<.......?..(...............d2.......k..............p...........................p................................................text............................... ..`.rdata...8.......:..................@..@.data....X...P.......<..............@....pdata..d2.......4...H..............@..@.rsrc................\|..............@..@.reloc...............~..............@..B........................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\tcc64-aarch64-linux.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1113504
Entropy (8bit):	5.932626447270598
Encrypted:	false
SSDEEP:	12288:3+hKmLazchlUT5PzJXmGFYKUeMzkMz7S480UJ+RNdO24a/s0X4G:Uy4n8VWGQdS480U4RN20X4G
MD5:	CCD151D8EE8ED05AA0E1D9142FD6E438
SHA1:	8D343BBC1A6F2D5D9ED8813427635696291C8F0D
SHA-256:	5C929F453DB7F0703BC8F939E39D48C79ECAB9E453918E5D0CD136C8026474CC
SHA-512:	DCB0B9A9B2908D5D55214F6A261B0A8C08889603CFABC327A7A82387012925BBF486B5C28B5250E9449FF9758748A021023C99EE02B59ABBB7B3C979A06DAEB4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0.Z't.4tt.4tt.4t..0ux.4t..7ur.4t..1u.4t.3.t~.4t&.1ui.4t&.0ue.4t&.7u~.4t..5uw.4tt.5t).4t..0uu.4t..1uu.4t..4uu.4t...tu.4t..6uu.4tRicht.4t........PE..d.....6c.........." .....\..........o........................................ ............`.............................................d......(.......<.......\........k..........@...8............................................................................textbss.A...............................text....Z...`...\.................. ..`.rdata...@.......B...`..............@..@.data...............................@....pdata..X...........................@..@.idata..r............Z..............@..@.msvcjmc8............l..............@....00cfg...............n..............@..@.rsrc...<............p..............@..@.reloc..7............v..............@..B................................................................

C:\Program Files\Cheat Engine 7.5\tcclib\COPYING (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26932
Entropy (8bit):	4.662099291681256
Encrypted:	false
SSDEEP:	384:cjWBIk+x/vIqk0TkX6sT6AATeINgKP+nHQ41fgcmmItyOQeM9YfWEeHBvo0:ciBJsFkOTeDnLqFXTfleHBvo0
MD5:	72B6BD92AB82F8774BBBB73C217C57B6
SHA1:	86D1215F2E127BFFD94F7B7BE6F7C4CE94ACDDA8
SHA-256:	9B183E7F0356C398CC0A65C4A2D2CD56F2149A8E244264C4D26AC59E9DADA3E8
SHA-512:	504E32EEBF7F3FDF37BB354F8B32BA9BB0810B490563AC5E8E58EF8BB3844A196706C8A25335E71A3D2E70C1C6C6304A6AEC7A9EFB309E89EEA89F6D9607A437
Malicious:	false
Preview:	.. GNU LESSER GENERAL PUBLIC LICENSE.... Version 2.1, February 1999.... Copyright (C) 1991, 1999 Free Software Foundation, Inc... 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.. Everyone is permitted to copy and distribute verbatim copies.. of this license document, but changing it is not allowed.....[This is the first released version of the Lesser GPL. It also counts.. as the successor of the GNU Library Public License, version 2, hence.. the version number 2.1.]....... Preamble.... The licenses for most software are designed to take away your..freedom to share and change it. By contrast, the GNU General Public..Licenses are intended to guarantee your freedom to share and change..free software--to make sure the software is free for all its users..... This license, the Lesser General Public License, applies to some..specially designated software packages--typically libraries--of the..Free Software Foundation and other authors who decide to use it. You..can

C:\Program Files\Cheat Engine 7.5\tcclib\RELICENSING (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2763
Entropy (8bit):	4.679490275459229
Encrypted:	false
SSDEEP:	48:wmINs5JslcE338QHFs5DGT93oVFl/9OsmONbs+2y:w7/Tn8QHDonOsJhs+
MD5:	0006E501494FE7AAC40035AD1E9B84A9
SHA1:	4D885BAA2024FA1CE2DF99041EC4B0D046549587
SHA-256:	B8CA96FA5251F2449F47F5E62E5B7C54A0D0DBCA353627D1C67A8B2CC71958E0
SHA-512:	BFF444F24836B3D85E734F4FE11FFDFD095E4F1386D54E4C934EDD3B9162E6D92BA0939103BDCC3B708D6296B9C268DDD77E4B63322A429DD4782202D754831C
Malicious:	false
Preview:	.. Relicensing TinyCC.. ------------------.... The authors listed below hereby confirm their agreement to relicense TinyCC.. including their past contributions under the following terms:...... * Permission is hereby granted, free of charge, to any person obtaining a copy.. * of this software and associated documentation files (the "Software"), to deal.. * in the Software without restriction, including without limitation the rights.. * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.. * copies of the Software, and to permit persons to whom the Software is.. * furnished to do so, subject to the following conditions:.. .. The above copyright notice and this permission notice shall be included in.. * all copies or substantial portions of the software... .. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.. * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.. * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEM

C:\Program Files\Cheat Engine 7.5\tcclib\REST (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	119
Entropy (8bit):	4.371155522109906
Encrypted:	false
SSDEEP:	3:GACoYQZGhzeF7FEd2NAFNMLAdS4INMLAKQvI+IEQtM0KRvMH:SorZGIF72gNAFNM0deNM0tI+IEQ+0KmH
MD5:	7C3537668B4B35F486F199AF30768340
SHA1:	611F489364DF2A1D404022ECFCF6BB028103CC19
SHA-256:	5F58445C525B6BE19809AA19D69067C1910EDF90A9C56A508571A56EE4CDB5F1
SHA-512:	FD3EC07B964BB66C604BFB55A7701951E47CCA13D9AC5811F35BE6EFF8C81745A7AB62F3A22393B1D5AF303702943B2FAB7C499BFA6037C8B79396C98A39D27B
Malicious:	false
Preview:	The rest of this project can be found at https://github.com/cheat-engine/cheat-engine/tree/master/Cheat%20Engine/tcclib

C:\Program Files\Cheat Engine 7.5\tcclib\is-47N79.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	119
Entropy (8bit):	4.371155522109906
Encrypted:	false
SSDEEP:	3:GACoYQZGhzeF7FEd2NAFNMLAdS4INMLAKQvI+IEQtM0KRvMH:SorZGIF72gNAFNM0deNM0tI+IEQ+0KmH
MD5:	7C3537668B4B35F486F199AF30768340
SHA1:	611F489364DF2A1D404022ECFCF6BB028103CC19
SHA-256:	5F58445C525B6BE19809AA19D69067C1910EDF90A9C56A508571A56EE4CDB5F1
SHA-512:	FD3EC07B964BB66C604BFB55A7701951E47CCA13D9AC5811F35BE6EFF8C81745A7AB62F3A22393B1D5AF303702943B2FAB7C499BFA6037C8B79396C98A39D27B
Malicious:	false
Preview:	The rest of this project can be found at https://github.com/cheat-engine/cheat-engine/tree/master/Cheat%20Engine/tcclib

C:\Program Files\Cheat Engine 7.5\tcclib\is-K56C1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2763
Entropy (8bit):	4.679490275459229
Encrypted:	false
SSDEEP:	48:wmINs5JslcE338QHFs5DGT93oVFl/9OsmONbs+2y:w7/Tn8QHDonOsJhs+
MD5:	0006E501494FE7AAC40035AD1E9B84A9
SHA1:	4D885BAA2024FA1CE2DF99041EC4B0D046549587
SHA-256:	B8CA96FA5251F2449F47F5E62E5B7C54A0D0DBCA353627D1C67A8B2CC71958E0
SHA-512:	BFF444F24836B3D85E734F4FE11FFDFD095E4F1386D54E4C934EDD3B9162E6D92BA0939103BDCC3B708D6296B9C268DDD77E4B63322A429DD4782202D754831C
Malicious:	false
Preview:	.. Relicensing TinyCC.. ------------------.... The authors listed below hereby confirm their agreement to relicense TinyCC.. including their past contributions under the following terms:...... * Permission is hereby granted, free of charge, to any person obtaining a copy.. * of this software and associated documentation files (the "Software"), to deal.. * in the Software without restriction, including without limitation the rights.. * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.. * copies of the Software, and to permit persons to whom the Software is.. * furnished to do so, subject to the following conditions:.. .. The above copyright notice and this permission notice shall be included in.. * all copies or substantial portions of the software... .. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.. * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.. * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEM

C:\Program Files\Cheat Engine 7.5\tcclib\is-V0OQK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26932
Entropy (8bit):	4.662099291681256
Encrypted:	false
SSDEEP:	384:cjWBIk+x/vIqk0TkX6sT6AATeINgKP+nHQ41fgcmmItyOQeM9YfWEeHBvo0:ciBJsFkOTeDnLqFXTfleHBvo0
MD5:	72B6BD92AB82F8774BBBB73C217C57B6
SHA1:	86D1215F2E127BFFD94F7B7BE6F7C4CE94ACDDA8
SHA-256:	9B183E7F0356C398CC0A65C4A2D2CD56F2149A8E244264C4D26AC59E9DADA3E8
SHA-512:	504E32EEBF7F3FDF37BB354F8B32BA9BB0810B490563AC5E8E58EF8BB3844A196706C8A25335E71A3D2E70C1C6C6304A6AEC7A9EFB309E89EEA89F6D9607A437
Malicious:	false
Preview:	.. GNU LESSER GENERAL PUBLIC LICENSE.... Version 2.1, February 1999.... Copyright (C) 1991, 1999 Free Software Foundation, Inc... 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.. Everyone is permitted to copy and distribute verbatim copies.. of this license document, but changing it is not allowed.....[This is the first released version of the Lesser GPL. It also counts.. as the successor of the GNU Library Public License, version 2, hence.. the version number 2.1.]....... Preamble.... The licenses for most software are designed to take away your..freedom to share and change it. By contrast, the GNU General Public..Licenses are intended to guarantee your freedom to share and change..free software--to make sure the software is free for all its users..... This license, the Lesser General Public License, applies to some..specially designated software packages--typically libraries--of the..Free Software Foundation and other authors who decide to use it. You..can

C:\Program Files\Cheat Engine 7.5\tcclib\lib\is-23JOJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13913
Entropy (8bit):	5.0625346433631195
Encrypted:	false
SSDEEP:	384:r19A/cZMTI5yb/KekUbGXiTYli8hcHPHuwGX9Gln4FmgopA:r19i5x/8hEfuTGQCm
MD5:	BDE9BB4FFF437414B38B1FEB2E8C5A0A
SHA1:	8CC60A152FA9FAABD63980977F93230AD4462FF2
SHA-256:	E656129DB32DD84EEB1BCE8CE9E6296943F1920EDB6E9296F67A5986E3C84E6E
SHA-512:	91653AEDFADA80F62D2906A09671932D9603CA884BC09B5BCE0317A29DF934252C7AC3BF6557399C642F010BE2ADDC90E96EA87EC5F3DC2AFEAD491F1E27BC39
Malicious:	false
Preview:	/* TCC runtime library. .. Parts of this code are (c) 2002 Fabrice Bellard .... Copyright (C) 1987, 1988, 1992, 1994, 1995 Free Software Foundation, Inc.....This file is free software; you can redistribute it and/or modify it..under the terms of the GNU General Public License as published by the..Free Software Foundation; either version 2, or (at your option) any..later version.....In addition to the permissions in the GNU General Public License, the..Free Software Foundation gives you unlimited permission to link the..compiled version of this file into combinations with other programs,..and to distribute those combinations without any restriction coming..from the use of this file. (The General Public License restrictions..do apply in other respects; for example, they cover modification of..the file, and distribution when not linked into a combine..executable.)....This file is distributed in the hope that it will be useful, but..WITHOUT ANY WARRANTY; without even the implied warra

C:\Program Files\Cheat Engine 7.5\tcclib\lib\libtcc1.c (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13913
Entropy (8bit):	5.0625346433631195
Encrypted:	false
SSDEEP:	384:r19A/cZMTI5yb/KekUbGXiTYli8hcHPHuwGX9Gln4FmgopA:r19i5x/8hEfuTGQCm
MD5:	BDE9BB4FFF437414B38B1FEB2E8C5A0A
SHA1:	8CC60A152FA9FAABD63980977F93230AD4462FF2
SHA-256:	E656129DB32DD84EEB1BCE8CE9E6296943F1920EDB6E9296F67A5986E3C84E6E
SHA-512:	91653AEDFADA80F62D2906A09671932D9603CA884BC09B5BCE0317A29DF934252C7AC3BF6557399C642F010BE2ADDC90E96EA87EC5F3DC2AFEAD491F1E27BC39
Malicious:	false
Preview:	/* TCC runtime library. .. Parts of this code are (c) 2002 Fabrice Bellard .... Copyright (C) 1987, 1988, 1992, 1994, 1995 Free Software Foundation, Inc.....This file is free software; you can redistribute it and/or modify it..under the terms of the GNU General Public License as published by the..Free Software Foundation; either version 2, or (at your option) any..later version.....In addition to the permissions in the GNU General Public License, the..Free Software Foundation gives you unlimited permission to link the..compiled version of this file into combinations with other programs,..and to distribute those combinations without any restriction coming..from the use of this file. (The General Public License restrictions..do apply in other respects; for example, they cover modification of..the file, and distribution when not linked into a combine..executable.)....This file is distributed in the hope that it will be useful, but..WITHOUT ANY WARRANTY; without even the implied warra

C:\Program Files\Cheat Engine 7.5\tiny.cepack (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	data
Category:	dropped
Size (bytes):	36018
Entropy (8bit):	7.994007484272608
Encrypted:	true
SSDEEP:	768:9vQvLQOAupOW0bBJ8RkEgh+zhlrKlfaMfToatTCCRFxg4Oaun:9Yv1bpOW0bBJ8goVUsMfcUvzOaun
MD5:	927EF77EFDA84808C9088632C76843E5
SHA1:	AA73E4C27F8A00DF4C9B8BD05088D483B5F8FF9B
SHA-256:	422A2989BABB5E9512C98B3FA24C4F5A0BA9A72C3C71A920C5F979316E1674C7
SHA-512:	98B6BA444008B5978D65FA83487465D700D6EEE721CE8990F1D2E034945F7650E7031E4B9E18C945FE81C6919E5213750DC4E2D86829988E25A3B237559E90E8
Malicious:	false
Preview:	CEPACK......\|T.0~v.$9I69.$.$@.`.F..%.!.$....]"$`.t]..p.`%.x...a....R.....^.X..B........6...j......3gw...{.....\|...{..3.<3..3..<3)...g.8....q\3...s...=.K...d...?.h6,...<.m..P...<.H.......$e\|.........0.hiE.#?Z...II..a.?<p1..s.......1....hc....M...;..6:X\|..Y.yc.sob...A<.....[l..~....#t....x....q...........q1.<1Q...X....l.g...u.....S...l..b..F...}......>.:_2.c....H.\|0LPs..G...5..}@z...3.u..~o]G".....]..c.:.}......5..?.k..V......?...D.....o.-.......[N.)...K\|2..E.f...(3..I.#..E.....3...O.Gv.R.U.....&."..y9-5...4..!.q'......%...!..N-....d.r-U..3,..3........'.0;..h....G.....IN...M...x(.,`M...t.C...?.,4..+...@...4-.>....;>.x(..K.&.B...4.IR..@RK....$-....R..g.Z*4:...R.@...Ry.J..M.q.u.hb....s%....A.r...2S.. .;.v...&....h.......4.[.._..[b(ih..@.}zi..N.K.....'u..$i.V.BR.[....F.I.....A&..........e,..)...P.%.Ui..\|.oP.B..0&../_..R..N..(3...(.~9....2z...a.h.[O.h...S..[..S..F...a..v...83E9....U..~.@..b#c.;..YN %..m....E1D.t.d 6......h%....

C:\Program Files\Cheat Engine 7.5\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	InnoSetup Log 64-bit Cheat Engine, version 0x418, 67945 bytes, 128757\37\user\37, C:\Program Files\Cheat Engine 7.5\376\377\
Category:	dropped
Size (bytes):	67945
Entropy (8bit):	3.6990452280703443
Encrypted:	false
SSDEEP:	1536:IFKlzYQO7LvyOWVKLCf7lbmrgf4JyA3Zek3:IFKlzYQO7Lvy9q
MD5:	0F58BB8D0D83936ADAE4E490DDEEB371
SHA1:	C20828EE86F5D1DB81BA970C317B96B65A935F35
SHA-256:	6009459CC5AAD7E0ECB3ACB68AFBEF3EC6B30CA5B974E15E32AE587B3A4CE2AE
SHA-512:	2A9D06B75AD7EA5A5FA7C5E883377EBAEFED32899421B61DAA53CC64CAD424BB0A47BB5336C747E5BC9D235CD177EEE53B3F03080AED50BB4BC3914C947AF0A9
Malicious:	false
Preview:	Inno Setup Uninstall Log (b) 64-bit.............................Cheat Engine....................................................................................................................Cheat Engine........................................................................................................................v...i...................................................................................................................S.........;H................1.2.8.7.5.7......h.u.b.e.r.t......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5................*.'.... ......).......IFPS....&...(....................................................................................................ANYMETHOD.....................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TMAINFORM....TMAINFORM.........TUNINSTALLPROGRESSFORM....TUNINSTALLPROGRESSFORM.........TEXECWAIT.........TUNINSTALLSTEP.........TMSGBOXTYPE.

C:\Program Files\Cheat Engine 7.5\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3223968
Entropy (8bit):	6.338087367720092
Encrypted:	false
SSDEEP:	49152:vdx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEjT333TYfx:0HDYsqiPRhINnq95FoHVBT333T+
MD5:	9AA2ACD4C96F8BA03BB6C3EA806D806F
SHA1:	9752F38CC51314BFD6D9ACB9FB773E90F8EA0E15
SHA-256:	1B81562FDAEAA1BC22CBAA15C92BAB90A12080519916CFA30C843796021153BB
SHA-512:	B0A00082C1E37EFBFC2058887DB60DABF6E9606713045F53DB450F16EBAE0296ABFD73A025FFA6A8F2DCB730C69DD407F7889037182CE46C68367F54F4B1DC8D
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...oGXb.................B,.........`V,......`,...@...........................1......u1...@......@....................-.......-..9....................0..k....................................-.......................-.......-......................text.....,.......,................. ..`.itext...(...0,..*....,............. ..`.data........`,......F,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-...... -.............@..@.rsrc................"-.............@..@..............1.......0.............@..@........................................................

C:\Program Files\Cheat Engine 7.5\unins000.msg

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	InnoSetup messages, version 6.0.0, 261 messages (UTF-16), Cancel installation
Category:	dropped
Size (bytes):	24097
Entropy (8bit):	3.2749730459064845
Encrypted:	false
SSDEEP:	192:b1EjNSCkf3SCqsTr6CCPanAG1tznL7VF+Iqfc51U5YQDztXfbKJG/Bfvo:b1EK6CHr6fSX+7Q1U5YQDztB/B3o
MD5:	313D0CC5D1A64D2565E35937991775A6
SHA1:	B8ACB11878C485865C9E4679248E53B83A8F3AD4
SHA-256:	5ED0233C0922E9F20307315E24B4F33C3D56AB9F42B2F75AE91E7A27FD313B66
SHA-512:	7C2DB4A3A4A8DF09F8119A7BA4CA9EBFE562F0A34D431928344E21A5853931EEFBFD910DC4026C6788AC22423BBB125F2B700326D8A1D82B134E2B486C3D0684
Malicious:	false
Reputation:	unknown
Preview:	Inno Setup Messages (6.0.0) (u)......................................]..+..... .C.a.n.c.e.l. .i.n.s.t.a.l.l.a.t.i.o.n...S.e.l.e.c.t. .a.c.t.i.o.n...&.I.g.n.o.r.e. .t.h.e. .e.r.r.o.r. .a.n.d. .c.o.n.t.i.n.u.e...&.T.r.y. .a.g.a.i.n...&.A.b.o.u.t. .S.e.t.u.p.........%.1. .v.e.r.s.i.o.n. .%.2.....%.3.........%.1. .h.o.m.e. .p.a.g.e.:.....%.4.....A.b.o.u.t. .S.e.t.u.p...Y.o.u. .m.u.s.t. .b.e. .l.o.g.g.e.d. .i.n. .a.s. .a.n. .a.d.m.i.n.i.s.t.r.a.t.o.r. .w.h.e.n. .i.n.s.t.a.l.l.i.n.g. .t.h.i.s. .p.r.o.g.r.a.m.....T.h.e. .f.o.l.l.o.w.i.n.g. .a.p.p.l.i.c.a.t.i.o.n.s. .a.r.e. .u.s.i.n.g. .f.i.l.e.s. .t.h.a.t. .n.e.e.d. .t.o. .b.e. .u.p.d.a.t.e.d. .b.y. .S.e.t.u.p... .I.t. .i.s. .r.e.c.o.m.m.e.n.d.e.d. .t.h.a.t. .y.o.u. .a.l.l.o.w. .S.e.t.u.p. .t.o. .a.u.t.o.m.a.t.i.c.a.l.l.y. .c.l.o.s.e. .t.h.e.s.e. .a.p.p.l.i.c.a.t.i.o.n.s.....T.h.e. .f.o.l.l.o.w.i.n.g. .a.p.p.l.i.c.a.t.i.o.n.s. .a.r.e. .u.s.i.n.g. .f.i.l.e.s. .t.h.a.t. .n.e.e.d. .t.o. .b.e. .u.p.d.a.t.e.d. .b.y. .S.e.t.u.p... .I.t. .i.s. .r.e.

C:\Program Files\Cheat Engine 7.5\vehdebug-i386.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	332704
Entropy (8bit):	6.512223997122371
Encrypted:	false
SSDEEP:	6144:UokW02RSGoOZQcW2jS95cM0EsZjv8trtH3Vizwy:ZkW02RsOKcWnDdMv8trtX0
MD5:	E9B5905D495A88ADBC12C811785E72EC
SHA1:	CA0546646986AAB770C7CF2E723C736777802880
SHA-256:	3EB9CD27035D4193E32E271778643F3ACB2BA73341D87FD8BB18D99AF3DFFDEA
SHA-512:	4124180B118149C25F8EA8DBBB2912B4BD56B43F695BF0FF9C6CCC95ADE388F1BE7D440A791D49E4D5C9C350EA113CF65F839A3C47D705533716ACC53DD038F8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#........D(..$-..................................................P...........................................d........................k.......:..................................................P................................text............................... ..`.data...D(.......*..................@....rdata..............................@..@.bss....$-...p...........................CRT.................Z..............@....idata...............\..............@....edata...............j..............@..@.reloc...:.......<...l..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\vehdebug-x86_64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	423328
Entropy (8bit):	6.077270660749132
Encrypted:	false
SSDEEP:	6144:gLJXTQOQV/MzZTixW5GmL7HOf0ADMTE21gFOpJz:Q+V/M9WWnL7HOf0ADMIuR
MD5:	8D487547F1664995E8C47EC2CA6D71FE
SHA1:	D29255653AE831F298A54C6FA142FB64E984E802
SHA-256:	F50BAF9DC3CD6B925758077EC85708DB2712999B9027CC632F57D1E6C588DF21
SHA-512:	79C230CFE8907DF9DA92607A2C1ACE0523A36C3A13296CB0265329208EDC453E293D7FBEDBD5410DECF81D20A7FE361FDEBDDADBC1DC63C96130B0BEDF5B1D8A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........6...2...................................................................................................p.......P..d................H.......k..........................................................LT...............................text............................... ..`.data....6.......8..................@....rdata...V...P...X...4..............@..@.pdata...H.......J..................@..@.bss.....2...............................CRT.........@......................@....idata.......P......................@....edata.......p......................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\vmdisk.img (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	DOS/MBR boot sector
Category:	dropped
Size (bytes):	477184
Entropy (8bit):	5.927630308859684
Encrypted:	false
SSDEEP:	12288:JEgIgQUO3gqHm5DHLj7S0/Y9kwRofaqcEL5jw/ayKImdyoO:Gg/hEm5DrHE9kwRofaqcEL5jw/ayKImD
MD5:	036B059F8C1CC9AFF3D010E5446BB16C
SHA1:	450842B84E2FACE167E2D138E4F96317CB255BB3
SHA-256:	248F3D48664482090D2C8C01B98518777DED1D900E17ACBC077EFE17258411A6
SHA-512:	4BA5E167A2E3BFE92D43759642AF7BCDB6F4C9EFA30C0F9DE85D6E9758B62FC7ED89FAFDE48910E4E059080E457E3556D23CB1D59B3062C75F81DB9C59B75657
Malicious:	false
Reputation:	unknown
Preview:	.$.CETC2#...............>.A..............f..p....$p1...f...pf...pf...pf.6.pf.>.pf...pf.&.p.."p...&p..(p..*p.X.,p....0p. .f..}......0.......\|1....?........}..............`.............6.\|...?@..\|.......& \|.!....Q....."\|.6$\|...\|....s......\|..........u........1.."\|..."\|S...J.[:..\|r....."\|..$\|..$\|:..\|u...$\|....$\|YI...Qu.Y.....\|f...\|......f}....0...P.P.&f}..g}...e..e.E...X..g}...f}...<.t...e..e.E.....F....f}.....Q....f.Y...`1.....t.=..t.=..t....X...@.f1........1..f.......@s.a..DBVM BS.......U......PR>..".>..#..........R........Z.&..&.D......Ps.........r...>..".>..#.ZX.....F.<$u..PRZX.PSQW....N..$N9.r.1......0..N...u..A9.r... N...._Y[X.PSQW....N..$N9.r,1.......w...0.......a..N...u..A9.r... N...._Y[X.88=$e801:$e820:..$ax=$bx=$cx=$dx=$SMAP ERROR!..$..................$................................get VESA info success..$get VESA info failed..$ Failurevideomode 0x$..1...H..&......6........&;.........t........retry reading disk..........f1.f1........]>..?.>

C:\Program Files\Cheat Engine 7.5\vmdisk.img.sig (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	data
Category:	dropped
Size (bytes):	132
Entropy (8bit):	6.593562490537789
Encrypted:	false
SSDEEP:	3:O18qyj/0fZMX/ferOk9OWtW2kdT0PgluBKd9cCkAl8F:O10/3er/X1Y4BKtJuF
MD5:	A4B42FDCA7043792CCC37C611DB21075
SHA1:	17CBF2EC6ECA6BD0CAF1DA78AF51D9F363151168
SHA-256:	8B8955524079508FEC59D396A891110660AE2486F24BC8BCBCDBCC975BB49AE7
SHA-512:	B6877F5B5B88A9B05A85F562D975A8820ACAC3773AA5FB91CEB1DA6C731C90C486A6AAF78DF6EDCF69B0EA74286DC7CC8FA2CBF98453539EFA55EC18D38116BB
Malicious:	false
Reputation:	unknown
Preview:	...[0n...w+$.H'1,..t...).=s..Ds.......y....G2......wX+...W=............./X1AjF~G4...OD>....J.R."..S......0.Q[8....A..6.... ...

C:\Program Files\Cheat Engine 7.5\win32\dbghelp.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1746376
Entropy (8bit):	6.547381278876358
Encrypted:	false
SSDEEP:	24576:/ETCUSw5C7fKrz3PRAarqzUH3Wj7Bnn6KB2m4JMfGPYTuLycEaU2vWUonrMLIAXg:MTj15CD0RHep6KJ4KqzEl2vWrYIA/W
MD5:	238C1C3286A94184FAE2C47CB7FB9DB8
SHA1:	EC4C96DBB342617AFCB728C4D58BDE4EDC0939DC
SHA-256:	74CCB6F5334248BA7020B9CDDC7D581FC6A3AC5A034489324A1FC134CF21DE6C
SHA-512:	0042EFB8DF5DD2D6CDE098DFD1A15217C55E8B68776856E354CED3B943C646C77A8A0132EB2A6332D76704F71A475E29F7330177CBFB4C2C4A26FFC4BA004D0E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........P.}...}...}.......}....R..}...}...x.......}.......}.......}....<..}.......}.......}....>..}.......}..Rich.}..........PE..L...N.,............!.........X.......-.......................................p......3;....@A............................1...D...l....@..P................!...P..........T...............................@...............@.......`....................text...1........................... ..`.data............^..................@....idata... ......."...&..............@..@.didat...............H..............@....mrdata...... .......J..............@..@.rsrc...P....@.......d..............@..@.reloc.......P.......p..............@..B................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\win32\is-7KKVU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	268760
Entropy (8bit):	6.271440072420579
Encrypted:	false
SSDEEP:	3072:mK+Zk16lasjUumChoTtckp/Ec3SYiAdCksr5CsHLz0hQTplZBXo8PrF5T681kO2y:Rbrdr3S/AdCkA57ghmlZ68rj6euk+hU
MD5:	B3EA90EA6E9C99965389662F8DB9DC8E
SHA1:	412685767347F0CB4360787214B28038B1F38278
SHA-256:	254609EC81013A878306C710ACFD258907E338C32EEB5FDDDB561116DFA65D40
SHA-512:	B963D9DFE09DB9C8E10CA91CF9504238F478F83BBA5B9B5BC4910725FBF917A1AF791E5FA8407D07E55589C8388C73CD0377405D03C88EEB5BA94A90DC5DF827
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[}..............d..1....n.......n...............n.......n.......n.......n.."....n.......n......Rich....................PE..L....m&@...........!.....r..........`...............................................I.....@A........................@}......l........0...................!...P..T,......T...............................@...............h...Xv.......................text....q.......r.................. ..`.data....L...........v..............@....idata...............z..............@..@.didat..............................@....mrdata.............................@..@.rsrc........0......................@..@.reloc..T,...P......................@..B................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\win32\is-A3GKJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	569856
Entropy (8bit):	6.48863246830026
Encrypted:	false
SSDEEP:	12288:09zpo7FKqmQEPmmo6G1SbhXIBQ22wnEKNy6ZfpTh2jK23L:eUANZPmjR1SbhYBT2wEKN3pmb
MD5:	AEF51484C41C348E6ECA26EAF36B5E00
SHA1:	01A37C222BC8EAFDF250953BFD5D0593CEB7AB5A
SHA-256:	F3E9E0DF553D9DF6650981A0758EDE142A33A889786BBEB586FE7EDC7F9E27EB
SHA-512:	E7B29E38F516D934617E0C46BC0DB33390E28890867427ADA0989CBB1F1DEBAAE962B3B39D0749BC5273EFF6545B967346D5F72A460D1C07B0FD451AFD58AB65
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;.OT...........#................`..............a.................................p........ .................................t................................'......................................................p............................text...............................`.P`.data...............................@.`..rdata..p...........................@.`@.eh_fram8....p.......V..............@.0@.bss..................................`..edata...............`..............@.0@.idata..t............z..............@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\win32\is-OH84O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1746376
Entropy (8bit):	6.547381278876358
Encrypted:	false
SSDEEP:	24576:/ETCUSw5C7fKrz3PRAarqzUH3Wj7Bnn6KB2m4JMfGPYTuLycEaU2vWUonrMLIAXg:MTj15CD0RHep6KJ4KqzEl2vWrYIA/W
MD5:	238C1C3286A94184FAE2C47CB7FB9DB8
SHA1:	EC4C96DBB342617AFCB728C4D58BDE4EDC0939DC
SHA-256:	74CCB6F5334248BA7020B9CDDC7D581FC6A3AC5A034489324A1FC134CF21DE6C
SHA-512:	0042EFB8DF5DD2D6CDE098DFD1A15217C55E8B68776856E354CED3B943C646C77A8A0132EB2A6332D76704F71A475E29F7330177CBFB4C2C4A26FFC4BA004D0E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........P.}...}...}.......}....R..}...}...x.......}.......}.......}....<..}.......}.......}....>..}.......}..Rich.}..........PE..L...N.,............!.........X.......-.......................................p......3;....@A............................1...D...l....@..P................!...P..........T...............................@...............@.......`....................text...1........................... ..`.data............^..................@....idata... ......."...&..............@..@.didat...............H..............@....mrdata...... .......J..............@..@.rsrc...P....@.......d..............@..@.reloc.......P.......p..............@..B................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\win32\sqlite3.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	569856
Entropy (8bit):	6.48863246830026
Encrypted:	false
SSDEEP:	12288:09zpo7FKqmQEPmmo6G1SbhXIBQ22wnEKNy6ZfpTh2jK23L:eUANZPmjR1SbhYBT2wEKN3pmb
MD5:	AEF51484C41C348E6ECA26EAF36B5E00
SHA1:	01A37C222BC8EAFDF250953BFD5D0593CEB7AB5A
SHA-256:	F3E9E0DF553D9DF6650981A0758EDE142A33A889786BBEB586FE7EDC7F9E27EB
SHA-512:	E7B29E38F516D934617E0C46BC0DB33390E28890867427ADA0989CBB1F1DEBAAE962B3B39D0749BC5273EFF6545B967346D5F72A460D1C07B0FD451AFD58AB65
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;.OT...........#................`..............a.................................p........ .................................t................................'......................................................p............................text...............................`.P`.data...............................@.`..rdata..p...........................@.`@.eh_fram8....p.......V..............@.0@.bss..................................`..edata...............`..............@.0@.idata..t............z..............@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\win32\symsrv.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	268760
Entropy (8bit):	6.271440072420579
Encrypted:	false
SSDEEP:	3072:mK+Zk16lasjUumChoTtckp/Ec3SYiAdCksr5CsHLz0hQTplZBXo8PrF5T681kO2y:Rbrdr3S/AdCkA57ghmlZ68rj6euk+hU
MD5:	B3EA90EA6E9C99965389662F8DB9DC8E
SHA1:	412685767347F0CB4360787214B28038B1F38278
SHA-256:	254609EC81013A878306C710ACFD258907E338C32EEB5FDDDB561116DFA65D40
SHA-512:	B963D9DFE09DB9C8E10CA91CF9504238F478F83BBA5B9B5BC4910725FBF917A1AF791E5FA8407D07E55589C8388C73CD0377405D03C88EEB5BA94A90DC5DF827
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[}..............d..1....n.......n...............n.......n.......n.......n.."....n.......n......Rich....................PE..L....m&@...........!.....r..........`...............................................I.....@A........................@}......l........0...................!...P..T,......T...............................@...............h...Xv.......................text....q.......r.................. ..`.data....L...........v..............@....idata...............z..............@..@.didat..............................@....mrdata.............................@..@.rsrc........0......................@..@.reloc..T,...P......................@..B................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\win64\dbghelp.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2130400
Entropy (8bit):	6.2987957684743945
Encrypted:	false
SSDEEP:	49152:21CydAIdaqDwWXf6J6eFyIfbIwDLk2A/R1UTwyIuZ:21fd7dxinRDLkF/R1zuZ
MD5:	7A7A9CD081AB016F84249EF4F06493AD
SHA1:	8DC1BEBFAE34C118FE3810DC9131CBF8CCBD9EDC
SHA-256:	009681092F6A13C5C28BB3B08EA14BB03BA959F9CE1A53730D069550DA376C48
SHA-512:	D2B3F302F653741298FB62D237BFC61E1555792AAD73C14395B4DD4B97FE37F745E916B9F586945042B1EDED19C2BC0E9EFD4BE57E44610D465296BD0C544E84
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........[...[...[......Y...R.W.f...[.........H......_......Z......3....9.Y...........;.Z......Z...Rich[...........PE..d....B............" .....0..........P.........................................".....1.!...`A............................................X.......l.....!.P....0 ..)...` ..!....!.pN......p............................y..8...........H.......L...`....................text............0.................. ..`.rdata..4....@.......@..............@..@.data....4..........................@....pdata...)...0 ..0..................@..@.didat..8....`!.....................@....mrdata..2...p!..@..................@..@.rsrc...P.....!....... .............@..@.reloc..pN....!..P.... .............@..B........................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\win64\is-356FE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1311232
Entropy (8bit):	5.897658121795144
Encrypted:	false
SSDEEP:	12288:aHnKY5WcmiyfogSknJbjhrbXBbrxaLsBDJbVQAjXwcasznMbDz43X6dmM:aqY5Wcmi4FJbXdsLsBNRQAjgH
MD5:	C11138204609EA63A3E88B4C8C09B035
SHA1:	B0829124F7E275B0F341C6AF0FDD3DD5F65667A4
SHA-256:	60C16C2FAB14B344B8343778DCD6BBFDEE3DFE5F83D1AC8D2E50C6877419EEE4
SHA-512:	28D9E92498433C1F6EC41893FC17DB76D6CB7A1C565461EB6E67EEBC2B924DD4AA65486C29874CAA9AC5C78F804A8799C7CE1C641DD9F080BF1BF94B58CA208C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................"........d......e.....f......e......a......b......g....Rich...........PE..d.....OT.........." ................@I.......................................p............`.........................................@...g!......(....0.......@..............P..8....+..8...........................0>..p...........8................................text............................... ..`.rdata....... ......................@..@.data....q.......D..................@....pdata.......@......................@..@.idata..X...........................@....rsrc........0......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\win64\is-F9V6M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2130400
Entropy (8bit):	6.2987957684743945
Encrypted:	false
SSDEEP:	49152:21CydAIdaqDwWXf6J6eFyIfbIwDLk2A/R1UTwyIuZ:21fd7dxinRDLkF/R1zuZ
MD5:	7A7A9CD081AB016F84249EF4F06493AD
SHA1:	8DC1BEBFAE34C118FE3810DC9131CBF8CCBD9EDC
SHA-256:	009681092F6A13C5C28BB3B08EA14BB03BA959F9CE1A53730D069550DA376C48
SHA-512:	D2B3F302F653741298FB62D237BFC61E1555792AAD73C14395B4DD4B97FE37F745E916B9F586945042B1EDED19C2BC0E9EFD4BE57E44610D465296BD0C544E84
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........[...[...[......Y...R.W.f...[.........H......_......Z......3....9.Y...........;.Z......Z...Rich[...........PE..d....B............" .....0..........P.........................................".....1.!...`A............................................X.......l.....!.P....0 ..)...` ..!....!.pN......p............................y..8...........H.......L...`....................text............0.................. ..`.rdata..4....@.......@..............@..@.data....4..........................@....pdata...)...0 ..0..................@..@.didat..8....`!.....................@....mrdata..2...p!..@..................@..@.rsrc...P.....!....... .............@..@.reloc..pN....!..P.... .............@..B........................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\win64\is-HNC5I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	344528
Entropy (8bit):	5.780306640057818
Encrypted:	false
SSDEEP:	6144:yT/zGgy2HzkCwmkfCl00EiwtHgadXIezwnzx7I91DR9J2:y3GL2HzkCwmkfClHbghpINzZmBRa
MD5:	1473A9CCB67526D4010F1B0F9E6B2977
SHA1:	7FE8C168E976200CF1562B8E8991245226B16B9A
SHA-256:	F118FD9D6BA4C36DB3556D1035EFE90E99C00BF879A22ABEBE1DADFDBB3074D7
SHA-512:	3F459A8C9536B615BBD3B8BFEC9970F432CC72BD3287937F9F915FCBE9B2A13FCB4C45946A1722018F89DB505B418957BD513BD32A64580484D4AC7D3896A551
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........F..CF..CF..CO.1Cv..C...BB..C...BV..CF..Ce..C...BO..C...BJ..C...BG..C...B{..C..]CG..C...BG..CRichF..C........................PE..d....g............" .........................................................p.......F....`A.........................................P......tU..0....@............... ...!...`......H...p.......................(.......8....................G.......................text.............................. ..`.rdata..............................@..@.data....S...p.......p..............@....pdata........... ..................@..@.didat..............................@....mrdata..2.......@..................@..@.rsrc........@... ..................@..@.reloc.......`......................@..B................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\win64\sqlite3.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1311232
Entropy (8bit):	5.897658121795144
Encrypted:	false
SSDEEP:	12288:aHnKY5WcmiyfogSknJbjhrbXBbrxaLsBDJbVQAjXwcasznMbDz43X6dmM:aqY5Wcmi4FJbXdsLsBNRQAjgH
MD5:	C11138204609EA63A3E88B4C8C09B035
SHA1:	B0829124F7E275B0F341C6AF0FDD3DD5F65667A4
SHA-256:	60C16C2FAB14B344B8343778DCD6BBFDEE3DFE5F83D1AC8D2E50C6877419EEE4
SHA-512:	28D9E92498433C1F6EC41893FC17DB76D6CB7A1C565461EB6E67EEBC2B924DD4AA65486C29874CAA9AC5C78F804A8799C7CE1C641DD9F080BF1BF94B58CA208C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................"........d......e.....f......e......a......b......g....Rich...........PE..d.....OT.........." ................@I.......................................p............`.........................................@...g!......(....0.......@..............P..8....+..8...........................0>..p...........8................................text............................... ..`.rdata....... ......................@..@.data....q.......D..................@....pdata.......@......................@..@.idata..X...........................@....rsrc........0......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\win64\symsrv.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	344528
Entropy (8bit):	5.780306640057818
Encrypted:	false
SSDEEP:	6144:yT/zGgy2HzkCwmkfCl00EiwtHgadXIezwnzx7I91DR9J2:y3GL2HzkCwmkfClHbghpINzZmBRa
MD5:	1473A9CCB67526D4010F1B0F9E6B2977
SHA1:	7FE8C168E976200CF1562B8E8991245226B16B9A
SHA-256:	F118FD9D6BA4C36DB3556D1035EFE90E99C00BF879A22ABEBE1DADFDBB3074D7
SHA-512:	3F459A8C9536B615BBD3B8BFEC9970F432CC72BD3287937F9F915FCBE9B2A13FCB4C45946A1722018F89DB505B418957BD513BD32A64580484D4AC7D3896A551
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........F..CF..CF..CO.1Cv..C...BB..C...BV..CF..Ce..C...BO..C...BJ..C...BG..C...B{..C..]CG..C...BG..CRichF..C........................PE..d....g............" .........................................................p.......F....`A.........................................P......tU..0....@............... ...!...`......H...p.......................(.......8....................G.......................text.............................. ..`.rdata..............................@..@.data....S...p.......p..............@....pdata........... ..................@..@.didat..............................@....mrdata..2.......@..................@..@.rsrc........@... ..................@..@.reloc.......`......................@..B................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\windowsrepair.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	268704
Entropy (8bit):	5.837891086948313
Encrypted:	false
SSDEEP:	6144:0drkqKo/nt7PrwnoK0M6EZgugEkkoSE5O7Z3LLr:6rkm9mP6EZgugEnoSE5OB
MD5:	9A4D1B5154194EA0C42EFEBEB73F318F
SHA1:	220F8AF8B91D3C7B64140CBB5D9337D7ED277EDB
SHA-256:	2F3214F799B0F0A2F3955DBDC64C7E7C0E216F1A09D2C1AD5D0A99921782E363
SHA-512:	6EEF3254FC24079751FC8C38DDA9A8E44840E5A4DF1FF5ADF076E4BE87127075A7FEA59BA7EF9B901AAF10EB64F881FC8FB306C2625140169665DD3991E5C25B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...............................d)..`........ ....@.................................:8..........................................d........................k...................................3.......................................................text............................... ..`.data........ ......................@....rdata...g...@...h...(..............@..@.bss....d)...............................CRT................................@....idata..N...........................@....rsrc...............................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\winhook-i386.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	206232
Entropy (8bit):	6.577803539808585
Encrypted:	false
SSDEEP:	6144:ZyuXZus0fJ34+UZQ5IvR2diworEdVpRmY:nXZgV4dkIJfrEdVt
MD5:	DE625AF5CF4822DB08035CC897F0B9F2
SHA1:	4440B060C1FA070EB5D61EA9AADDA11E4120D325
SHA-256:	3CDB85EE83EF12802EFDFC9314E863D4696BE70530B31E7958C185FC4D6A9B38
SHA-512:	19B22F43441E8BC72507BE850A8154321C20B7351669D15AF726145C0D34805C7DF58F9DC64A29272A4811268308E503E9840F06E51CCDCB33AFD61258339099
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#........t...D)..0........ ...............................@..................................................P........................g.......#...................................................................................text............................... ..`.data...t.... ......................@....rdata..0d...@...f... ..............@..@.bss....D)...............................CRT................................@....idata..............................@....rsrc...............................@....reloc...#.......$..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files\Cheat Engine 7.5\winhook-x86_64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	271256
Entropy (8bit):	6.040002515360521
Encrypted:	false
SSDEEP:	6144:XcxPVJy83/NkY56owwouBQGsyTfkaiX6P0a:XkPV483FB56wsyTfkOJ
MD5:	F9C562B838A3C0620FB6EE46B20B554C
SHA1:	5095F54BE57622730698B5C92C61B124DFB3B944
SHA-256:	E08B035D0A894D8BEA64E67B1ED0BCE27567D417EAAA133E8B231F8A939E581D
SHA-512:	A20BC9A442C698C264FEF82AA743D9F3873227D7D55CB908E282FA1F5DCFF6B40C5B9CA7802576EF2F5A753FD1C534E9BE69464B29AF8EFEC8B019814B875296
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....d..t....-...........................................0.................................................................P........................g......h.......................................................0............................text....d.......f.................. ..`.data...t............j..............@....rdata..............................@..@.pdata...........0...`..............@..@.bss.....-...............................CRT................................@....idata..............................@....rsrc...............................@....reloc..h...........................@..B........................................................................................................................................................................................................................................................

C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2366456
Entropy (8bit):	7.412019669265582
Encrypted:	false
SSDEEP:	49152:UfH6zTpzzrjEEiNjbBnfnsKm8Igo+tDO6admDTDb:A6nxbqFnIdmS50PDb
MD5:	70FD2613E8171383FCB917E2F22B71A2
SHA1:	FC6D26F501F57C2E3B5B71A5054AF847C7C368FC
SHA-256:	8CAF8DDC69826C56C2BFC66DEE054F19AE607709155FC18600B9478EA9FDB316
SHA-512:	7C42924A255909BACC216EF11245FAFC2C529F99ABD13AC26A2A9D1DA18ED173911EE76D81790475EDE840879B55037681DDF6B4833B8F9911104B2CDE421AE0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Ka...S..S..S.5.S..Sn6.S..S.5.S..S.5.S..Sc"PS..S..Sd.Sn"RS..S...S..S.U.R..S...S..S...S..SuX.R..S,.S..SRich.*.S........................PE..L....\.d........../.................l.............@...................................$.........................................x....0...A.......... .#..l...........................................................................................text............................... ..`.rdata...:.......<..................@..@.data....$..........................@....sxdata...... ......................@....rsrc....A...0...B..................@..@................................................................................................................................................................................................................................................................................

C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	modified
Size (bytes):	814440
Entropy (8bit):	6.475738224302649
Encrypted:	false
SSDEEP:	12288:LkaJoYf9Z+uUMidkp22We0cRxoJy5DPbTtsqq5dlgM7qcNmP1bGq06ZIEUKth1OH:JJll87GY2q61llaOZBjKt5qq4i
MD5:	CC7167823D2D6D25E121FC437AE6A596
SHA1:	559C334CD3986879947653B7B37E139E0C3C6262
SHA-256:	6138D9EA038014B293DAC1C8FDE8C0D051C0435C72CD6E7DF08B2F095B27D916
SHA-512:	D4945C528E4687AF03B40C27F29B3CBF1A8D1DAF0EE7DE10CD0CB19288B7BC47FAE979E1462B3FA03692BF67DA51AB6FA562EB0E30B73E55828F3735BBFFFA48
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......lC. ("rs("rs("rscZqr""rscZwr."rscZvr;"rszWvr8"rszWqr""rszWwrv"rscZtr)"rscZsr?"rs("ss."rs.W{r "rs.W.s)"rs(".s)"rs.Wpr)"rsRich("rs........................PE..d...x6.d.........."......\...........(.........@.....................................q....`.................................................T........`..p.......xW..."..hK...p..........p...............................8............p...............................text....Z.......\.................. ..`.rdata...'...p...(...`..............@..@.data....F.......*..................@....pdata..xW.......X..................@..@_RDATA.......P......................@..@.rsrc...p....`......................@..@.reloc.......p......................@..B................................................................................................................................................................................

C:\Program Files\ReasonLabs\EPP\Uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	332568
Entropy (8bit):	5.000961772420698
Encrypted:	false
SSDEEP:	3072:sbjak9Kn0bnccfHyeL+FRexTh6z6ryBLqB9fbUD6y9lvQzJLEX48:GdKn0bnfPjL1xTh6zub1QD3leLEI8
MD5:	8157D03D4CD74D7DF9F49555A04F4272
SHA1:	EAE3DAD1A3794C884FAE0D92B101F55393153F4E
SHA-256:	CDF775B4D83864B071DBCFEED6D5DA930A9F065919D195BB801B6FFAF9645B74
SHA-512:	64A764068810A49A8D3191BC534CD6D7031E636AE306D2204AF478B35D102012D8C7E502ED31AF88280689012DC8E6AFD3F7B2A1FE1E25DA6142388713B67FA7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[.L.5.L.5.L.5...6.I.5...0...5...1.F.5.L.5.M.5.M1.\.5.M6.].5.M0.`.5...3.M.5...4.I.5.L.4...5.N<.M.5.N..M.5.N7.M.5.RichL.5.........................PE..d.....Uf.........."....'.L...........<.........@.............................0.......[....`.....................................................<....`......0..d........;... ..........p...........................P...@............`..h............................text...`J.......L.................. ..`.rdata.......`.......P..............@..@.data...h...........................@....pdata..d....0......................@..@_RDATA.......P......................@..@.rsrc.......`......................@..@.reloc....... ......................@..B................................................................................................................................................................................

C:\ProgramData\McAfee\WebAdvisor\saBSI.exe\log_0009004600300011001A0023.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	212
Entropy (8bit):	5.063205047955981
Encrypted:	false
SSDEEP:	6:rtRVb78k2JM0RG0DKhSnO1tRVbcVwZVjwOrADGq:ZRVn8k2JTDFnOHRVYwrjhroZ
MD5:	D8D19E997929F387D9E106D3E73E809B
SHA1:	D9BC03A22CADBCAB993B8640F65E5A2AD82F07F8
SHA-256:	541D8A9BD4AAF460D32EE9BDC59BBFDCB0389DA402CE5865BE5EBC909026671F
SHA-512:	87AE4C50693F98E75DCDB7F78028C33AA116935450CD8E6889684D20DBD7400B8C54BD717995BE38C599A8CD030C0DA3198875B3467D7EB5163590AC17D99D56
Malicious:	false
Reputation:	unknown
Preview:	[ERR][20240727 20:40:36.506][ProcessUtils.cpp@210]: Failed to get executable filename for process with id 4048. Error 31..[ERR][20240727 20:40:50.334][HttpsDownloadFile.cpp@200]: Unable to open HTTP transaction..

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine (32-bit).lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sat Jul 27 21:42:39 2024, mtime=Sat Jul 27 21:42:40 2024, atime=Wed Feb 8 15:45:06 2023, length=12807608, window=hide
Category:	dropped
Size (bytes):	969
Entropy (8bit):	4.538885562984562
Encrypted:	false
SSDEEP:	12:8mGhsVRYXaDh9Ji+dpF4AzKIDvPLmAjAo7Q/sAtbdpMZLibdpMG1bS9STmV:8mh9ddfKmvPiUAv/hxd2ydT1bS9STm
MD5:	51279433A612721D04EC193757BFE2A6
SHA1:	DD80BE6FE2FA04D61299F9C21F75C6ED55E16F21
SHA-256:	0E7BDD17B5810FFC83A4AABBB8FF927432058F2F64E3AA5FEFBEC48C437CA67C
SHA-512:	D3ABB498EC6AD241AABBC09FD9B7855594D6C0D8412278D130890AEC87583288044AC9F4FBF5661776B2AD15C95471256238717AB0A65656E3954EBEBEC793F8
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ....`.Iv.....bIv.......;...m...........................P.O. .:i.....+00.../C:\.....................1......XT...PROGRA~1..t......O.I.XT.....B...............J......%X.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1......XY...CHEATE~1.5..R.......XT..XY.....xT........................C.h.e.a.t. .E.n.g.i.n.e. .7...5.....v.2..m..HV.. .CHEATE~2.EXE..Z.......XT..XU......T........................c.h.e.a.t.e.n.g.i.n.e.-.i.3.8.6...e.x.e.......e...............-.......d....................C:\Program Files\Cheat Engine 7.5\cheatengine-i386.exe..E.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.\.c.h.e.a.t.e.n.g.i.n.e.-.i.3.8.6...e.x.e.!.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.`.......X.......128757...........hT..CrF.f4... .c..Yc...,...E...hT..CrF.f4... .c..Yc...,...E..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine (64-bit SSE4-AVX2).lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sat Jul 27 21:42:42 2024, mtime=Sat Jul 27 21:42:42 2024, atime=Wed Feb 8 15:45:12 2023, length=16708024, window=hide
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	4.570206681324524
Encrypted:	false
SSDEEP:	24:8mT9ddfKm8XgrEAk0/h7Md5grtdT1bUEm:8mvdfX86T17MdgtdT1AE
MD5:	0FFEABDCB522EB5E8513A980C3BCA4FD
SHA1:	1A97E2BF97403DAACDD600D3923970DCA461C358
SHA-256:	E43BAB2C8054C7A0231C23B238F4809485215BD0477E0C283CF35FF84541A478
SHA-512:	F9C8D8A0DAFC54D348AAA219BE8793CC670B8153B5CE5CAD9A2FDFCEE4EFC5B768B178B8CAE98F60E5504F5AD8A5CADA6A0678A9642915FDC2D76486536CAD42
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... .....\|Jv......Jv....\6..;...............................P.O. .:i.....+00.../C:\.....................1......XT...PROGRA~1..t......O.I.XT.....B...............J......%X.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1......XY...CHEATE~1.5..R.......XT..XY.....xT........................C.h.e.a.t. .E.n.g.i.n.e. .7...5.......2.....HV.. .CHEATE~4.EXE..r.......XV..XV......T........................c.h.e.a.t.e.n.g.i.n.e.-.x.8.6._.6.4.-.S.S.E.4.-.A.V.X.2...e.x.e.......q...............-.......p....................C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe..Q.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.\.c.h.e.a.t.e.n.g.i.n.e.-.x.8.6._.6.4.-.S.S.E.4.-.A.V.X.2...e.x.e.!.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.`.......X.......128757...........hT..CrF.f4... .c..Yc...,...E...hT..CrF.f4... .c..Yc...,...E..E.......9...1SPS..mD..pH.H@..=x.....h....H..

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine (64-bit).lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sat Jul 27 21:42:41 2024, mtime=Sat Jul 27 21:42:41 2024, atime=Wed Feb 8 15:45:10 2023, length=16718264, window=hide
Category:	dropped
Size (bytes):	979
Entropy (8bit):	4.562052678405407
Encrypted:	false
SSDEEP:	24:8m/dhG9ddfKmxmHsyAl/h78d5KdT1bGam:8m/jQdfXxmMRH78d0dT1Ka
MD5:	B6400CBB814439F940EB413349DA9C3A
SHA1:	783FFC410B33EA7E1CF6B58A216B2FD82B73CD27
SHA-256:	84AB33F3EF767ACEDA66AD321554DDFAEBE205D5D17E3DFF50D3A350744BEC83
SHA-512:	B6BCEDCDE4AA072CFECF292080DF9E6C06741A9A96F3266D4A731C84C48369874B4221B7357D95B4F86ADA73B219982EC21183A0FACB9CDD4C89FDAB9DAC416B
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ...Z..Iv....S-Jv..../...;...............................P.O. .:i.....+00.../C:\.....................1......XT...PROGRA~1..t......O.I.XT.....B...............J......%X.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1......XY...CHEATE~1.5..R.......XT..XY.....xT........................C.h.e.a.t. .E.n.g.i.n.e. .7...5.....z.2.....HV.. .CHEATE~3.EXE..^.......XU..XU......T........................c.h.e.a.t.e.n.g.i.n.e.-.x.8.6._.6.4...e.x.e.......g...............-.......f....................C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64.exe..G.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.\.c.h.e.a.t.e.n.g.i.n.e.-.x.8.6._.6.4...e.x.e.!.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.`.......X.......128757...........hT..CrF.f4... .c..Yc...,...E...hT..CrF.f4... .c..Yc...,...E..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine help.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sat Jul 27 21:42:47 2024, mtime=Sat Jul 27 21:42:47 2024, atime=Fri Apr 21 14:00:10 2017, length=306758, window=hide
Category:	dropped
Size (bytes):	944
Entropy (8bit):	4.515984023618469
Encrypted:	false
SSDEEP:	12:8mdEbCEZYXaDh9Ji+dpF4AzKIDihHMnawjA2CQ/MMFbdpMwuTbdpMG1bnxmV:8m529ddfKmHdAe/BdsPdT1bnxm
MD5:	857A53DBB5B1F010DC0E6C0CAA93694C
SHA1:	C2A3590B1645DDE48A1BE12B37DB34303EE989C2
SHA-256:	7EB59D1B39F3158B1B45C00E5A398B97FD297B805E8EC5D1AB0D6034FC31AC9E
SHA-512:	1BDBD5772C5D27E9F48CD453EC385343EC9E8E1748FF9DE9151B12AA287EABCD3BF02977514FA8664ACDBBCCD5A65ABFD1C67EDF94D07E99823BB48C5AA5DF8B
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ...!..Mv...!..Mv....9......F............................P.O. .:i.....+00.../C:\.....................1......XT...PROGRA~1..t......O.I.XT.....B...............J......%X.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1......XY...CHEATE~1.5..R.......XT..XY.....xT........................C.h.e.a.t. .E.n.g.i.n.e. .7...5.....l.2.F....J.x .CHEATE~1.CHM..P.......XX..XX.....#V........................C.h.e.a.t.E.n.g.i.n.e...c.h.m.......`...............-......._....................C:\Program Files\Cheat Engine 7.5\CheatEngine.chm..@.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.\.C.h.e.a.t.E.n.g.i.n.e...c.h.m.!.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.`.......X.......128757...........hT..CrF.f4... .c..Yc...,...E...hT..CrF.f4... .c..Yc...,...E..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine tutorial (64-bit).lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sat Jul 27 21:42:47 2024, mtime=Sat Jul 27 21:42:47 2024, atime=Fri Sep 30 18:38:22 2022, length=3403192, window=hide
Category:	dropped
Size (bytes):	964
Entropy (8bit):	4.573095551441782
Encrypted:	false
SSDEEP:	12:8mQushYXaDh9Ji+dpF4AzKIDr9VB2jA1Q/0gwbdpMJBObdpMG1b0s0smV:8my9ddfKmdKAa/0pdeKdT1blrm
MD5:	5BD973DE017DA520B22FC81EB5298585
SHA1:	43B9EA202BB452E701C1F01F16CBC168F725A0AC
SHA-256:	3C7AA69ECCA76B1242A95A21618314E594ED24AC077ED894D9B0DEC04B77D02D
SHA-512:	2BEFD2A06BE35DC8AF485950067F10233F28E77CD3A492C1295DADBD3C39E6EC5BF59E2EE67C17700DC256972D0F47DD5B198420E542E492F3353D043200A293
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ......Mv...N>.Mv....K.3......3..........................P.O. .:i.....+00.../C:\.....................1......XT...PROGRA~1..t......O.I.XT.....B...............J......%X.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1......XY...CHEATE~1.5..R.......XT..XY.....xT........................C.h.e.a.t. .E.n.g.i.n.e. .7...5.....t.2...3.>U. .TUTORI~1.EXE..X.......XX..XX.....&V........................T.u.t.o.r.i.a.l.-.x.8.6._.6.4...e.x.e.......d...............-.......c....................C:\Program Files\Cheat Engine 7.5\Tutorial-x86_64.exe..D.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.\.T.u.t.o.r.i.a.l.-.x.8.6._.6.4...e.x.e.!.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.`.......X.......128757...........hT..CrF.f4... .c..Yc...,...E...hT..CrF.f4... .c..Yc...,...E..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine tutorial.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Category:	dropped
Size (bytes):	665
Entropy (8bit):	2.989929398381464
Encrypted:	false
SSDEEP:	6:4xtCl0Xw0Ml//A9LY/dlrtelX8SKA89NTNAm6tibdlrMAe8mAm6ebdlrMAe8w:8wl0g0kXXdpUfKfBNAsbdpMJAibdpMV
MD5:	9CECB30EE563CEF0187E17C153C87AD2
SHA1:	35A124D70C992855C8AABAFD25A99520D2CE5BE6
SHA-256:	BF93799CD75A79868A1B5834D55644500110270F77529512824E2F9F1F605C06
SHA-512:	23ECD43901FED7827AAB04B4A4C55D0FEFD2EB39DA29A32EC0D031D9F116C61ABC3199CA38D949A44F3EF6DF774F071C0B2349B57413F92704D7C6031421B52D
Malicious:	false
Reputation:	unknown
Preview:	L..................F........................................................}....P.O. .:i.....+00.../C:\...................h.1...........Program Files.L............................................P.r.o.g.r.a.m. .F.i.l.e.s.....r.1...........Cheat Engine 7.5..R............................................C.h.e.a.t. .E.n.g.i.n.e. .7...5... .t.2...........Tutorial-i386.exe.T............................................T.u.t.o.r.i.a.l.-.i.3.8.6...e.x.e... ...B.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.\.T.u.t.o.r.i.a.l.-.i.3.8.6...e.x.e.!.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.....

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Cheat Engine.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sat Jul 27 21:42:39 2024, mtime=Sat Jul 27 21:42:39 2024, atime=Fri Sep 30 18:37:02 2022, length=399264, window=hide
Category:	dropped
Size (bytes):	949
Entropy (8bit):	4.490566403587587
Encrypted:	false
SSDEEP:	12:8m89C40YXaDh9Ji+dpF4AzKID8dDg0zKl6TjEjAKQ/MiYbdpMwkbdpMG1bgsgsmV:8m8NG9ddfKmSKloQAT/WdidT1bgsgsm
MD5:	27CE9934BBACFBDA0BC6C8B6A965CB5C
SHA1:	CD52C54465F0C5C992F6BACFFDE7B8987A6F0C04
SHA-256:	4D0E797377A0B22D579A64A6103949E342EEB4BE72812A762C8374523CCA450E
SHA-512:	2954CA6A4B49CA99136C60C267661AAFD836A4CDF6F26C29D079377B28F216822F45E1B4B9E8C6FBDE806C6D80A2B7D0985E67E6942EFA983FBF711BF89FCCBF
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ...+9.Iv......Iv....CV..................................P.O. .:i.....+00.../C:\.....................1......XT...PROGRA~1..t......O.I.XT.....B...............J......%X.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1......XY...CHEATE~1.5..R.......XT..XY.....xT........................C.h.e.a.t. .E.n.g.i.n.e. .7...5.....n.2.....>U.. .CHEATE~1.EXE..R.......XT..XT......T........................C.h.e.a.t. .E.n.g.i.n.e...e.x.e.......a...............-.......`....................C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe..A.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.\.C.h.e.a.t. .E.n.g.i.n.e...e.x.e.!.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.`.......X.......128757...........hT..CrF.f4... .c..Yc...,...E...hT..CrF.f4... .c..Yc...,...E..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Kernel stuff\Unload kernel module.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sat Jul 27 21:42:46 2024, mtime=Sat Jul 27 21:42:46 2024, atime=Wed Jan 25 17:19:40 2023, length=242616, window=hide
Category:	dropped
Size (bytes):	995
Entropy (8bit):	4.52168843525684
Encrypted:	false
SSDEEP:	12:8mQ4HYXaDh9Ji+dpF4AzKIDSlHheAjACQ//FbdpMcmbdpMG1bwswsmV:8mQA9ddfKmSHhAr//pdZCdT1bwswsm
MD5:	10FFCE07A26EE4EB368729DEF1EEFAAF
SHA1:	E04E48923C9E257AE1B6D3992AD51B0886CF07E0
SHA-256:	376FE73C5EFE52FA67E51542C1CB2CEC78E800510FBADDCC5ECB3C9D15685547
SHA-512:	D49E26841AE68F5ED2DDB2D98999B8E6E347FF1E7E617AC368A1DBB2E3CCBB8A6A2DB19F6F4DE836C471CF8C2F2D2F14111D4330379CC6FBFFC12C2FA41EAC41
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ......Lv......Lv.......0...............................P.O. .:i.....+00.../C:\.....................1......XT...PROGRA~1..t......O.I.XT.....B...............J......%X.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1......XY...CHEATE~1.5..R.......XT..XY.....xT........................C.h.e.a.t. .E.n.g.i.n.e. .7...5.....~.2.....9Vt. .KERNEL~1.EXE..b.......XX..XX......U........................K.e.r.n.e.l.m.o.d.u.l.e.u.n.l.o.a.d.e.r...e.x.e.......i...............-.......h....................C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe..L.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.\.K.e.r.n.e.l.m.o.d.u.l.e.u.n.l.o.a.d.e.r...e.x.e.!.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.`.......X.......128757...........hT..CrF.f4... .c..Yc...,...E...hT..CrF.f4... .c..Yc...,...E..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Lua documentation.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Has command line arguments, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Category:	dropped
Size (bytes):	822
Entropy (8bit):	3.3455528192085535
Encrypted:	false
SSDEEP:	12:8Ql0M0m/3BVSXz5dlsW+fy9+B0bdpM6iNL4t2YZ/elFlSJm:8AJ/Bql+fW+GdK5qy
MD5:	043CCC4692426220B9446A0EC57866AD
SHA1:	CAA088A5E8C3C54FD5E6FA619D881FDC72FF42D9
SHA-256:	40CDBB79FD47554E716C2BD47A48BA4401F0C93BF73AFC6F4F21EB891DAC8D92
SHA-512:	388E78F675605282E8471CABFA0390AC74979446EB04E7F7F552F7AB3C6911FC59141933CD46F2DE136E68056D6751C647FF4C8559502ED60B9F1586F6F710F5
Malicious:	false
Reputation:	unknown
Preview:	L..................F........................................................A....P.O. .:i.....+00.../C:\...................V.1...........Windows.@............................................W.i.n.d.o.w.s.....Z.1...........system32..B............................................s.y.s.t.e.m.3.2.....b.2...........notepad.exe.H............................................n.o.t.e.p.a.d...e.x.e.............\.....\.....\.....\.....\.....\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.n.o.t.e.p.a.d...e.x.e...C.:.\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.+.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.\.c.e.l.u.a...t.x.t.........%...............wN....]N.D...Q..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3.................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Reset settings.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sat Jul 27 21:42:46 2024, mtime=Sat Jul 27 21:42:46 2024, atime=Fri Feb 3 03:35:32 2023, length=309664, window=hide
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.517492824710165
Encrypted:	false
SSDEEP:	12:8mFZcBRYXaDh9Ji+dpF4AzKIDN56l7MtYjAwQ/SaDebdpM3bdpMG1bDVmV:8mjKb9ddfKmNvyAN/b6dEdT1bDVm
MD5:	DA7E03418F3301E8BDE3215BA34A3B8F
SHA1:	C187648860D0278065A04D6E732CB087F14D54DD
SHA-256:	69607CC93D762B1FE2A8FC79886A7E7C300F620DFC653517BDE598069BC99A0E
SHA-512:	5CB7D4D3E8BCBEFF65D6E2A76817BDF54754161A6E29D62785A052A512B04B642B61FBE066640370C011836B4A1F3476BA048E1A07AE31A27AC22A42150704C7
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ...w..Lv...w..Lv.....;.7...............................P.O. .:i.....+00.../C:\.....................1......XT...PROGRA~1..t......O.I.XT.....B...............J......%X.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1......XY...CHEATE~1.5..R.......XT..XY.....xT........................C.h.e.a.t. .E.n.g.i.n.e. .7...5.....j.2.....CVp$ .CEREGR~1.EXE..N.......XX..XX......U........................c.e.r.e.g.r.e.s.e.t...e.x.e......._...............-.......^....................C:\Program Files\Cheat Engine 7.5\ceregreset.exe..?.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.\.c.e.r.e.g.r.e.s.e.t...e.x.e.!.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.`.......X.......128757...........hT..CrF.f4... .c..Yc...,...E...hT..CrF.f4... .c..Yc...,...E..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 7.5\Uninstall Cheat Engine.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sat Jul 27 21:42:39 2024, mtime=Sat Jul 27 21:42:39 2024, atime=Sat Jul 27 21:42:36 2024, length=3223968, window=hide
Category:	dropped
Size (bytes):	929
Entropy (8bit):	4.531143233333796
Encrypted:	false
SSDEEP:	12:8mY8c6PYXaDh9Ji+dpF4AzKIDtRboAjA+Q/ZkbdpMUwbdpMG1bO9OTmV:8m6C9ddfKmtdoUAX/edjEdT1bEUm
MD5:	3EDE6415376C4DE640C4A66553543C23
SHA1:	62B33534FC1090B9C04682FB873956BFB7DDC462
SHA-256:	FD0AEF3F552AAD9D2309CCA00EF8C64FC4BE3DC4A0DF4D520F19D6B91D5B66AB
SHA-512:	18A40F09E7B28F97AE4797C873F958847E40B0EE3BA97772607EB59B3F700610B66831650BDE4B3066766D7B089D04155A3A34318E0F6C4AED7F2F6D02180EEB
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ......Hv...g..Hv......Gv....11..........................P.O. .:i.....+00.../C:\.....................1......XT...PROGRA~1..t......O.I.XT.....B...............J......%X.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1......XY...CHEATE~1.5..R.......XT..XY.....xT........................C.h.e.a.t. .E.n.g.i.n.e. .7...5.....f.2..11..XS. .unins000.exe..J.......XT..XT......T....................c...u.n.i.n.s.0.0.0...e.x.e.......]...............-.......\....................C:\Program Files\Cheat Engine 7.5\unins000.exe..=.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.\.u.n.i.n.s.0.0.0...e.x.e.!.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.`.......X.......128757...........hT..CrF.f4... .c..Yc...,...E...hT..CrF.f4... .c..Yc...,...E..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.676048742462893
Encrypted:	false
SSDEEP:	24:ujsZPSIPSUcnA3/46giyfV4Hxk7P3Gus6acCQ4CXmW5mOgs:ujul2nQ4XfVkk7P3g6dB42mVs
MD5:	E94FB54871208C00DF70F708AC47085B
SHA1:	4EFC31460C619ECAE59C1BCE2C008036D94C84B8
SHA-256:	7B9D553E1C92CB6E8803E137F4F287D4363757F5D44B37D52F9FCA22FB97DF86
SHA-512:	2E15B76E16264ABB9F5EF417752A1CBB75F29C11F96AC7D73793172BD0864DB65F2D2B7BE0F16BBBE686068F0C368815525F1E39DB5A0D6CA3AB18BE6923B898
Malicious:	false
Reputation:	unknown
Preview:	0..r0..Z.......vS..uFH....JH:N.0....H........0S1.0...U....BE1.0...U....GlobalSign nv-sa1)0'..U... GlobalSign Code Signing Root R450...200318000000Z..450318000000Z0S1.0...U....BE1.0...U....GlobalSign nv-sa1)0'..U... GlobalSign Code Signing Root R450.."0....H.............0.........-.0.z.=.r.:K..a....g.7..~.....C..E..cW]....%..h.K..K.J...j..a'..D...?".O.....(..].Y.......,.3$.P:A..{.M.X8.........,..C...t...{.3..Yk....Z.{..U......L...u.o.a.tD....t..h.l&>.......0....\|U..p\$x %.gg...N4.kp..8...........;.gC....t./.....7=gl.E\.a.A.....w.FGs.....+....X.W..Z..%....r=....;D.&.........E.......Bng~B.qb...`.d....!N+.mh...tsg1z...yn\|..~FoM..+."D...7..aW...$..1s..5WG~.:E.-.Q.....7.e...k.w....?.0.o1..@........PvtY..m.2...~...u..J.,....+B..j6..L.............:.c...$d.......B0@0...U...........0...U.......0....0...U.........F...x9...C.VP..;0...*.H.............^+.t.4D_vH(@....n..%.{...=..v...0 ..`.....x.+.2..$.RR......9n....CA}..[.]...&..tr&....=;jR.<../.{.3.E.....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5C8CC0A7FE31816B4641D0465402560

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe
File Type:	data
Category:	dropped
Size (bytes):	264
Entropy (8bit):	3.079863962769498
Encrypted:	false
SSDEEP:	6:kK72Ti6WFkYGhipWhliK8al0GQcmqe3KQjMIXIXL/:T2tYkYGIWzyZ3qe3KQjxXIT
MD5:	D83CFF5259BCEB6B9D87C6E1E98DCA9E
SHA1:	C95B619A8593F2981DA5BC27A6EE041740CC3CDD
SHA-256:	50AE663165161394316DCFB23342746DC838BF8249589F96E3D56E21FEB6DEED
SHA-512:	42CDF0AAF9219E1D5EB00791560963B9F6D2A1603E70E8D477EFFB20C61B14038BA6A6C16A4146FE4CF12DC1C9A5113382CF23738A6CD5C7C6285D8243358CC9
Malicious:	false
Reputation:	unknown
Preview:	p...... ....v.....hv...(....................................................... ...............(.............v...h.t.t.p.:././.s.e.c.u.r.e...g.l.o.b.a.l.s.i.g.n...c.o.m./.c.a.c.e.r.t./.c.o.d.e.s.i.g.n.i.n.g.r.o.o.t.r.4.5...c.r.t...".6.2.f.a.4.8.4.5.-.5.7.6."...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\UnifiedStub-installer.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.357964438493834
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khav:ML9E4KQwKDE4KGKZI6Khk
MD5:	D8F8A79B5C09FCB6F44E8CFFF11BF7CA
SHA1:	669AFE705130C81BFEFECD7CC216E6E10E72CB81
SHA-256:	91B010B5C9F022F3449F161425F757B276021F63B024E8D8ED05476509A6D406
SHA-512:	C95CB5FC32843F555EFA7CCA5758B115ACFA365A6EEB3333633A61CA50A90FEFAB9B554C3776FFFEA860FEF4BF47A6103AFECF3654C780287158E2DBB8137767
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Temp\3yq4abxg.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2366456
Entropy (8bit):	7.412019669265582
Encrypted:	false
SSDEEP:	49152:UfH6zTpzzrjEEiNjbBnfnsKm8Igo+tDO6admDTDb:A6nxbqFnIdmS50PDb
MD5:	70FD2613E8171383FCB917E2F22B71A2
SHA1:	FC6D26F501F57C2E3B5B71A5054AF847C7C368FC
SHA-256:	8CAF8DDC69826C56C2BFC66DEE054F19AE607709155FC18600B9478EA9FDB316
SHA-512:	7C42924A255909BACC216EF11245FAFC2C529F99ABD13AC26A2A9D1DA18ED173911EE76D81790475EDE840879B55037681DDF6B4833B8F9911104B2CDE421AE0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Ka...S..S..S.5.S..Sn6.S..S.5.S..S.5.S..Sc"PS..S..Sd.Sn"RS..S...S..S.U.R..S...S..S...S..SuX.R..S,.S..SRich.*.S........................PE..L....\.d........../.................l.............@...................................$.........................................x....0...A.......... .#..l...........................................................................................text............................... ..`.rdata...:.......<..................@..@.data....$..........................@....sxdata...... ......................@....rsrc....A...0...B..................@..@................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\ArchiveUtilityx64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	158512
Entropy (8bit):	6.366328902517048
Encrypted:	false
SSDEEP:	3072:ixAyrpDDw+Quvmsd3xsVjxlppyYlDB5sqnjJHSGzj2:aAWDUuvmsd3GnjpyYlt5pa
MD5:	C70238BD9FB1A0B38F50A30BE7623EB7
SHA1:	17B1452D783ED9FAE8FF00F1290498C397810D45
SHA-256:	88FB2446D4EAC42A41036354006AFADFCA5ACD38A0811110F7337DC5EC434884
SHA-512:	DD77E5C5CF0BF76BA480EB4682C965D0030171A7B7A165A6D1C3BA49895BC13388D17DDBB0FE3AC5D47B3D7D8110942C0D5B40E2FE3DF0A022E051696EC4FEB6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m...)...)...)...b...,...b.......b...#...)...(...............'.......8...b......)...t...C.9.......+.......(.....g.(.......(...Rich)...........PE..d...B.Uf.........." ...'.d................................................................`.............................................T.......(............`.......6..05......P.......p...........................@...@...............`............................text...pc.......d.................. ..`.rdata..............h..............@..@.data...p<... ......................@....pdata.......`......................@..@_RDATA.............................@..@.rsrc................,..............@..@.reloc..P...........................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Microsoft.Win32.TaskScheduler.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	349024
Entropy (8bit):	6.20930916625922
Encrypted:	false
SSDEEP:	3072:n1sSJApTSnQU/x0ImhuDzHfs4zbYOjujDRfygDgKQINXLLHIaKlay8weCycJ5DfT:n1sSmRIt/xhtsOju1DH5NXnIKAci
MD5:	87D7FB0770406BC9B4DC292FA9E1E116
SHA1:	6C2D9D5E290DF29CF4D95A4564DA541489A92511
SHA-256:	AAEB1EACBDAEB5425FD4B5C28CE2FD3714F065756664FA9F812AFDC367FBBB46
SHA-512:	25F7C875899C1F0B67F1ECEE82FE436B54C9A615F3E26A6BEC6233EB37F27CA09AE5CE7CF3DF9C3902207E1D5DDD394BE21A7B20608ADB0F730128BE978BEC9B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._O............" ..0..............-... ...@....... ....................................`.................................0-..O....@..................`;...`......(,..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d-......H............V..........`...H....+........................................{......{....V.(......}......}.......0..A........u2.......4.,/(.....{.....{....o....,.(.....{.....{....o....... ..<. )UU.Z(.....{....o....X )UU.Z(.....{....o....X...0..b........r...p......%..{.......%q5....5...-.&.+...5...o.....%..{.......%q6....6...-.&.+...6...o.....(......{......{......{....r.(......}......}......}......0..Y........u7.......L.,G(.....{.....{....o....,/(.....{.....{....o....

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\System.Data.SQLite.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	370744
Entropy (8bit):	6.1104091244570675
Encrypted:	false
SSDEEP:	6144:VruNWxFaLx73+nRo2GGmZ2CRGpAM3JUGuT5up6zOPLyU0SJFNFaFeFOFwcGF6cmt:INWx6xz+nRo2GGWHQZMaLyJSJFNFaFeo
MD5:	FFBB71041C9A01DA9EA90BDD4C0096A2
SHA1:	D4E9E5B70B356489F1C6EEFCCD58B343F9D79E44
SHA-256:	178570575291B95C767BA304D71C5310A94E93B6C1F673B9179D41A75A48D0E8
SHA-512:	AE7926C6CE85464B66FD73C1FE046F51DEE1739DD7476C8FBAC39D8479E7F8CB891C216DDBB160E5CECF828EFDEB2BF1C10A630BA57ADCF302AA7A2D83CC9728
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.].........." ..0..b..........j.... ........... ..............................Fr....`.....................................O.......$............l..8<...........~............................................... ............... ..H............text....a... ...b.................. ..`.rsrc...$............d..............@..@.reloc...............j..............@..B................L.......H...............................`~......................................:.(:.....}......{....:.(:.....}......{.......0...........~;...}.....r...p}........(......~;...(<...,r.....s....}.......}............{............%......(=....%...:....%...!....%...%.........%....%.........s....(....z.{....,......(=...o>...s?...z..0..'........{....-..(......o........(A.....}.....*..................0..T........{....,K.{....o@....+...(A......(B.....,..o;.....(C...-...........oD.....{..

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\System.ValueTuple.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	75800
Entropy (8bit):	6.026203256069962
Encrypted:	false
SSDEEP:	1536:r784YWau8lqubx6WxXLA+o2SLFyEdux136ytgHo0AuresehSAA7sxR:r7NV8v36tI0XCKAAy
MD5:	F34410B23B973CE915C40345C96DD82D
SHA1:	57B1D2DD6600CBCC64062549A925A4548CF9A47C
SHA-256:	E461CD2F7700FD28A3869D7C65F805058E0C30D44D9BCAF390ADF1896548B0D3
SHA-512:	CAE7D1CDFC68CE705D6292BE1A60C074F1E5B56E58D1558C958FC1022465626669D38CDE891152247C8877985C63A4806A4F0F82664E40F3AE173BF2B1280702
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>.Z.........." ..0.................. ... ....... .......................`......$.....@.....................................O.... ..P................2...@......x................................................ ............... ..H............text........ ...................... ..`.rsrc...P.... ......................@..@.reloc.......@......................@..B........................H......................................................................6..o.........f..o...........o............o...........o...........o............o...........o ..........o!...........o"...........o#..........o$..........o%...........o&...........o'............0..L.........o(..........o)..........o...........o+...........o,...........o-.........0..Y.........o...........o/..........o0...........o1...........o2...........o3...........o4.... .......0..k.........o5....

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\cs-CZ\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.881485510441517
Encrypted:	false
SSDEEP:	192:LIY1pQ8vGO4xToxMi5eX2zUA8rYgLIgPrEyz23tMuuVWJkYUECd1Vl7Iru+M3YV+:L3pQ8vQToxMi5emzUA8rYgLIOrnz8uu0
MD5:	999C5174344E3AF9CCD1E17299448E76
SHA1:	B66455DEB863B0A928D4E55ACD886E3C16506DE6
SHA-256:	0748A7D73F44ACDC027ABF5177DA04DD69D773299138EA0B25D3DBE4C00AD4A0
SHA-512:	E4F0C9C443070BBE348BA142FFB28631D4B86CA9D4DC1AA18E0711650CF063F590E2383A54C693ECA4CBA57EEC946BB5DFD2FFEA45820682D2C49DBC3ACFF612
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&..........NE... ...`....... ....................................@..................................E..K....`............................................................................... ............... ..H............text...T%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................0E......H........A..d...........P ..J!..........................................F!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\da-DK\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.746338816012684
Encrypted:	false
SSDEEP:	192:IIYRN3EsGGj3fvKEx8rUrb+M0lIVixNPqDGomU3WUeQoXjAUwMXrAfeMA7AWmBHt:IXN3EsVfvVx8rUrb+M0lIVixNqiomyJZ
MD5:	C2819AE6DB238F0D9FDD865347819A40
SHA1:	35F19D2AEC295FD7F98CE039DA95A0A556517B2B
SHA-256:	DA090057B5388EF09CA5F6E72C729F0330FC3CC0352E2EE704982E979DC4E1F1
SHA-512:	FD015CE397D556A669B1D83CFE82400998B7484A1F50D8683AF80EDC1533784196DF9092EDB4F6E727C45DF8B8430745DED57F154833626CEE7C778883074385
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&..........>E... ...`....... ....................................@..................................D..K....`............................................................................... ............... ..H............text...D%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................ E......H........A..d...........P ..<!..........................................8!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\de-DE\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.758461459269092
Encrypted:	false
SSDEEP:	384:l5rayxOPAxMtzTxCmf6hC/s2TvOFk6AOPh3+yFdmyndC58i:2PAKtnHOdvPhO2dmyndC58i
MD5:	63DB7F10882D9A963496A27CE65A6F35
SHA1:	DED19C471C9139479F25FB5B5B42C48163491763
SHA-256:	50A5AF3023A6BE366350730D9962DA94DACA926CFB5F9C5C3EF04C5AB5A06103
SHA-512:	04E7A081CC7814C93E10A7D21768F864026B2DF6FB58D3D67CDBE8D643B7497B6FBFC2064A75F8CA8C6147E12A04A9CE2E9E492CE7906EE0EDA6E71A2690D51F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....(...........F... ...`....... ....................................@..................................F..S....`............................................................................... ............... ..H............text....&... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B.................F......H.......4C..d...........P ..."...........................................".............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\de\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.557060180794725
Encrypted:	false
SSDEEP:	192:0MiWWNv/jzSENtqcadVl8PandjJUf7ZJSqSi/ufP/1S5rxg0XWr:0D1Nvb5adVl8P2djJMZJSGu3A5rxg0Xq
MD5:	F83D720B236576C7D1F9F55D3BB988F9
SHA1:	105A4993E92646B5DBB50518187ABE07CA473276
SHA-256:	6909A1C134D0285FBA2422A40EA0E65C1F0CA3C3EF2B94A1166015AF2A87780F
SHA-512:	FD8A464F2BC9D5B6C2EFA80348C3A9362F7473D4D632B2ADDAD8C272E8874E7E67C15B99B67E6515906B86D01D57CD42F9F0F1E9251C0AF93A9391CCC30E3202
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................9... ...@....... ..............................-E....@..................................9..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................9......H........4............... ......P .......................................z..).........*SE.1r.2K58\p.`1....SJ..G.f0d.W.oQY....&1+E..z..:@.n@........S.XEp=C... T.q.l....S.Kg....%..l..._...0..'.+................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\el-GR\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	4.982978904707212
Encrypted:	false
SSDEEP:	384:EnpUcW/WJsxvxwKW9iu6Wxtp701zA27r+PMvozT958I:yJs5xEGzfOPMvMx58I
MD5:	765162C01B6A1D4B1EF68832658F4EDA
SHA1:	0054503A01721F374796199F2202F308BAF0B280
SHA-256:	0EF2B0E94D98919186598312218A6BDF5E5C58D7BBA15E85C08CC64454081970
SHA-512:	6CEE1EE72E0AF4246EF6DF458CF68EA66C3987F915FBA642610C00D1C7CF3F23596471B9176ADAEFDF61E7891462665588056DF0A51835130965B148246237C1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....2...........P... ...`....... ....................................@..................................P..O....`............................................................................... ............... ..H............text....1... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B.................P......H.......HM..d...........P ...,...........................................,.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\es-ES\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.713044834675741
Encrypted:	false
SSDEEP:	192:cIYVmGe/VGuDqni6wxCjfp3DocEs5dMvGPcDonP33TewxlhiYwEHU4dIyrokBD7F:cuGe/V0ni6wxCjfpzocEs5dMvkcDqPD7
MD5:	648AD011C505A34A9A756209FF749753
SHA1:	4325FBB69E9BE4B38DE9BFC81F91CC851FB16145
SHA-256:	0CA79AE16990C66CE642475AE2C48EDD9C7D93D1CA361A84FF67B046E3DB1272
SHA-512:	980C68CB78807190911CED7F013FAAB3036C39BA1CB45EB41AEE9010C048E2F149303E881D7AE6C8A7494D51E5760A6ED0039B0E13502E28EE4B76CBEFA2C52A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........E... ...`....... ....................................@..................................D..S....`............................................................................... ............... ..H............text...$%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H.......dA..d...........P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\es\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.425694157692337
Encrypted:	false
SSDEEP:	192:r0WWNv/jzSEStoC1vxx6hUltfxx+BE00cUnAP9115rxg0XWr:r01NvbGVxx6hUltfxgE00cLF5rxg0XWr
MD5:	15DB634B70D6D9D6CD41BAAE3F02EB14
SHA1:	1456FFE09DF896271A746F9CB40A230F188AD397
SHA-256:	E893C6907DA8D68C03B1A10E68B554AD5A8C0533F15912106F32E925F2BEABF0
SHA-512:	1230E5368D4DAB9776D57056993669327E95FE72E262EFA541ED5D43ABC1BCD3618DB13B6BD6B3A27DA053C103E3FB647EAE759CCAEB443F7D9FFD1ECAA1122B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!................n:... ...@....... ..............................pi....@................................. :..K....@.......................`....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B................P:......H.......,5............... ..\...P .......................................2M.. ,.,]...).].....@.l..~.u.....Oz.B.{~*;.......6\..s..$_BZS.b..x.S....-..g.......Jr...{...E..F...s..sa.p.eS....X..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\fi-FI\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.7226745243816906
Encrypted:	false
SSDEEP:	192:K9IYXkNcDGwgTsxJoRxAM2+9Ul/laxRe+PE8v+GA3kr29zrJzfPWCiqxskBbHUi6:K9RkNcDtxJMxAM2+9Ul/laxRe8ZGGWgL
MD5:	2D4061061AF403D74AF69EEC9DFE6BA3
SHA1:	ED9F6F00A4F2ADA56485294E6BE527BB155EDF9E
SHA-256:	3F3D9DD8A18721304CB4BBE992BA0F4F5429A848B1B07FCA1919223DEE35161C
SHA-512:	2CE44FA04FEF89295AB0729C2A6EAA03818D77F14E700700CD6C54BA25ED3F07793F575CB88C9332AD65D46E8124D81453035D4C097034529FAD43DB3AFD1F93
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........D... ...`....... ....................................@..................................D..W....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......@A..d...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\fil-PH\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.3998629103661635
Encrypted:	false
SSDEEP:	192:b0Zne9hwoGBjeCipxwU6LOl+DDUbqN4PPjjDr8d30LfmJyXOhZCa2m5sml+T9lmP:b0Y9hwoEipxwU6LOl+DDUbqN4Xjz8V4e
MD5:	119609E491507BF1AC03571959DFB46F
SHA1:	5BFA87B946F8EA2559DD3039EDAAB1F710EB7C67
SHA-256:	68B32C96F048BE6FDF16050A5D5C073E2F9C5B76A4305CFD0E0A7AC9A45E6726
SHA-512:	3DAF79B9C30BC7A64FA388B35C750951874ED114697AD9A9F4E8AB733BACC71770983A007C837989526F1F45A2D60D87A58E395E27864FD16BB545110519937F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!..... ...........>... ...@....... ....................................@..................................=..K....@.......................`....................................................... ............... ..H............text...4.... ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B.................>......H.......x:..h...........P ..'...........................................#..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....Q.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..]....b..`............)...s..%'..JA*......>.$.\.&...'

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\fr-FR\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.837603709696788
Encrypted:	false
SSDEEP:	384:oY0al1sBIxgyFzjXZfu14MpXrOUDlK8yXahGY7uXR58b:2BImyDM5DtyXwGY7uXR58b
MD5:	49308946ADC1C1565024EAB211D2A703
SHA1:	F0004DC3E436FEE811A79618D6029DB0497D4A42
SHA-256:	82C2F6F6A3F4870F8486EFB70BEBC6BA085838A051BD465AC2C638079C14B891
SHA-512:	7A17AFB06AB0D036C0D80D3326695F17E52C8365C4B7F86FA668F090CA5A4416B4881C2110D075C22F650CDE6B8D04135669B886AEBEB030DA9ABA74B796CFCF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....(...........G... ...`....... ....................................@.................................\G..O....`............................................................................... ............... ..H............text....'... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B.................G......H........C..d...........P ...#...........................................#.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\fr\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.588569516197988
Encrypted:	false
SSDEEP:	192:YWWNv/jzSEYtPpmKJiDjgmlRFI0HYZDKz/VP81g5rxg0XWr:Y1NvbdKJiDjgmlRi0HYZDMp5rxg0XWr
MD5:	3B4621370ADDCF4306669C9E7E45C865
SHA1:	EA1AB3C499E946E152C1FC4A63FA99E1F9BE94B4
SHA-256:	E3EE50E08124A7603BE7D996DCF596EB0D3F9C603768E86E003F7B942D7097F3
SHA-512:	586755F32D16AFD937BFC1FE3C52210AB815D5D4C904DE101150FA052A94BABFCBDC465669FF8C2537B782474658D7912037DDB76D8C9A8FD34715D1FE7B2857
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!................^;... ...@....... ..............................1.....@..................................;..W....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B................@;......H........6............... ..?...P .......................................ME....P.<......I.J...Q'D........................X7..'<F..q..o.6G..M-.$.v..i.>...z..'....OV?....+.9..V........I"..9........;..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\hi-IN\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17408
Entropy (8bit):	4.802138576816784
Encrypted:	false
SSDEEP:	384:lIE5h/2kXJsxw5w2UW4ctvHU+Th60iu2F6mKVZnCyJT2ox8mn9THjI5gE2ac7D5P:lXJsO57hOt9AZnttxKqN58Q
MD5:	A9854641A26F4C67F43C62808AE321AE
SHA1:	A89D6B3ABED21270B6311161D4118AA26D82A69F
SHA-256:	B91AAE7B8D476828108FCF99E4348EC533A7FCD2654F630B3B6255FEF2B32DA8
SHA-512:	E8291B1BE4F00CB41857CB5CA83D617369E9AF1AA58829A85D6A696C78E5CFA1B0B0CC5CB1041961A05B85C512CE7E2F15978DC62032ECA6899B9664472C0881
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....:...........X... ...`....... ....................................@.................................lX..O....`............................................................................... ............... ..H............text....8... ...:.................. ..`.rsrc........`.......<..............@..@.reloc...............B..............@..B.................X......H........U..d...........P ...4...........................................4.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\hr-HR\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.744554675762649
Encrypted:	false
SSDEEP:	192:+IYVdDpBwGpkiVlZPxZlrPy2o92kGetEQyPIlUVKC3JDsS7qSmKV/4jNni67gXWu:+1DpBwSkoZPxZlrPY92kGetEQII2oANn
MD5:	4D275EF7CE5F02C9C92F2D10A90B78CD
SHA1:	319785221773DDBAFFBBE29A9B04DAF37C517BD5
SHA-256:	A3B7D4A8462021F7DD05DD15273FB41EEBEAA566BE106CD71C9B8A28A03DFD8B
SHA-512:	45800341E338301FF27F6D6F1EEA52E12941883B3FFA45CA96DD76FFB9BCCB5AF8138C724ED078846F9AD5370FF2B5C1D9C5F584B5D121115C4257F6889C34D1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........D... ...`....... ....................................@.................................\|D..O....`............................................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H........A..d...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\hu-HU\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.7989297090684016
Encrypted:	false
SSDEEP:	384:adpTgTI4gNxtBqu+p5DXv00jiOKQosgcekILk0pltfN58x:q4gNrBnOVlgcekILfpltV58x
MD5:	ADF094F101CA6B84BB7E2296EABCB05D
SHA1:	1C6F38FCF1E072865118803DF5C7F356456D23EB
SHA-256:	85241CD496E646DB4EB9DF9C8808CBD1384964F61B7CB4FEDB1B812FC913E9F0
SHA-512:	89249C151395AB1D2E698221553634D1FB39B48A667A46139B4CCE5B890B6B1C66F646D0229A31699949F07336042C9A5604A10C0B51246091825CC01700D5E9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....(...........F... ...`....... ....................................@..................................E..W....`............................................................................... ............... ..H............text...$&... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B.................F......H.......`B..d...........P ..."...........................................".............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\id-ID\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.680086159864234
Encrypted:	false
SSDEEP:	192:LqIYIZcKqG4ny8ZxSWuwCoBWidWjZdPAhDHPBg37eXCIKKXgXruQm8X0tF8HgGCe:LqOZcKqG8ZxSWuwCoBWidWjZ9AhLJ2SI
MD5:	6863EB1B4658AC9D04729CCE4E70480A
SHA1:	E0731B472F8D535AFF29BE240659D601BAECFB3C
SHA-256:	80E43D515959F4F7EE8138C74FB5BCF1F3DD7BCB19666760812C5BC46AF94B98
SHA-512:	D84EC0BFC778AB0D3F066129EB2BBA4E13A60C1E7B66994F1087790AC9DA635DA0C7F506FE92C6E46A76756686566AEB83EB81899C5FBFE23503632B5B076673
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........D... ...`....... ....................................@..................................D..O....`............................................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......(A..d...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\it-IT\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.768378931838588
Encrypted:	false
SSDEEP:	192:nIYr9kupX/Gdq8SQxZdNYobyRXvujVf9UgPw/ev3nww3OajMRD1TLIjB5leULIp5:n3kupX/GSQxZdNYBRXvujVf9UOwGvwwy
MD5:	9D5CEBB0C561E0DA0BCE75E527465BC9
SHA1:	2851D4995D9E9A37A0C1404C8E215B204871204E
SHA-256:	35BD747676E8512899D56A80276CA1835E6FCB17B309F80E709860363DFAA52F
SHA-512:	0A276428145E9B42E88757D8D1BA5C20A54AD7E1A287F9A9BFACCEB319901822D17C0D28DD96895B752A14867B19E2907E49E5968B77A8114A1D41C2F431BB0A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........E... ...`....... ....................................@..................................E..S....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H.......4B..d...........P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\it\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.368637490829895
Encrypted:	false
SSDEEP:	192:vOiWWNv/jzSE5tyT1TNgr1nJIhZAf/07mPD1q5rxg0XWr:v11NvbGTNgr1nJI3+07MM5rxg0XWr
MD5:	1C331DA4BCE2809E16913C02E385576E
SHA1:	CF8E71E030347749596A53D1B13B9E9583EC0527
SHA-256:	1D0493E38D8B3FCC7EFA4916FEA1EEA69EE6449BF435E1869C1BC3F54D4090C5
SHA-512:	2871119690F3DF0F244384A3F5F65FFE7CF17F1F00F6B530512AEDEB8397C9E357079E8FBA76D2A5BF6BE4E2B18E4AC1AC104EA2D29F8F40CEF6F30A905ECF83
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................9... ...@....... ..............................GR....@..................................9..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B.................9......H........4............... ......P ........................................M..+..u.3...i.7.[H\G.4D..dy.*p..L.m..4.....d..dZ...m..f../.@..GXQ.. ...$..."a......-....4..pS.5`@...;.`....Q..mHBx3..w3,!................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\ja-JP\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.087780030270019
Encrypted:	false
SSDEEP:	384:WxwAHD6CkxQdCnvRl/oRHx8asale681v/e589:ZCkSdK0t81vW589
MD5:	E77665402F7750BFA2B38018E5CA72DA
SHA1:	F3974F0F8F7E2FB60B41B77F08D226FC8787C324
SHA-256:	BC57C5F54A2CFD2212504E19D84C2E5FACF29D940B8631538CE82207244C8BB6
SHA-512:	59682D579A6458902E7208CAE06492081A8233C2D2A383D65C2EF5A40D4DC36211D14005B684587AFF08E8B32DD83FD81C3C454441DD905F94AE967A65B08844
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....,...........J... ...`....... ....................................@..................................I..O....`............................................................................... ............... ..H............text...$... ...,.................. ..`.rsrc........`......................@..@.reloc...............4..............@..B.................J......H.......hF..d...........P ...&...........................................&.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\ko-KR\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	5.202416131377818
Encrypted:	false
SSDEEP:	384:DFWuuyUdKvx4W9SxBmJsEMGFW/uuH2LlLTDUCl9w5JHJ8/uDP58z:WdKv+WqV2ZLToU9wXi/ub58z
MD5:	6935598916AF67879EA1BFB9E1D1FC50
SHA1:	54EE67CB95C349F5286CF5E9B2E5C0B7E01E1875
SHA-256:	C4E8DBD22A2BC4DB1844B75E600DFB8810EC1BD79AE9244E9BF95D6CD07BA593
SHA-512:	CFBF6C99640064C04D57E7F01F44EC378DBEBB42193B375080B2BD6E413111B1AD5D3CDA30E40A7CD2C0D5E0668372ADE5A9B71DE825DC0F337D9D9C2CD732C0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....(..........NG... ...`....... ....................................@..................................F..W....`............................................................................... ............... ..H............text...T'... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B................0G......H........C..d...........P ..=#..........................................9#.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\nb-NO\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.693180822922721
Encrypted:	false
SSDEEP:	192:WIYfsK6eGOy+v3qxh7EFBYn1p4hVYTPMPhT9CEGF3aN3MfCExO4MV09J7wcLaaEc:WZsK6epv3qxh7EFBYn1p4hVYTqhTAEGV
MD5:	58AFB3AE460111832F87628A55578CD1
SHA1:	9E43CE2918E003B67B80C7A2ABD314D8C489BC35
SHA-256:	0EAC601A33C74E373EEA3B72C6826E9512154852D9EDA174F5959EB8551DEDC4
SHA-512:	9F95FA0EB3AE3E2400A1A399D2821F6BC40D065C1E182304DB67B55E03D934A54153524D67D73FB5302781A988A7A87EAA23040C44C598298E078239C3EA938B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........D... ...`....... ....................................@.................................dD..W....`............................................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H........A..d...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\nl-NL\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.73364372569939
Encrypted:	false
SSDEEP:	192:etIYBN1XfOGCvouQTxklOVw/lzyOl/dEf80gPCdmP347U9DC47aqFD37E/avkeZu:CTN1X2HQTxklOVylzyOl/dEf80OCQPAn
MD5:	3F2522D425B3CC674925C117F5EB7984
SHA1:	E43D21EBD065BB42C0D66FD09E741F3FE75D04A4
SHA-256:	0F2D18D4EA34E514BC0865EE2C4DB488E44AB96A6F60D8666FA1CBAA50F83BA0
SHA-512:	DBF57878A763147E2312BADC78B3FE3A35D9F06F03681B071C5D3DFD84EEFCCF8877693D591C63A8D92628B1CDD59A8C30489D2094E9F59BFFDFA9920721FA2A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&..........nE... ...`....... ....................................@................................. E..K....`............................................................................... ............... ..H............text...t%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................PE......H........A..d...........P ..i!..........................................e!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\pl-PL\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.8003614094777545
Encrypted:	false
SSDEEP:	192:aIYfp3DcrGr6SHAOzLxE6oMuN50rtbxn/XidPWd3SJC30Gh58xSoHR+hxWfbrVsu:aZp3Dcr2NAcLxE6oMy50rtbxn/Xi9Wdq
MD5:	046D8A330F45EFDE3EB3F83F446663DE
SHA1:	DAC7E590C64A39332FD6527CDD21B194257234D6
SHA-256:	1332F9D4F4189C94E25B7755D8BDB779C4C016229B93C10D8CFA978B1B41A6B4
SHA-512:	BCF70C1B1751D5DBFF1A6A97C07B04749603DB246EC40B3658F1E673BE4C80D1FFAAE1E3A8A70A1C949494B12531237FEF1EBB647EF7B2DF1C617F458A56CAA6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........D... ...`....... ....................................@..................................D..K....`............................................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H........A..d...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\pl\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.594776627495051
Encrypted:	false
SSDEEP:	192:haWWNv/jzSEYtq2dE1cxy8ON0Qsk96sPb1V5rxg0XWr:g1NvbaG1cxy8ONHskdD5rxg0XWr
MD5:	B60817A69E314B22F746917C826DA53E
SHA1:	7D2785A6D1A53A0717C986B959AF67DE6F9300E4
SHA-256:	6E58D86C42B61226DD7AF35D7C9432CE6F0982D1D0D5A2F4120E8ABC5C787A02
SHA-512:	9A8F029329CE105B3F72FEE623E3AB8C88E1AF45F86FAB61F81BE418B2D70F83E4C0466010D312240A01E1EF8F9B9926EBF43E25BDC3C364C2D28AB9B0E5F6FC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................;... ...@....... ............................../c....@..................................:..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B.................:......H........5............... ......P .......................................T`.K.%...N.f..u.........Z..1....#CTR.v....:aq.i#:Z.oAkQ:D...q.6...l....J.W.Pn.J......d........3.F..[.c....#....$.F..0...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\pt-BR\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.717379118116406
Encrypted:	false
SSDEEP:	192:NIY1nlNKGnxGxIDx+sQ0Y4EQujHOVhPgdfBF3UTVV/Lea/FVgYISK+uZqiF4Afk5:NrnlNK/xIDx+sQ0Y4EQujHOVZgdBtofn
MD5:	81F5B0997E189FEC285ACD3443FD109B
SHA1:	0306EC1169E196997BF196EC985105EF1464A2C9
SHA-256:	0F4397AD0FA9627DF4B50BAEB213EDB790AAEDFC1862708B8D4D401620C6D47F
SHA-512:	156F7082E24FB87765F83859834DA4027AB473821B7E39C92E206D0F1DF827EA17F243A913C5FFC890ECB7506BA4A7E28986272A988A38D05619C7034B329ADB
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........E... ...`....... ....................................@..................................D..S....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......TA..d...........P ...!........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\pt-PT\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.728117001174555
Encrypted:	false
SSDEEP:	192:xIY1nlNKGnxOu7xKgUOVBQ6Bo19sPzPLegs8+3vCqV/LMa/FVKYIS+9wOTKQiF4I:xrnlNKNu7xKgUOVBQ6Bo19sPTLM80aol
MD5:	2955126EC370BB65EE76E53DCF1FBCDC
SHA1:	CFFCC8D9D2414863FD45DA41F03030878A7F8769
SHA-256:	A5FE29467CFE179EFA29C1A4C1DC39247517150E734ACB20AB29C3FF817CCD3B
SHA-512:	56F6164D09BACA5D86844D126BF557410F15B442D43DD072A102F78BC02192F2ED734012BB1127DD09C0821115DECB6E6B3E0BB637423FEBE7069BA8BF275617
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&..........>E... ...`....... ....................................@..................................D..S....`............................................................................... ............... ..H............text...D%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................ E......H........A..d...........P ..2!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\pt\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.725154076738642
Encrypted:	false
SSDEEP:	192:9IY1nlNKGnxOu7xKgUOVBQ6Bo19sPzPLegs8+3vCqV/LMa/FVKYIS+9wOTKQiF4U:9rnlNKNu7xKgUOVBQ6Bo19sPTLM80ao5
MD5:	ABE4A7998F99C8BDD303BE6AB09DC20A
SHA1:	577A7FDC5DBBF1BC231C8665603F48C15E674EDD
SHA-256:	DC166EA7286C26BE2CCF0A44677F228B660BFB6D9DD4C78FE0409B08327536DF
SHA-512:	B28AB5F36736AEDCCE65099734813E3260D95908EF457F67AAB96089EC3D50E2FA0562EC1454E4E1320433B50847001909E28F27AE87C3A7CBE66ABC24A5FD75
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&..........>E... ...`....... ....................................@..................................D..W....`............................................................................... ............... ..H............text...D%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................ E......H........A..`...........P ..2!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\ro-RO\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.785865587531196
Encrypted:	false
SSDEEP:	192:kdIY4puUhG9oHusJxWgAm/45t6lSertHPHrgCs324VfosqPXMdEqljSNPEinIOBZ:CapuUhg7sJxWgAm/45t6lSertvHrDapG
MD5:	5F6E31693AFF46FBDBCA6AABC5ED7E40
SHA1:	D1460A56FD08C8EE10D6E4E470B72BB53D3955A8
SHA-256:	31AA8F7D10891DB8188A5FB8999EE0CB8564253D8C91A39EC432764011BF42C8
SHA-512:	CDBD5C9C488BF31C0C8F772819D41E36546F8CAA7E0AB75281DAF59C401A60629DF00F1D6C85FB396A6FC1610AD5C24F17D2436397688E348FB55C312428E7B8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&..........^E... ...`....... ....................................@..................................E..W....`............................................................................... ............... ..H............text...d%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................@E......H........A..d...........P ..O!..........................................K!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\ru-RU\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	4.949048788389918
Encrypted:	false
SSDEEP:	384:NZ2vdzqaLxW8w5/EtHjl+dbA5eI00QF7jiS58U:3aL88/sd0QF7jiS58U
MD5:	566A9E0CEEA6C3CBF82B05C4F8470C27
SHA1:	C24F42AE5FC9A326B6526557501EA98150409F85
SHA-256:	CFB04DD1A62A3C5FE6D9AE898DF507B7567ABEEE7C871FA9AAD1A0D2475968AD
SHA-512:	ABA8482414B1D98313D37C58C4D19D7D197A440601175C9E3F1AEC5D7A86C53A43A289F843A3EFF85C0FEE043334A25E9D215A54FD4CA3DFF6E8A786E6FE85C3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.................M... ...`....... ....................................@..................................L..O....`............................................................................... ............... ..H............text...$-... ...................... ..`.rsrc........`.......0..............@..@.reloc...............6..............@..B.................M......H.......hI..d...........P ...)...........................................).............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\ru\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.846136752240531
Encrypted:	false
SSDEEP:	192:phbWWNv/jzSEfthb7O9JKggIOrCPPzm394in3fwB/CZPlAg1O5rxg0XWr:pN1NvbH7O9JKgglrCPChnYVC5A5rxg06
MD5:	DADE13E423762BDAE745D57CA3DC86EF
SHA1:	7B4122CBEF771C5548A7CB5641B6DB6743C8C3F6
SHA-256:	1A1D5FDAC027144BCAA0E8110F4DE717E80944420C59708B3DD8E2BD31BC7ED4
SHA-512:	77F5050BA87E8ABEB92298D16897D6CEC087FFB7B4C38442C854A0993B398DE529C15B5674ADAACFB3E39CE05165F05A38337B2DBD41E8A7D806751542F6E8D3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!................~=... ...@....... ..............................>"....@.................................,=..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......(..............@..B................`=......H.......88............... ..e...P ......................................w..4.8b^b..W..i8s....oz...t..tlhp...$.8p..c....U(O'....N.w`...<".1.w....?.*.0=z`Lz5..^....O...Q.....v..z...........`;..a..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\sk-SK\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.89773663933091
Encrypted:	false
SSDEEP:	192:mIYK1uOKGEXJ7hxwUmX+41C/TUMZc/ZgPPInsYJNM3TPGdTzXpPbf+oBumIJMr2P:m41uOKl7hx9mX+41CLUMZc/ZOPVYJN6b
MD5:	EF403938F8FDBFB9638F378774F93D97
SHA1:	020AAD53FEB53DD763CA422CE47BC75F0A06F426
SHA-256:	EDA401DC462FAB09262874A61915D30F7721FA7F3FFCA7242461D978C54E76BA
SHA-512:	B40A0F1CC1C0C9A99FAFB1F96BF44DA543364DAB15A1BA4F564B9D3014C3031881E67700240BBD5DF280439901EE36A9345A32EC83DAED80203C115712820DB6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&..........nE... ...`....... ....................................@..................................E..O....`............................................................................... ............... ..H............text...t%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................PE......H........A..d...........P ..f!..........................................b!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\sl-SI\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.769946515681843
Encrypted:	false
SSDEEP:	192:NIYV7AGeXGfqyuMxUY+iZWBe2v3gW0dFgPaVCe1d3qTS3xH4q9OYtRwbHUWPsLZ4:NTAGeXyuMxUY+iZWBei3gW0dFOaEe3C5
MD5:	E3D94C18654B6E3A630A7932298E989D
SHA1:	A46151D16A43728FC905578B04C97A6034BEEC48
SHA-256:	4A6897E25BEA93BC47A166AE7C02CB2858C6399A9360F12E6EE56C4FE110B537
SHA-512:	DFCF6207F5D1EE1CA490ECE1CEFCC0B4C073A74D9E7AC0C1E865181173328421115BAB4530AF995DF2B04893C801D5F8D58B9867905FC1F59A6416E4CBFD5710
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........E... ...`....... ....................................@..................................D..S....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......TA..d...........P ...!........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\sl\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.767196344145025
Encrypted:	false
SSDEEP:	192:5IYV7AGeXGfqyuMxUY+iZWBe2v3gW0dFgPaVCe1d3qTS3xH4q9OYtRwbHUWPsLZA:5TAGeXyuMxUY+iZWBei3gW0dFOaEe3C5
MD5:	B84137A373B458BFDB8E37BF68DBC93B
SHA1:	C66FEC010EDA81A93608892749F6CA44E01828E9
SHA-256:	CC83EDEBF62A1C0F0698C97180AB13D96301C531C7270D4BDE4C43FA96129728
SHA-512:	5CEFD56822A084B7AC139A306640474FF82B106CA8088991FF58432867A405CE5091D11F465EBEA4EA1F30D102854FFA79424B0430E5BDA88FA9494FD8D23E00
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........E... ...`....... ....................................@..................................D..W....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......TA..`...........P ...!........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\sv-SE\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.726343979225638
Encrypted:	false
SSDEEP:	192:3tIYShuTiGMuLj/kyxI0Nc/yGUbwMgWf2iPMXBSSky3WDeFzMShGOBZ7T3GyRKvL:3tUhuTiGj/HxI0Nc/yGUbwMgWf2YMXQd
MD5:	F26F586F37F77C4040A1110CD09C1A04
SHA1:	9511A7124B27AB89BDCB25F4D373CC08C25E06BC
SHA-256:	0C709CC4E21D236600DCB400713D93940BB96BFCC3BE184ABC27EAA25C50853C
SHA-512:	F48821C805E4359CD6FE1571050248DBB6496040528ECCC313C1ACC67088B91E391C412023C37E2B2F1BFFB2704EC6D25982819FF6487298E4E17EBB1F43E18B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........D... ...`....... ....................................@..................................D..W....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......@A..d...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\th-TH\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16896
Entropy (8bit):	4.847206773739568
Encrypted:	false
SSDEEP:	384:HWmNyydz3LxBD5uSw84x/d/dfwJGTV/cEJviNhsFx55n5z5OPMuQ5m5rPzzSvooG:T7LHDFGh0EJviNhsFx55n5z5OPMuQ5mP
MD5:	912EF860F4ACB26AFA205A91956990D3
SHA1:	8DB790876785FE61D10F4E8E4D32722B5AD35679
SHA-256:	E49F80929F50C19E430352B21851F8359D7061B3EF4CDC9264BCC1BE3620B987
SHA-512:	0E89322265A7B8827302DD91DFF85E82DF7ED87FC8C1F04F2B13C23FFD8471A01CD52A172C008D0AA40288322C2F1EF2913A7039539EF5C9D9ED06F90B8D57CC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....8...........W... ...`....... ....................................@.................................@W..K....`............................................................................... ............... ..H............text....7... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B................pW......H........S..d...........P ...3...........................................3.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\tr-TR\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.883497823407382
Encrypted:	false
SSDEEP:	192:wIY4kciiGg/kISxvnmkYsPV+tIqMvhBhPYTua1j3SfDpu6WbyLWFTXLgNzCii7oM:wKkciiwISxvnmkYsPV+tIqMvhBZYquLt
MD5:	0082F8E3C82E3BEC8FA2EC9B8F62030A
SHA1:	BD9790D90D940DA82015B1A003DDDE0E6A814388
SHA-256:	8094AD142AB016533528ECCCEB49182D1AF3BF0BFD34DDD940F3714D7D17A145
SHA-512:	5B737D66475DC957E53A2F88CEABA78DB7D76BE7B5184B75D8516C5A97161131DDCD3130200BA0DF2C000F46658EC01A5CB2ED60A876266DB4BAC95986BD763B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........E... ...`....... ....................................@.................................dE..W....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H........B..d...........P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\vi-VN\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.077789016416725
Encrypted:	false
SSDEEP:	384:tTp4EAT1bY2bx1CxHdO35YFInizzX83tNeRFYMvF2Mr58N:CblbzC5jmtNeRN2y58N
MD5:	E224E6925C4274296BA7BEC71FF953A4
SHA1:	1BF409839D76EDB70B88426AC2C17106105EA3C9
SHA-256:	8CC2EAE4D338CC29846144136702F717E1379468A07919975FE6EEEB9007C558
SHA-512:	DAFABB12F383BD99CF0D1F1BD949CEE2F922C6CB03FFA51CD5583E45B2FF6B79C7B88B26CCD5E8DC0873388B7C61DE39DE968FC8E4A3E8B63C3B3D94711AC309
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!...............^I... ...`....... ....................................@..................................I..O....`............................................................................... ............... ..H............text...d)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B................@I......H........E..d...........P ..U%..........................................Q%.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.701646036890297
Encrypted:	false
SSDEEP:	192:HWWNv/jzSEhtiBbSEmfO2mdqeCtzEc6yCPVDA1L5rxg0XWr:H1NvbcbSEm22mdqet+wh25rxg0XWr
MD5:	3CEFEC17BAAC089C54C8102A4CFD160C
SHA1:	A54CD9BD4181A591937A99BE88BEB006279837DE
SHA-256:	AAFBE48966DBC5372A308AB9501245CE261D2715F336AD1908C799D354C981A2
SHA-512:	2D45193662C7CE2854CE2D3EE53AE199E094D09BC76D8D8A8E36B24EA60400A5F064CA16CE0078FE6CBDF4117C22565C04E47B99CD99868254C915DB6D18700F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................8... ...@....... ...................................@..................................8..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................8......H........3............... ......P ......................................%h...P...y.7....ON(..U.~vT]h.e9dfp*1...oDL..1.M..6.Ku...^5....RE.')f.$......{...mcc......E...g.l.Z.q..M..@._D.{...,...S....................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\zh-CN\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.080167063477581
Encrypted:	false
SSDEEP:	192:IIYXbXbaQGf0wwrCwYxzJSKqdy6eY5R6Q3Pyt7g0mY3IC1wx+bDqhbXpVuieenT1:IRbXbaQixwYxzJSKqdy6eY5Rt/A7c+hS
MD5:	93DDE9DE1910EC7C10CAF6A2A950E6E6
SHA1:	D9E977B3153676C2422374AD1D314046E1318806
SHA-256:	597FC5D537F33A564CDB2D467D2F588CA25954D6E758316D4911CA97C2A1A7CA
SHA-512:	300B6B873CF5C5487AD813D27823B4E899DA49342DB6F83FC0D23919A629AAAEC53334DAD63BEEBAD4D92372A76636F8069CF054D08C755A4C7CE76AA07C65D2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....$...........B... ...`....... ....................................@.................................XB..S....`............................................................................... ............... ..H............text...."... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B.................B......H........>..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\zh-Hant\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.728551774224484
Encrypted:	false
SSDEEP:	192:JWWNv/jzSEhtimYtEq40uI7Sr2fqmxkNeo7R7L7c7xM757odHK9nPol1f5rxg0Xq:J1NvbOtEq40uYSatEdHwWloA9Pk5rxgJ
MD5:	833F269BA6F0C34F49273DA7FBD7DCE7
SHA1:	D0253D322DCDF7F54E37C7E8911A8B77670D2967
SHA-256:	F8C769A357E6CD27452835E5288FE515FB50BFEEC83EF3969975171174B467E5
SHA-512:	4FA315E23D985AFFB46F6536CDF2DDC1B882F47098EE2D5A4B954DDEEB8904D1C83182B1598E4948A59728339945307B699A147ECD813C0F91986D95BDC57184
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................8... ...@....... ....................................@..................................8..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................8......H........3............... ......P ......................................gh....R.xns+....2..b]...c........W\|..C.....\*.~w.?.....%...M.}..K?.`.Y.0%U..........I.:f...p.EB.....]O]..4Sy'.D4N..................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\Translations\zh-TW\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.067541414141853
Encrypted:	false
SSDEEP:	192:oIY26Y9TGjEWVWxzJS9gSKiLHQhcScP/yggS2w3tWGPO4JRy0ty6WGbdIY9MAFXx:ow6Y9TEVWxzJS9gSKiLwhcSSqgwmMGxp
MD5:	142024ABF19A89ED6DF37C56CE927361
SHA1:	B818199BB5D275F7E583D9E20F99CF7A393ED226
SHA-256:	9678E0D14BAC32C77BAAE8A4B697051E3ADE12B91278D7B01FDA00ED471167E4
SHA-512:	0FF2F4570F35DF7B44901E982D3D15FA1DA6D8D41EB6D98B8ECCB920A8345ACB5A2E89D400F6AC1DD0DF3DD0F70CD1FD4AD38DD4B613F7E72D07D49F7E045C33
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....$...........B... ...`....... ....................................@.................................8B..S....`............................................................................... ............... ..H............text...."... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B................pB......H........>..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1120648
Entropy (8bit):	6.282495231593689
Encrypted:	false
SSDEEP:	12288:nAIzN9/YaT6MIQtZM1A0+Nwhq3drYozTW0fbcIQTPFdWHJLKe:AIzNpG061A0ue8lYozK0fbNpNKe
MD5:	C7FE1EB6A82B9FFAAF8DCA0D86DEF7CA
SHA1:	3CD3D6592BBE9C06D51589E483CCE814BAB095EE
SHA-256:	61D225EEFB7D7AF3519A7E251217A7F803A07A6DDF42C278417C140B15D04B0B
SHA-512:	348A48B41C2978E48DDBEB8B46AD63EF7DDE805A5998F1730594899792462762A9EEE6E4FE474389923D6B995ECA6518C58563F9D1765087B7AC05CE2D91C096
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...`.L..........."...0......B........... ........@.. ....................................`.....................................O.......`?...............U..........$...8............................................ ............... ..H............text........ ...................... ..`.rsrc...`?.......@..................@..@.reloc..............................@..B.......................H........Y..................@............................................~.............0..`.......(....o....(....o....(....(.......r...p(....(....(....~.......(.........,..(......(........(.....0..............~....o......E............'...9.......o...........8....~....o....s,....~....o....s.....+h~....o....s.....+V~....o....s.....~....o....~....o....~....o ...s$....+ ~....o....s.....~....o....s.....~......o!.......0..........~....-..("...+....(#.....o$...-..o%.....(.....,.

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsAtom.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	160016
Entropy (8bit):	6.4048842736009
Encrypted:	false
SSDEEP:	3072:S6lrh8aWSI9uVDeMWoWVy5zmndQ1dTZjxO3S/9FVkmiGUV+fS:S6lrhISL9e1oWE56ndQ19aY9Fjs2S
MD5:	F5CF4F3E8DEDDC2BF3967B6BFF3E4499
SHA1:	0B236042602A645C5068F44F8FCBCC000C673BFE
SHA-256:	9D31024A76DCAD5E2B39810DFF530450EE5A1B3ECBC08C72523E6E7EA7365A0B
SHA-512:	48905A9FF4A2EC31A605030485925A8048E7B79AD3319391BC248F8F022813801D82EB2FF9900EBCB82812F16D89FDFF767EFA3D087303DF07C6C66D2DCB2473
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsAtom.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!..0..2...........P... ...`....@.. ...................................`.................................pP..K....`..T............<...5..........0P............................................... ............... ..H............text....0... ...2.................. ..`.rsrc...T....`.......4..............@..@.reloc...............:..............@..B.................P......H........i..(...........0....U...O.......................................(....(.................................0..............0..............0.....................0.....................2K........`.2........0.....................6F.......0..............0.....................MU.z.....0.............B(....(....(...................................................................................................0..............0.............*Ad..........

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsDatabase.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	170328
Entropy (8bit):	6.47551843695429
Encrypted:	false
SSDEEP:	3072:XR761d9cCg9+zhOzcx9R0KvvvvnPPH6Gi5tPArrYeiYiPKiF15fJ2K/Krrii555z:81TcpihOk0KvvvvnPPH6Gi5tPArrYeiG
MD5:	72689B177CD84AE5260532F5C7A10EBD
SHA1:	4129FBAB0F99F8420F25D772D2D62A26B1FADB3C
SHA-256:	062FD8045911EAAB4B5F505DADE6C0E23E6200C1AC1FDB86EA73E69AB801E037
SHA-512:	8649EB139AE3B695463210EA2E6061C35CD3580C0AD6A5D2D859835255DD6ACD334D791BFCC0D00D1B60573960C91C29009F3325EB8B37DACFBB7CEF401EC4EE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsDatabase.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................!..0..Z...........x... ........@.. ..............................$.....`..................................w..K.......\............d..X5...........w............................................... ............... ..H............text...$X... ...Z.................. ..`.rsrc...\............\..............@..@.reloc...............b..............@..B.................x......H.......\|l..`...............4k...w.......................................(....(....:+.(Nf%^.(......0.....................0..............0...................-....;.....0.....................VV.Q!....0.........................!....0.............AL......Z.......q...................j.......................................................................................................0.............A4.................Y...............s...........!....0..........

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsJSON.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	223016
Entropy (8bit):	6.7884547646820765
Encrypted:	false
SSDEEP:	3072:cBuq5tonhw9PY+fAKul0ZJXY9ooyJtTsbbiRl7m76m/GS+KKeA4dtrSsQDZ:VqDOhw9PY+4Zl0ZFY9ooyUbc3Kc4dtaF
MD5:	927934736C03A05209CB3DCC575DAF6A
SHA1:	A95562897311122BB451791D6E4749BF49D8275F
SHA-256:	589C228E22DAB9B848A9BD91292394E3BEF327D16B4C8FDD1CC37133EB7D2DA7
SHA-512:	12D4A116AEE39EB53A6BE1078D4F56F0EBD9D88B8777C7BD5C0A549AB5CFF1DB7F963914552EF0A68FF1096B1E1DC0F378F2D7E03FF97D2850CA6B766C4D6683
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsJSON.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....r.............!..0..&...........D... ...`....@.. ...............................B....`..................................D..K....`..D............0..(7..........cD............................................... ............... ..H............text....%... ...&.................. ..`.rsrc...D....`.......(..............@..@.reloc..............................@..B.................D......H........\|...............W..O....C.......................................(....(....:+.(..4g.(......0.............A...................:........0.............B(....(....(.........................................................................................................................................................................0..............0.....................0.....................0..............................0.............*....

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsLogger.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	181184
Entropy (8bit):	6.53382578985949
Encrypted:	false
SSDEEP:	3072:+0AqxqD7b0Qv6wIMCP1Yr+Xle9WQJTrz96JiBRqMadYMBpCA5LH3wjg:NRkD/0Q7IMCP3ePOUBRqKep5jZ
MD5:	F55948A2538A1AB3F6EDFEEFBA1A68AD
SHA1:	A0F4827983F1BF05DA9825007B922C9F4D0B2920
SHA-256:	DE487EDA80E7F3BCE9CD553BC2A766985E169C3A2CAE9E31730644B8A2A4AD26
SHA-512:	E9B52A9F90BAECB922C23DF9C6925B231827B8A953479E13F098D5E2C0DABD67263EEECED9A304A80B597010B863055F16196E0923922FEF2A63EB000CFF04C9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsLogger.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...ky.............!..0.................. ........@.. ....................................`.................................P...K.......P................5........................................................... ............... ..H............text........ ...................... ..`.rsrc...P...........................@..@.reloc..............................@..B........................H.......ds..............."...}...........................................(....(....:+.(...W.(\|...."...........0..............0..............0.................................................0..............0.....................0..............................0..............................0..............................0.....................00.......0..............................0.....................00.......0..............................0.............

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsStubLib.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	261232
Entropy (8bit):	6.520670838166452
Encrypted:	false
SSDEEP:	6144:L4TddrmwvYlpI+JxFKb708NFR75vp+uvewjLbqzm9iVkW:Ud8HI+DW75Hmwnlip
MD5:	FA4E3D9B299DA1ABC5F33F1FB00BFA4F
SHA1:	9919B46034B9EFF849AF8B34BC48AA39FB5B6386
SHA-256:	9631939542E366730A9284A63F1D0D5459C77EC0B3D94DE41196F719FC642A96
SHA-512:	D21CF55D6B537EF9882EACD737E153812C0990E6BDEA44F5352DFE0B1320E530F89F150662E88DB63BEDF7F691A11D89F432A3C32C8A14D1EB5FC99387420680
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....WG..........." ..0.................. ........... ....................... .......c....`.....................................O.......p...............p8..........4...8............................................ ............... ..H............text...X.... ...................... ..`.rsrc...p...........................@..@.reloc..............................@..B........................H.......l&..`............2..h.............................................{ .....{!...V.(".....} .....}!......0..A........u........4.,/(#....{ ....{ ...o$...,.(%....{!....{!...o&...... ..f. )UU.Z(#....{ ...o'...X )UU.Z(%....{!...o(...X...0..b........r...p......%..{ ......%q.........-.&.+.......o)....%..{!......%q.........-.&.+.......o)....(...*...0...........(....}4....("...........s+...o(.....}......}......}.......}.......}.......}.......}.......}.......}......(B....

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsSyncSvc.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	814440
Entropy (8bit):	6.475738224302649
Encrypted:	false
SSDEEP:	12288:LkaJoYf9Z+uUMidkp22We0cRxoJy5DPbTtsqq5dlgM7qcNmP1bGq06ZIEUKth1OH:JJll87GY2q61llaOZBjKt5qq4i
MD5:	CC7167823D2D6D25E121FC437AE6A596
SHA1:	559C334CD3986879947653B7B37E139E0C3C6262
SHA-256:	6138D9EA038014B293DAC1C8FDE8C0D051C0435C72CD6E7DF08B2F095B27D916
SHA-512:	D4945C528E4687AF03B40C27F29B3CBF1A8D1DAF0EE7DE10CD0CB19288B7BC47FAE979E1462B3FA03692BF67DA51AB6FA562EB0E30B73E55828F3735BBFFFA48
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......lC. ("rs("rs("rscZqr""rscZwr."rscZvr;"rszWvr8"rszWqr""rszWwrv"rscZtr)"rscZsr?"rs("ss."rs.W{r "rs.W.s)"rs(".s)"rs.Wpr)"rsRich("rs........................PE..d...x6.d.........."......\...........(.........@.....................................q....`.................................................T........`..p.......xW..."..hK...p..........p...............................8............p...............................text....Z.......\.................. ..`.rdata...'...p...(...`..............@..@.data....F.......*..................@....pdata..xW.......X..................@..@_RDATA.......P......................@..@.rsrc...p....`......................@..@.reloc.......p......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsTime.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	132112
Entropy (8bit):	6.108992422954668
Encrypted:	false
SSDEEP:	3072:SWGjyLgosGplJLT7AwoTFGmrY6sWGGHyj:SwgBGplJX7AHGm8UI
MD5:	167B304C9C615BE2852AC0BEF86E6F15
SHA1:	7C38A8AF0DE07B41D5E5AF771274B0D46B87B0E0
SHA-256:	6D5EA04F978E429C5CF0065A213BF28D8AF36540493C6564218EA51B0D5B961D
SHA-512:	557CF71B939D5F388E17B432DB5D2A15EDE76E6ABCF0476B985BBA0DE4FC22CB130A1A240FE92F41DE03B60E7EDBC9445BE2461079E28EBE985FF523B32EB456
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\rsTime.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.................!..0.................. ........@.. .......................@......0I....`.....................................K.......D................4... ......`................................................ ............... ..H............text........ ...................... ..`.rsrc...D...........................@..@.reloc....... ......................@..B........................H........Z...i...........................................................(@...(6....0............j.0....................j....0..................0..............0............j.0..............0............jB(@...(6...(......."..........".............l................."..................(@...(....:+.(r.S1.(6.....0..............0..............0..........(@...8].......E........G...R...8.... ....(....( ...o....(!........ .....9....&8....(R... ........8....(....

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\uninstall-dns.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	269016
Entropy (8bit):	5.638348013030407
Encrypted:	false
SSDEEP:	3072:99jevmK0U7H/cF9P/V+FKDe/HfETJBLqw+foMCsbpM9NV:3FK0U7HkF9HVpe/HfASJCr9j
MD5:	772E66BF2ED9CA8F60C413576B9BFBA0
SHA1:	91A274E4B66966EB5D036835F8C99FFCD3E74F35
SHA-256:	C3A505A0BF9BB525DCFE981A5CB60D3B4DC4163F1A1179AA55DDB66E569CF2CB
SHA-512:	D3C5742FA5F0E663DF7809288B3159465323B9F8942EA684CAA1B98C912245C151E9F1C909129AB3EAFD5F6282B2B4C0BB983E929E945AA92EB6BC506CD19787
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[.L.5.L.5.L.5...6.I.5...0...5...1.F.5.L.5.M.5.M1.\.5.M6.].5.M0.`.5...3.M.5...4.I.5.L.4...5.N<.M.5.N..M.5.N7.M.5.RichL.5.........................PE..d.....Uf.........."....'.L.......... <.........@.............................0......p/....`.....................................................<....`.......0..d........8... ..........p...........................P...@............`..h............................text....J.......L.................. ..`.rdata.......`.......P..............@..@.data...h...........................@....pdata..d....0......................@..@_RDATA.......P......................@..@.rsrc........`......................@..@.reloc....... ......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\uninstall-epp.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	332568
Entropy (8bit):	5.000961772420698
Encrypted:	false
SSDEEP:	3072:sbjak9Kn0bnccfHyeL+FRexTh6z6ryBLqB9fbUD6y9lvQzJLEX48:GdKn0bnfPjL1xTh6zub1QD3leLEI8
MD5:	8157D03D4CD74D7DF9F49555A04F4272
SHA1:	EAE3DAD1A3794C884FAE0D92B101F55393153F4E
SHA-256:	CDF775B4D83864B071DBCFEED6D5DA930A9F065919D195BB801B6FFAF9645B74
SHA-512:	64A764068810A49A8D3191BC534CD6D7031E636AE306D2204AF478B35D102012D8C7E502ED31AF88280689012DC8E6AFD3F7B2A1FE1E25DA6142388713B67FA7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[.L.5.L.5.L.5...6.I.5...0...5...1.F.5.L.5.M.5.M1.\.5.M6.].5.M0.`.5...3.M.5...4.I.5.L.4...5.N<.M.5.N..M.5.N7.M.5.RichL.5.........................PE..d.....Uf.........."....'.L...........<.........@.............................0.......[....`.....................................................<....`......0..d........;... ..........p...........................P...@............`..h............................text...`J.......L.................. ..`.rdata.......`.......P..............@..@.data...h...........................@....pdata..d....0......................@..@_RDATA.......P......................@..@.rsrc.......`......................@..@.reloc....... ......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\uninstall-vpn.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	201880
Entropy (8bit):	6.4046209284871525
Encrypted:	false
SSDEEP:	3072:O9jevmK0U7H/cF9P/V+FKDe/HfETJBLqU+foMCdEiBhGo:eFK0U7HkF9HVpe/HfA6JCdEid
MD5:	410D4E81BE560D860339E12AC63ACB68
SHA1:	06A9F74874C76EBA0110CDD720DD1E66AA9C271A
SHA-256:	E4A8D1E07F851BE8070DD9B74255E9DD8B49262C338BFB6EF1537EDD8F088498
SHA-512:	4BBFFEEF276CE9B8FDD6D767BA00066309EEE0F65E49CEA999D48D1E8688C73D7011ED1301A668C69814457CAAD3981167A1E3FE2021329DD8FC05659103FB3A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[.L.5.L.5.L.5...6.I.5...0...5...1.F.5.L.5.M.5.M1.\.5.M6.].5.M0.`.5...3.M.5...4.I.5.L.4...5.N<.M.5.N..M.5.N7.M.5.RichL.5.........................PE..d.....Uf.........."....'.L.......... <.........@.............................0............`.....................................................<....`......0..d........6... ..........p...........................P...@............`..h............................text....J.......L.................. ..`.rdata.......`.......P..............@..@.data...h...........................@....pdata..d....0......................@..@_RDATA.......P......................@..@.rsrc.......`......................@..@.reloc....... ......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\ArchiveUtilityx64.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	158512
Entropy (8bit):	6.366328902517048
Encrypted:	false
SSDEEP:	3072:ixAyrpDDw+Quvmsd3xsVjxlppyYlDB5sqnjJHSGzj2:aAWDUuvmsd3GnjpyYlt5pa
MD5:	C70238BD9FB1A0B38F50A30BE7623EB7
SHA1:	17B1452D783ED9FAE8FF00F1290498C397810D45
SHA-256:	88FB2446D4EAC42A41036354006AFADFCA5ACD38A0811110F7337DC5EC434884
SHA-512:	DD77E5C5CF0BF76BA480EB4682C965D0030171A7B7A165A6D1C3BA49895BC13388D17DDBB0FE3AC5D47B3D7D8110942C0D5B40E2FE3DF0A022E051696EC4FEB6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m...)...)...)...b...,...b.......b...#...)...(...............'.......8...b......)...t...C.9.......+.......(.....g.(.......(...Rich)...........PE..d...B.Uf.........." ...'.d................................................................`.............................................T.......(............`.......6..05......P.......p...........................@...@...............`............................text...pc.......d.................. ..`.rdata..............h..............@..@.data...p<... ......................@....pdata.......`......................@..@_RDATA.............................@..@.rsrc................,..............@..@.reloc..P...........................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Microsoft.Win32.TaskScheduler.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	349024
Entropy (8bit):	6.20930916625922
Encrypted:	false
SSDEEP:	3072:n1sSJApTSnQU/x0ImhuDzHfs4zbYOjujDRfygDgKQINXLLHIaKlay8weCycJ5DfT:n1sSmRIt/xhtsOju1DH5NXnIKAci
MD5:	87D7FB0770406BC9B4DC292FA9E1E116
SHA1:	6C2D9D5E290DF29CF4D95A4564DA541489A92511
SHA-256:	AAEB1EACBDAEB5425FD4B5C28CE2FD3714F065756664FA9F812AFDC367FBBB46
SHA-512:	25F7C875899C1F0B67F1ECEE82FE436B54C9A615F3E26A6BEC6233EB37F27CA09AE5CE7CF3DF9C3902207E1D5DDD394BE21A7B20608ADB0F730128BE978BEC9B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._O............" ..0..............-... ...@....... ....................................`.................................0-..O....@..................`;...`......(,..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d-......H............V..........`...H....+........................................{......{....V.(......}......}.......0..A........u2.......4.,/(.....{.....{....o....,.(.....{.....{....o....... ..<. )UU.Z(.....{....o....X )UU.Z(.....{....o....X...0..b........r...p......%..{.......%q5....5...-.&.+...5...o.....%..{.......%q6....6...-.&.+...6...o.....(......{......{......{....r.(......}......}......}......0..Y........u7.......L.,G(.....{.....{....o....,/(.....{.....{....o....

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\System.Data.SQLite.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	370744
Entropy (8bit):	6.1104091244570675
Encrypted:	false
SSDEEP:	6144:VruNWxFaLx73+nRo2GGmZ2CRGpAM3JUGuT5up6zOPLyU0SJFNFaFeFOFwcGF6cmt:INWx6xz+nRo2GGWHQZMaLyJSJFNFaFeo
MD5:	FFBB71041C9A01DA9EA90BDD4C0096A2
SHA1:	D4E9E5B70B356489F1C6EEFCCD58B343F9D79E44
SHA-256:	178570575291B95C767BA304D71C5310A94E93B6C1F673B9179D41A75A48D0E8
SHA-512:	AE7926C6CE85464B66FD73C1FE046F51DEE1739DD7476C8FBAC39D8479E7F8CB891C216DDBB160E5CECF828EFDEB2BF1C10A630BA57ADCF302AA7A2D83CC9728
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.].........." ..0..b..........j.... ........... ..............................Fr....`.....................................O.......$............l..8<...........~............................................... ............... ..H............text....a... ...b.................. ..`.rsrc...$............d..............@..@.reloc...............j..............@..B................L.......H...............................`~......................................:.(:.....}......{....:.(:.....}......{.......0...........~;...}.....r...p}........(......~;...(<...,r.....s....}.......}............{............%......(=....%...:....%...!....%...%.........%....%.........s....(....z.{....,......(=...o>...s?...z..0..'........{....-..(......o........(A.....}.....*..................0..T........{....,K.{....o@....+...(A......(B.....,..o;.....(C...-...........oD.....{..

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\System.ValueTuple.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	75800
Entropy (8bit):	6.026203256069962
Encrypted:	false
SSDEEP:	1536:r784YWau8lqubx6WxXLA+o2SLFyEdux136ytgHo0AuresehSAA7sxR:r7NV8v36tI0XCKAAy
MD5:	F34410B23B973CE915C40345C96DD82D
SHA1:	57B1D2DD6600CBCC64062549A925A4548CF9A47C
SHA-256:	E461CD2F7700FD28A3869D7C65F805058E0C30D44D9BCAF390ADF1896548B0D3
SHA-512:	CAE7D1CDFC68CE705D6292BE1A60C074F1E5B56E58D1558C958FC1022465626669D38CDE891152247C8877985C63A4806A4F0F82664E40F3AE173BF2B1280702
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>.Z.........." ..0.................. ... ....... .......................`......$.....@.....................................O.... ..P................2...@......x................................................ ............... ..H............text........ ...................... ..`.rsrc...P.... ......................@..@.reloc.......@......................@..B........................H......................................................................6..o.........f..o...........o............o...........o...........o............o...........o ..........o!...........o"...........o#..........o$..........o%...........o&...........o'............0..L.........o(..........o)..........o...........o+...........o,...........o-.........0..Y.........o...........o/..........o0...........o1...........o2...........o3...........o4.... .......0..k.........o5....

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\cs-CZ\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.881485510441517
Encrypted:	false
SSDEEP:	192:LIY1pQ8vGO4xToxMi5eX2zUA8rYgLIgPrEyz23tMuuVWJkYUECd1Vl7Iru+M3YV+:L3pQ8vQToxMi5emzUA8rYgLIOrnz8uu0
MD5:	999C5174344E3AF9CCD1E17299448E76
SHA1:	B66455DEB863B0A928D4E55ACD886E3C16506DE6
SHA-256:	0748A7D73F44ACDC027ABF5177DA04DD69D773299138EA0B25D3DBE4C00AD4A0
SHA-512:	E4F0C9C443070BBE348BA142FFB28631D4B86CA9D4DC1AA18E0711650CF063F590E2383A54C693ECA4CBA57EEC946BB5DFD2FFEA45820682D2C49DBC3ACFF612
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&..........NE... ...`....... ....................................@..................................E..K....`............................................................................... ............... ..H............text...T%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................0E......H........A..d...........P ..J!..........................................F!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\da-DK\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.746338816012684
Encrypted:	false
SSDEEP:	192:IIYRN3EsGGj3fvKEx8rUrb+M0lIVixNPqDGomU3WUeQoXjAUwMXrAfeMA7AWmBHt:IXN3EsVfvVx8rUrb+M0lIVixNqiomyJZ
MD5:	C2819AE6DB238F0D9FDD865347819A40
SHA1:	35F19D2AEC295FD7F98CE039DA95A0A556517B2B
SHA-256:	DA090057B5388EF09CA5F6E72C729F0330FC3CC0352E2EE704982E979DC4E1F1
SHA-512:	FD015CE397D556A669B1D83CFE82400998B7484A1F50D8683AF80EDC1533784196DF9092EDB4F6E727C45DF8B8430745DED57F154833626CEE7C778883074385
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&..........>E... ...`....... ....................................@..................................D..K....`............................................................................... ............... ..H............text...D%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................ E......H........A..d...........P ..<!..........................................8!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\de-DE\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.758461459269092
Encrypted:	false
SSDEEP:	384:l5rayxOPAxMtzTxCmf6hC/s2TvOFk6AOPh3+yFdmyndC58i:2PAKtnHOdvPhO2dmyndC58i
MD5:	63DB7F10882D9A963496A27CE65A6F35
SHA1:	DED19C471C9139479F25FB5B5B42C48163491763
SHA-256:	50A5AF3023A6BE366350730D9962DA94DACA926CFB5F9C5C3EF04C5AB5A06103
SHA-512:	04E7A081CC7814C93E10A7D21768F864026B2DF6FB58D3D67CDBE8D643B7497B6FBFC2064A75F8CA8C6147E12A04A9CE2E9E492CE7906EE0EDA6E71A2690D51F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....(...........F... ...`....... ....................................@..................................F..S....`............................................................................... ............... ..H............text....&... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B.................F......H.......4C..d...........P ..."...........................................".............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\de\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.557060180794725
Encrypted:	false
SSDEEP:	192:0MiWWNv/jzSENtqcadVl8PandjJUf7ZJSqSi/ufP/1S5rxg0XWr:0D1Nvb5adVl8P2djJMZJSGu3A5rxg0Xq
MD5:	F83D720B236576C7D1F9F55D3BB988F9
SHA1:	105A4993E92646B5DBB50518187ABE07CA473276
SHA-256:	6909A1C134D0285FBA2422A40EA0E65C1F0CA3C3EF2B94A1166015AF2A87780F
SHA-512:	FD8A464F2BC9D5B6C2EFA80348C3A9362F7473D4D632B2ADDAD8C272E8874E7E67C15B99B67E6515906B86D01D57CD42F9F0F1E9251C0AF93A9391CCC30E3202
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................9... ...@....... ..............................-E....@..................................9..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................9......H........4............... ......P .......................................z..).........*SE.1r.2K58\p.`1....SJ..G.f0d.W.oQY....&1+E..z..:@.n@........S.XEp=C... T.q.l....S.Kg....%..l..._...0..'.+................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\el-GR\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	4.982978904707212
Encrypted:	false
SSDEEP:	384:EnpUcW/WJsxvxwKW9iu6Wxtp701zA27r+PMvozT958I:yJs5xEGzfOPMvMx58I
MD5:	765162C01B6A1D4B1EF68832658F4EDA
SHA1:	0054503A01721F374796199F2202F308BAF0B280
SHA-256:	0EF2B0E94D98919186598312218A6BDF5E5C58D7BBA15E85C08CC64454081970
SHA-512:	6CEE1EE72E0AF4246EF6DF458CF68EA66C3987F915FBA642610C00D1C7CF3F23596471B9176ADAEFDF61E7891462665588056DF0A51835130965B148246237C1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....2...........P... ...`....... ....................................@..................................P..O....`............................................................................... ............... ..H............text....1... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B.................P......H.......HM..d...........P ...,...........................................,.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\es-ES\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.713044834675741
Encrypted:	false
SSDEEP:	192:cIYVmGe/VGuDqni6wxCjfp3DocEs5dMvGPcDonP33TewxlhiYwEHU4dIyrokBD7F:cuGe/V0ni6wxCjfpzocEs5dMvkcDqPD7
MD5:	648AD011C505A34A9A756209FF749753
SHA1:	4325FBB69E9BE4B38DE9BFC81F91CC851FB16145
SHA-256:	0CA79AE16990C66CE642475AE2C48EDD9C7D93D1CA361A84FF67B046E3DB1272
SHA-512:	980C68CB78807190911CED7F013FAAB3036C39BA1CB45EB41AEE9010C048E2F149303E881D7AE6C8A7494D51E5760A6ED0039B0E13502E28EE4B76CBEFA2C52A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........E... ...`....... ....................................@..................................D..S....`............................................................................... ............... ..H............text...$%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H.......dA..d...........P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\es\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.425694157692337
Encrypted:	false
SSDEEP:	192:r0WWNv/jzSEStoC1vxx6hUltfxx+BE00cUnAP9115rxg0XWr:r01NvbGVxx6hUltfxgE00cLF5rxg0XWr
MD5:	15DB634B70D6D9D6CD41BAAE3F02EB14
SHA1:	1456FFE09DF896271A746F9CB40A230F188AD397
SHA-256:	E893C6907DA8D68C03B1A10E68B554AD5A8C0533F15912106F32E925F2BEABF0
SHA-512:	1230E5368D4DAB9776D57056993669327E95FE72E262EFA541ED5D43ABC1BCD3618DB13B6BD6B3A27DA053C103E3FB647EAE759CCAEB443F7D9FFD1ECAA1122B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!................n:... ...@....... ..............................pi....@................................. :..K....@.......................`....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B................P:......H.......,5............... ..\...P .......................................2M.. ,.,]...).].....@.l..~.u.....Oz.B.{~*;.......6\..s..$_BZS.b..x.S....-..g.......Jr...{...E..F...s..sa.p.eS....X..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\fi-FI\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.7226745243816906
Encrypted:	false
SSDEEP:	192:K9IYXkNcDGwgTsxJoRxAM2+9Ul/laxRe+PE8v+GA3kr29zrJzfPWCiqxskBbHUi6:K9RkNcDtxJMxAM2+9Ul/laxRe8ZGGWgL
MD5:	2D4061061AF403D74AF69EEC9DFE6BA3
SHA1:	ED9F6F00A4F2ADA56485294E6BE527BB155EDF9E
SHA-256:	3F3D9DD8A18721304CB4BBE992BA0F4F5429A848B1B07FCA1919223DEE35161C
SHA-512:	2CE44FA04FEF89295AB0729C2A6EAA03818D77F14E700700CD6C54BA25ED3F07793F575CB88C9332AD65D46E8124D81453035D4C097034529FAD43DB3AFD1F93
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........D... ...`....... ....................................@..................................D..W....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......@A..d...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\fil-PH\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.3998629103661635
Encrypted:	false
SSDEEP:	192:b0Zne9hwoGBjeCipxwU6LOl+DDUbqN4PPjjDr8d30LfmJyXOhZCa2m5sml+T9lmP:b0Y9hwoEipxwU6LOl+DDUbqN4Xjz8V4e
MD5:	119609E491507BF1AC03571959DFB46F
SHA1:	5BFA87B946F8EA2559DD3039EDAAB1F710EB7C67
SHA-256:	68B32C96F048BE6FDF16050A5D5C073E2F9C5B76A4305CFD0E0A7AC9A45E6726
SHA-512:	3DAF79B9C30BC7A64FA388B35C750951874ED114697AD9A9F4E8AB733BACC71770983A007C837989526F1F45A2D60D87A58E395E27864FD16BB545110519937F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!..... ...........>... ...@....... ....................................@..................................=..K....@.......................`....................................................... ............... ..H............text...4.... ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B.................>......H.......x:..h...........P ..'...........................................#..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....Q.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..]....b..`............)...s..%'..JA*......>.$.\.&...'

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\fr-FR\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.837603709696788
Encrypted:	false
SSDEEP:	384:oY0al1sBIxgyFzjXZfu14MpXrOUDlK8yXahGY7uXR58b:2BImyDM5DtyXwGY7uXR58b
MD5:	49308946ADC1C1565024EAB211D2A703
SHA1:	F0004DC3E436FEE811A79618D6029DB0497D4A42
SHA-256:	82C2F6F6A3F4870F8486EFB70BEBC6BA085838A051BD465AC2C638079C14B891
SHA-512:	7A17AFB06AB0D036C0D80D3326695F17E52C8365C4B7F86FA668F090CA5A4416B4881C2110D075C22F650CDE6B8D04135669B886AEBEB030DA9ABA74B796CFCF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....(...........G... ...`....... ....................................@.................................\G..O....`............................................................................... ............... ..H............text....'... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B.................G......H........C..d...........P ...#...........................................#.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\fr\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.588569516197988
Encrypted:	false
SSDEEP:	192:YWWNv/jzSEYtPpmKJiDjgmlRFI0HYZDKz/VP81g5rxg0XWr:Y1NvbdKJiDjgmlRi0HYZDMp5rxg0XWr
MD5:	3B4621370ADDCF4306669C9E7E45C865
SHA1:	EA1AB3C499E946E152C1FC4A63FA99E1F9BE94B4
SHA-256:	E3EE50E08124A7603BE7D996DCF596EB0D3F9C603768E86E003F7B942D7097F3
SHA-512:	586755F32D16AFD937BFC1FE3C52210AB815D5D4C904DE101150FA052A94BABFCBDC465669FF8C2537B782474658D7912037DDB76D8C9A8FD34715D1FE7B2857
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!................^;... ...@....... ..............................1.....@..................................;..W....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B................@;......H........6............... ..?...P .......................................ME....P.<......I.J...Q'D........................X7..'<F..q..o.6G..M-.$.v..i.>...z..'....OV?....+.9..V........I"..9........;..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\hi-IN\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17408
Entropy (8bit):	4.802138576816784
Encrypted:	false
SSDEEP:	384:lIE5h/2kXJsxw5w2UW4ctvHU+Th60iu2F6mKVZnCyJT2ox8mn9THjI5gE2ac7D5P:lXJsO57hOt9AZnttxKqN58Q
MD5:	A9854641A26F4C67F43C62808AE321AE
SHA1:	A89D6B3ABED21270B6311161D4118AA26D82A69F
SHA-256:	B91AAE7B8D476828108FCF99E4348EC533A7FCD2654F630B3B6255FEF2B32DA8
SHA-512:	E8291B1BE4F00CB41857CB5CA83D617369E9AF1AA58829A85D6A696C78E5CFA1B0B0CC5CB1041961A05B85C512CE7E2F15978DC62032ECA6899B9664472C0881
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....:...........X... ...`....... ....................................@.................................lX..O....`............................................................................... ............... ..H............text....8... ...:.................. ..`.rsrc........`.......<..............@..@.reloc...............B..............@..B.................X......H........U..d...........P ...4...........................................4.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\hr-HR\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.744554675762649
Encrypted:	false
SSDEEP:	192:+IYVdDpBwGpkiVlZPxZlrPy2o92kGetEQyPIlUVKC3JDsS7qSmKV/4jNni67gXWu:+1DpBwSkoZPxZlrPY92kGetEQII2oANn
MD5:	4D275EF7CE5F02C9C92F2D10A90B78CD
SHA1:	319785221773DDBAFFBBE29A9B04DAF37C517BD5
SHA-256:	A3B7D4A8462021F7DD05DD15273FB41EEBEAA566BE106CD71C9B8A28A03DFD8B
SHA-512:	45800341E338301FF27F6D6F1EEA52E12941883B3FFA45CA96DD76FFB9BCCB5AF8138C724ED078846F9AD5370FF2B5C1D9C5F584B5D121115C4257F6889C34D1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........D... ...`....... ....................................@.................................\|D..O....`............................................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H........A..d...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\hu-HU\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.7989297090684016
Encrypted:	false
SSDEEP:	384:adpTgTI4gNxtBqu+p5DXv00jiOKQosgcekILk0pltfN58x:q4gNrBnOVlgcekILfpltV58x
MD5:	ADF094F101CA6B84BB7E2296EABCB05D
SHA1:	1C6F38FCF1E072865118803DF5C7F356456D23EB
SHA-256:	85241CD496E646DB4EB9DF9C8808CBD1384964F61B7CB4FEDB1B812FC913E9F0
SHA-512:	89249C151395AB1D2E698221553634D1FB39B48A667A46139B4CCE5B890B6B1C66F646D0229A31699949F07336042C9A5604A10C0B51246091825CC01700D5E9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....(...........F... ...`....... ....................................@..................................E..W....`............................................................................... ............... ..H............text...$&... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B.................F......H.......`B..d...........P ..."...........................................".............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\id-ID\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.680086159864234
Encrypted:	false
SSDEEP:	192:LqIYIZcKqG4ny8ZxSWuwCoBWidWjZdPAhDHPBg37eXCIKKXgXruQm8X0tF8HgGCe:LqOZcKqG8ZxSWuwCoBWidWjZ9AhLJ2SI
MD5:	6863EB1B4658AC9D04729CCE4E70480A
SHA1:	E0731B472F8D535AFF29BE240659D601BAECFB3C
SHA-256:	80E43D515959F4F7EE8138C74FB5BCF1F3DD7BCB19666760812C5BC46AF94B98
SHA-512:	D84EC0BFC778AB0D3F066129EB2BBA4E13A60C1E7B66994F1087790AC9DA635DA0C7F506FE92C6E46A76756686566AEB83EB81899C5FBFE23503632B5B076673
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........D... ...`....... ....................................@..................................D..O....`............................................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......(A..d...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\it-IT\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.768378931838588
Encrypted:	false
SSDEEP:	192:nIYr9kupX/Gdq8SQxZdNYobyRXvujVf9UgPw/ev3nww3OajMRD1TLIjB5leULIp5:n3kupX/GSQxZdNYBRXvujVf9UOwGvwwy
MD5:	9D5CEBB0C561E0DA0BCE75E527465BC9
SHA1:	2851D4995D9E9A37A0C1404C8E215B204871204E
SHA-256:	35BD747676E8512899D56A80276CA1835E6FCB17B309F80E709860363DFAA52F
SHA-512:	0A276428145E9B42E88757D8D1BA5C20A54AD7E1A287F9A9BFACCEB319901822D17C0D28DD96895B752A14867B19E2907E49E5968B77A8114A1D41C2F431BB0A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........E... ...`....... ....................................@..................................E..S....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H.......4B..d...........P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\it\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.368637490829895
Encrypted:	false
SSDEEP:	192:vOiWWNv/jzSE5tyT1TNgr1nJIhZAf/07mPD1q5rxg0XWr:v11NvbGTNgr1nJI3+07MM5rxg0XWr
MD5:	1C331DA4BCE2809E16913C02E385576E
SHA1:	CF8E71E030347749596A53D1B13B9E9583EC0527
SHA-256:	1D0493E38D8B3FCC7EFA4916FEA1EEA69EE6449BF435E1869C1BC3F54D4090C5
SHA-512:	2871119690F3DF0F244384A3F5F65FFE7CF17F1F00F6B530512AEDEB8397C9E357079E8FBA76D2A5BF6BE4E2B18E4AC1AC104EA2D29F8F40CEF6F30A905ECF83
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................9... ...@....... ..............................GR....@..................................9..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B.................9......H........4............... ......P ........................................M..+..u.3...i.7.[H\G.4D..dy.*p..L.m..4.....d..dZ...m..f../.@..GXQ.. ...$..."a......-....4..pS.5`@...;.`....Q..mHBx3..w3,!................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\ja-JP\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.087780030270019
Encrypted:	false
SSDEEP:	384:WxwAHD6CkxQdCnvRl/oRHx8asale681v/e589:ZCkSdK0t81vW589
MD5:	E77665402F7750BFA2B38018E5CA72DA
SHA1:	F3974F0F8F7E2FB60B41B77F08D226FC8787C324
SHA-256:	BC57C5F54A2CFD2212504E19D84C2E5FACF29D940B8631538CE82207244C8BB6
SHA-512:	59682D579A6458902E7208CAE06492081A8233C2D2A383D65C2EF5A40D4DC36211D14005B684587AFF08E8B32DD83FD81C3C454441DD905F94AE967A65B08844
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....,...........J... ...`....... ....................................@..................................I..O....`............................................................................... ............... ..H............text...$... ...,.................. ..`.rsrc........`......................@..@.reloc...............4..............@..B.................J......H.......hF..d...........P ...&...........................................&.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\ko-KR\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	5.202416131377818
Encrypted:	false
SSDEEP:	384:DFWuuyUdKvx4W9SxBmJsEMGFW/uuH2LlLTDUCl9w5JHJ8/uDP58z:WdKv+WqV2ZLToU9wXi/ub58z
MD5:	6935598916AF67879EA1BFB9E1D1FC50
SHA1:	54EE67CB95C349F5286CF5E9B2E5C0B7E01E1875
SHA-256:	C4E8DBD22A2BC4DB1844B75E600DFB8810EC1BD79AE9244E9BF95D6CD07BA593
SHA-512:	CFBF6C99640064C04D57E7F01F44EC378DBEBB42193B375080B2BD6E413111B1AD5D3CDA30E40A7CD2C0D5E0668372ADE5A9B71DE825DC0F337D9D9C2CD732C0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....(..........NG... ...`....... ....................................@..................................F..W....`............................................................................... ............... ..H............text...T'... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B................0G......H........C..d...........P ..=#..........................................9#.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\nb-NO\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.693180822922721
Encrypted:	false
SSDEEP:	192:WIYfsK6eGOy+v3qxh7EFBYn1p4hVYTPMPhT9CEGF3aN3MfCExO4MV09J7wcLaaEc:WZsK6epv3qxh7EFBYn1p4hVYTqhTAEGV
MD5:	58AFB3AE460111832F87628A55578CD1
SHA1:	9E43CE2918E003B67B80C7A2ABD314D8C489BC35
SHA-256:	0EAC601A33C74E373EEA3B72C6826E9512154852D9EDA174F5959EB8551DEDC4
SHA-512:	9F95FA0EB3AE3E2400A1A399D2821F6BC40D065C1E182304DB67B55E03D934A54153524D67D73FB5302781A988A7A87EAA23040C44C598298E078239C3EA938B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........D... ...`....... ....................................@.................................dD..W....`............................................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H........A..d...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\nl-NL\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.73364372569939
Encrypted:	false
SSDEEP:	192:etIYBN1XfOGCvouQTxklOVw/lzyOl/dEf80gPCdmP347U9DC47aqFD37E/avkeZu:CTN1X2HQTxklOVylzyOl/dEf80OCQPAn
MD5:	3F2522D425B3CC674925C117F5EB7984
SHA1:	E43D21EBD065BB42C0D66FD09E741F3FE75D04A4
SHA-256:	0F2D18D4EA34E514BC0865EE2C4DB488E44AB96A6F60D8666FA1CBAA50F83BA0
SHA-512:	DBF57878A763147E2312BADC78B3FE3A35D9F06F03681B071C5D3DFD84EEFCCF8877693D591C63A8D92628B1CDD59A8C30489D2094E9F59BFFDFA9920721FA2A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&..........nE... ...`....... ....................................@................................. E..K....`............................................................................... ............... ..H............text...t%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................PE......H........A..d...........P ..i!..........................................e!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\pl-PL\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.8003614094777545
Encrypted:	false
SSDEEP:	192:aIYfp3DcrGr6SHAOzLxE6oMuN50rtbxn/XidPWd3SJC30Gh58xSoHR+hxWfbrVsu:aZp3Dcr2NAcLxE6oMy50rtbxn/Xi9Wdq
MD5:	046D8A330F45EFDE3EB3F83F446663DE
SHA1:	DAC7E590C64A39332FD6527CDD21B194257234D6
SHA-256:	1332F9D4F4189C94E25B7755D8BDB779C4C016229B93C10D8CFA978B1B41A6B4
SHA-512:	BCF70C1B1751D5DBFF1A6A97C07B04749603DB246EC40B3658F1E673BE4C80D1FFAAE1E3A8A70A1C949494B12531237FEF1EBB647EF7B2DF1C617F458A56CAA6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........D... ...`....... ....................................@..................................D..K....`............................................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H........A..d...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\pl\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.594776627495051
Encrypted:	false
SSDEEP:	192:haWWNv/jzSEYtq2dE1cxy8ON0Qsk96sPb1V5rxg0XWr:g1NvbaG1cxy8ONHskdD5rxg0XWr
MD5:	B60817A69E314B22F746917C826DA53E
SHA1:	7D2785A6D1A53A0717C986B959AF67DE6F9300E4
SHA-256:	6E58D86C42B61226DD7AF35D7C9432CE6F0982D1D0D5A2F4120E8ABC5C787A02
SHA-512:	9A8F029329CE105B3F72FEE623E3AB8C88E1AF45F86FAB61F81BE418B2D70F83E4C0466010D312240A01E1EF8F9B9926EBF43E25BDC3C364C2D28AB9B0E5F6FC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................;... ...@....... ............................../c....@..................................:..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B.................:......H........5............... ......P .......................................T`.K.%...N.f..u.........Z..1....#CTR.v....:aq.i#:Z.oAkQ:D...q.6...l....J.W.Pn.J......d........3.F..[.c....#....$.F..0...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\pt-BR\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.717379118116406
Encrypted:	false
SSDEEP:	192:NIY1nlNKGnxGxIDx+sQ0Y4EQujHOVhPgdfBF3UTVV/Lea/FVgYISK+uZqiF4Afk5:NrnlNK/xIDx+sQ0Y4EQujHOVZgdBtofn
MD5:	81F5B0997E189FEC285ACD3443FD109B
SHA1:	0306EC1169E196997BF196EC985105EF1464A2C9
SHA-256:	0F4397AD0FA9627DF4B50BAEB213EDB790AAEDFC1862708B8D4D401620C6D47F
SHA-512:	156F7082E24FB87765F83859834DA4027AB473821B7E39C92E206D0F1DF827EA17F243A913C5FFC890ECB7506BA4A7E28986272A988A38D05619C7034B329ADB
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........E... ...`....... ....................................@..................................D..S....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......TA..d...........P ...!........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\pt-PT\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.728117001174555
Encrypted:	false
SSDEEP:	192:xIY1nlNKGnxOu7xKgUOVBQ6Bo19sPzPLegs8+3vCqV/LMa/FVKYIS+9wOTKQiF4I:xrnlNKNu7xKgUOVBQ6Bo19sPTLM80aol
MD5:	2955126EC370BB65EE76E53DCF1FBCDC
SHA1:	CFFCC8D9D2414863FD45DA41F03030878A7F8769
SHA-256:	A5FE29467CFE179EFA29C1A4C1DC39247517150E734ACB20AB29C3FF817CCD3B
SHA-512:	56F6164D09BACA5D86844D126BF557410F15B442D43DD072A102F78BC02192F2ED734012BB1127DD09C0821115DECB6E6B3E0BB637423FEBE7069BA8BF275617
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&..........>E... ...`....... ....................................@..................................D..S....`............................................................................... ............... ..H............text...D%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................ E......H........A..d...........P ..2!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\pt\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.725154076738642
Encrypted:	false
SSDEEP:	192:9IY1nlNKGnxOu7xKgUOVBQ6Bo19sPzPLegs8+3vCqV/LMa/FVKYIS+9wOTKQiF4U:9rnlNKNu7xKgUOVBQ6Bo19sPTLM80ao5
MD5:	ABE4A7998F99C8BDD303BE6AB09DC20A
SHA1:	577A7FDC5DBBF1BC231C8665603F48C15E674EDD
SHA-256:	DC166EA7286C26BE2CCF0A44677F228B660BFB6D9DD4C78FE0409B08327536DF
SHA-512:	B28AB5F36736AEDCCE65099734813E3260D95908EF457F67AAB96089EC3D50E2FA0562EC1454E4E1320433B50847001909E28F27AE87C3A7CBE66ABC24A5FD75
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&..........>E... ...`....... ....................................@..................................D..W....`............................................................................... ............... ..H............text...D%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................ E......H........A..`...........P ..2!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\ro-RO\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.785865587531196
Encrypted:	false
SSDEEP:	192:kdIY4puUhG9oHusJxWgAm/45t6lSertHPHrgCs324VfosqPXMdEqljSNPEinIOBZ:CapuUhg7sJxWgAm/45t6lSertvHrDapG
MD5:	5F6E31693AFF46FBDBCA6AABC5ED7E40
SHA1:	D1460A56FD08C8EE10D6E4E470B72BB53D3955A8
SHA-256:	31AA8F7D10891DB8188A5FB8999EE0CB8564253D8C91A39EC432764011BF42C8
SHA-512:	CDBD5C9C488BF31C0C8F772819D41E36546F8CAA7E0AB75281DAF59C401A60629DF00F1D6C85FB396A6FC1610AD5C24F17D2436397688E348FB55C312428E7B8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&..........^E... ...`....... ....................................@..................................E..W....`............................................................................... ............... ..H............text...d%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................@E......H........A..d...........P ..O!..........................................K!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\ru-RU\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	4.949048788389918
Encrypted:	false
SSDEEP:	384:NZ2vdzqaLxW8w5/EtHjl+dbA5eI00QF7jiS58U:3aL88/sd0QF7jiS58U
MD5:	566A9E0CEEA6C3CBF82B05C4F8470C27
SHA1:	C24F42AE5FC9A326B6526557501EA98150409F85
SHA-256:	CFB04DD1A62A3C5FE6D9AE898DF507B7567ABEEE7C871FA9AAD1A0D2475968AD
SHA-512:	ABA8482414B1D98313D37C58C4D19D7D197A440601175C9E3F1AEC5D7A86C53A43A289F843A3EFF85C0FEE043334A25E9D215A54FD4CA3DFF6E8A786E6FE85C3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.................M... ...`....... ....................................@..................................L..O....`............................................................................... ............... ..H............text...$-... ...................... ..`.rsrc........`.......0..............@..@.reloc...............6..............@..B.................M......H.......hI..d...........P ...)...........................................).............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\ru\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.846136752240531
Encrypted:	false
SSDEEP:	192:phbWWNv/jzSEfthb7O9JKggIOrCPPzm394in3fwB/CZPlAg1O5rxg0XWr:pN1NvbH7O9JKgglrCPChnYVC5A5rxg06
MD5:	DADE13E423762BDAE745D57CA3DC86EF
SHA1:	7B4122CBEF771C5548A7CB5641B6DB6743C8C3F6
SHA-256:	1A1D5FDAC027144BCAA0E8110F4DE717E80944420C59708B3DD8E2BD31BC7ED4
SHA-512:	77F5050BA87E8ABEB92298D16897D6CEC087FFB7B4C38442C854A0993B398DE529C15B5674ADAACFB3E39CE05165F05A38337B2DBD41E8A7D806751542F6E8D3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!................~=... ...@....... ..............................>"....@.................................,=..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......(..............@..B................`=......H.......88............... ..e...P ......................................w..4.8b^b..W..i8s....oz...t..tlhp...$.8p..c....U(O'....N.w`...<".1.w....?.*.0=z`Lz5..^....O...Q.....v..z...........`;..a..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\sk-SK\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.89773663933091
Encrypted:	false
SSDEEP:	192:mIYK1uOKGEXJ7hxwUmX+41C/TUMZc/ZgPPInsYJNM3TPGdTzXpPbf+oBumIJMr2P:m41uOKl7hx9mX+41CLUMZc/ZOPVYJN6b
MD5:	EF403938F8FDBFB9638F378774F93D97
SHA1:	020AAD53FEB53DD763CA422CE47BC75F0A06F426
SHA-256:	EDA401DC462FAB09262874A61915D30F7721FA7F3FFCA7242461D978C54E76BA
SHA-512:	B40A0F1CC1C0C9A99FAFB1F96BF44DA543364DAB15A1BA4F564B9D3014C3031881E67700240BBD5DF280439901EE36A9345A32EC83DAED80203C115712820DB6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&..........nE... ...`....... ....................................@..................................E..O....`............................................................................... ............... ..H............text...t%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................PE......H........A..d...........P ..f!..........................................b!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\sl-SI\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.769946515681843
Encrypted:	false
SSDEEP:	192:NIYV7AGeXGfqyuMxUY+iZWBe2v3gW0dFgPaVCe1d3qTS3xH4q9OYtRwbHUWPsLZ4:NTAGeXyuMxUY+iZWBei3gW0dFOaEe3C5
MD5:	E3D94C18654B6E3A630A7932298E989D
SHA1:	A46151D16A43728FC905578B04C97A6034BEEC48
SHA-256:	4A6897E25BEA93BC47A166AE7C02CB2858C6399A9360F12E6EE56C4FE110B537
SHA-512:	DFCF6207F5D1EE1CA490ECE1CEFCC0B4C073A74D9E7AC0C1E865181173328421115BAB4530AF995DF2B04893C801D5F8D58B9867905FC1F59A6416E4CBFD5710
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........E... ...`....... ....................................@..................................D..S....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......TA..d...........P ...!........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\sl\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.767196344145025
Encrypted:	false
SSDEEP:	192:5IYV7AGeXGfqyuMxUY+iZWBe2v3gW0dFgPaVCe1d3qTS3xH4q9OYtRwbHUWPsLZA:5TAGeXyuMxUY+iZWBei3gW0dFOaEe3C5
MD5:	B84137A373B458BFDB8E37BF68DBC93B
SHA1:	C66FEC010EDA81A93608892749F6CA44E01828E9
SHA-256:	CC83EDEBF62A1C0F0698C97180AB13D96301C531C7270D4BDE4C43FA96129728
SHA-512:	5CEFD56822A084B7AC139A306640474FF82B106CA8088991FF58432867A405CE5091D11F465EBEA4EA1F30D102854FFA79424B0430E5BDA88FA9494FD8D23E00
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........E... ...`....... ....................................@..................................D..W....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......TA..`...........P ...!........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\sv-SE\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.726343979225638
Encrypted:	false
SSDEEP:	192:3tIYShuTiGMuLj/kyxI0Nc/yGUbwMgWf2iPMXBSSky3WDeFzMShGOBZ7T3GyRKvL:3tUhuTiGj/HxI0Nc/yGUbwMgWf2YMXQd
MD5:	F26F586F37F77C4040A1110CD09C1A04
SHA1:	9511A7124B27AB89BDCB25F4D373CC08C25E06BC
SHA-256:	0C709CC4E21D236600DCB400713D93940BB96BFCC3BE184ABC27EAA25C50853C
SHA-512:	F48821C805E4359CD6FE1571050248DBB6496040528ECCC313C1ACC67088B91E391C412023C37E2B2F1BFFB2704EC6D25982819FF6487298E4E17EBB1F43E18B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........D... ...`....... ....................................@..................................D..W....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......@A..d...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\th-TH\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16896
Entropy (8bit):	4.847206773739568
Encrypted:	false
SSDEEP:	384:HWmNyydz3LxBD5uSw84x/d/dfwJGTV/cEJviNhsFx55n5z5OPMuQ5m5rPzzSvooG:T7LHDFGh0EJviNhsFx55n5z5OPMuQ5mP
MD5:	912EF860F4ACB26AFA205A91956990D3
SHA1:	8DB790876785FE61D10F4E8E4D32722B5AD35679
SHA-256:	E49F80929F50C19E430352B21851F8359D7061B3EF4CDC9264BCC1BE3620B987
SHA-512:	0E89322265A7B8827302DD91DFF85E82DF7ED87FC8C1F04F2B13C23FFD8471A01CD52A172C008D0AA40288322C2F1EF2913A7039539EF5C9D9ED06F90B8D57CC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....8...........W... ...`....... ....................................@.................................@W..K....`............................................................................... ............... ..H............text....7... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B................pW......H........S..d...........P ...3...........................................3.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\tr-TR\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.883497823407382
Encrypted:	false
SSDEEP:	192:wIY4kciiGg/kISxvnmkYsPV+tIqMvhBhPYTua1j3SfDpu6WbyLWFTXLgNzCii7oM:wKkciiwISxvnmkYsPV+tIqMvhBZYquLt
MD5:	0082F8E3C82E3BEC8FA2EC9B8F62030A
SHA1:	BD9790D90D940DA82015B1A003DDDE0E6A814388
SHA-256:	8094AD142AB016533528ECCCEB49182D1AF3BF0BFD34DDD940F3714D7D17A145
SHA-512:	5B737D66475DC957E53A2F88CEABA78DB7D76BE7B5184B75D8516C5A97161131DDCD3130200BA0DF2C000F46658EC01A5CB2ED60A876266DB4BAC95986BD763B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........E... ...`....... ....................................@.................................dE..W....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H........B..d...........P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\vi-VN\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.077789016416725
Encrypted:	false
SSDEEP:	384:tTp4EAT1bY2bx1CxHdO35YFInizzX83tNeRFYMvF2Mr58N:CblbzC5jmtNeRN2y58N
MD5:	E224E6925C4274296BA7BEC71FF953A4
SHA1:	1BF409839D76EDB70B88426AC2C17106105EA3C9
SHA-256:	8CC2EAE4D338CC29846144136702F717E1379468A07919975FE6EEEB9007C558
SHA-512:	DAFABB12F383BD99CF0D1F1BD949CEE2F922C6CB03FFA51CD5583E45B2FF6B79C7B88B26CCD5E8DC0873388B7C61DE39DE968FC8E4A3E8B63C3B3D94711AC309
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!...............^I... ...`....... ....................................@..................................I..O....`............................................................................... ............... ..H............text...d)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B................@I......H........E..d...........P ..U%..........................................Q%.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.701646036890297
Encrypted:	false
SSDEEP:	192:HWWNv/jzSEhtiBbSEmfO2mdqeCtzEc6yCPVDA1L5rxg0XWr:H1NvbcbSEm22mdqet+wh25rxg0XWr
MD5:	3CEFEC17BAAC089C54C8102A4CFD160C
SHA1:	A54CD9BD4181A591937A99BE88BEB006279837DE
SHA-256:	AAFBE48966DBC5372A308AB9501245CE261D2715F336AD1908C799D354C981A2
SHA-512:	2D45193662C7CE2854CE2D3EE53AE199E094D09BC76D8D8A8E36B24EA60400A5F064CA16CE0078FE6CBDF4117C22565C04E47B99CD99868254C915DB6D18700F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................8... ...@....... ...................................@..................................8..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................8......H........3............... ......P ......................................%h...P...y.7....ON(..U.~vT]h.e9dfp*1...oDL..1.M..6.Ku...^5....RE.')f.$......{...mcc......E...g.l.Z.q..M..@._D.{...,...S....................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\zh-CN\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.080167063477581
Encrypted:	false
SSDEEP:	192:IIYXbXbaQGf0wwrCwYxzJSKqdy6eY5R6Q3Pyt7g0mY3IC1wx+bDqhbXpVuieenT1:IRbXbaQixwYxzJSKqdy6eY5Rt/A7c+hS
MD5:	93DDE9DE1910EC7C10CAF6A2A950E6E6
SHA1:	D9E977B3153676C2422374AD1D314046E1318806
SHA-256:	597FC5D537F33A564CDB2D467D2F588CA25954D6E758316D4911CA97C2A1A7CA
SHA-512:	300B6B873CF5C5487AD813D27823B4E899DA49342DB6F83FC0D23919A629AAAEC53334DAD63BEEBAD4D92372A76636F8069CF054D08C755A4C7CE76AA07C65D2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....$...........B... ...`....... ....................................@.................................XB..S....`............................................................................... ............... ..H............text...."... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B.................B......H........>..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\zh-Hant\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.728551774224484
Encrypted:	false
SSDEEP:	192:JWWNv/jzSEhtimYtEq40uI7Sr2fqmxkNeo7R7L7c7xM757odHK9nPol1f5rxg0Xq:J1NvbOtEq40uYSatEdHwWloA9Pk5rxgJ
MD5:	833F269BA6F0C34F49273DA7FBD7DCE7
SHA1:	D0253D322DCDF7F54E37C7E8911A8B77670D2967
SHA-256:	F8C769A357E6CD27452835E5288FE515FB50BFEEC83EF3969975171174B467E5
SHA-512:	4FA315E23D985AFFB46F6536CDF2DDC1B882F47098EE2D5A4B954DDEEB8904D1C83182B1598E4948A59728339945307B699A147ECD813C0F91986D95BDC57184
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................8... ...@....... ....................................@..................................8..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................8......H........3............... ......P ......................................gh....R.xns+....2..b]...c........W\|..C.....\*.~w.?.....%...M.}..K?.`.Y.0%U..........I.:f...p.EB.....]O]..4Sy'.D4N..................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\Translations\zh-TW\UnifiedStub.resources.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.067541414141853
Encrypted:	false
SSDEEP:	192:oIY26Y9TGjEWVWxzJS9gSKiLHQhcScP/yggS2w3tWGPO4JRy0ty6WGbdIY9MAFXx:ow6Y9TEVWxzJS9gSKiLwhcSSqgwmMGxp
MD5:	142024ABF19A89ED6DF37C56CE927361
SHA1:	B818199BB5D275F7E583D9E20F99CF7A393ED226
SHA-256:	9678E0D14BAC32C77BAAE8A4B697051E3ADE12B91278D7B01FDA00ED471167E4
SHA-512:	0FF2F4570F35DF7B44901E982D3D15FA1DA6D8D41EB6D98B8ECCB920A8345ACB5A2E89D400F6AC1DD0DF3DD0F70CD1FD4AD38DD4B613F7E72D07D49F7E045C33
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....$...........B... ...`....... ....................................@.................................8B..S....`............................................................................... ............... ..H............text...."... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B................pB......H........>..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1120648
Entropy (8bit):	6.282495231593689
Encrypted:	false
SSDEEP:	12288:nAIzN9/YaT6MIQtZM1A0+Nwhq3drYozTW0fbcIQTPFdWHJLKe:AIzNpG061A0ue8lYozK0fbNpNKe
MD5:	C7FE1EB6A82B9FFAAF8DCA0D86DEF7CA
SHA1:	3CD3D6592BBE9C06D51589E483CCE814BAB095EE
SHA-256:	61D225EEFB7D7AF3519A7E251217A7F803A07A6DDF42C278417C140B15D04B0B
SHA-512:	348A48B41C2978E48DDBEB8B46AD63EF7DDE805A5998F1730594899792462762A9EEE6E4FE474389923D6B995ECA6518C58563F9D1765087B7AC05CE2D91C096
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...`.L..........."...0......B........... ........@.. ....................................`.....................................O.......`?...............U..........$...8............................................ ............... ..H............text........ ...................... ..`.rsrc...`?.......@..................@..@.reloc..............................@..B.......................H........Y..................@............................................~.............0..`.......(....o....(....o....(....(.......r...p(....(....(....~.......(.........,..(......(........(.....0..............~....o......E............'...9.......o...........8....~....o....s,....~....o....s.....+h~....o....s.....+V~....o....s.....~....o....~....o....~....o ...s$....+ ~....o....s.....~....o....s.....~......o!.......0..........~....-..("...+....(#.....o$...-..o%.....(.....,.

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsAtom.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	160016
Entropy (8bit):	6.4048842736009
Encrypted:	false
SSDEEP:	3072:S6lrh8aWSI9uVDeMWoWVy5zmndQ1dTZjxO3S/9FVkmiGUV+fS:S6lrhISL9e1oWE56ndQ19aY9Fjs2S
MD5:	F5CF4F3E8DEDDC2BF3967B6BFF3E4499
SHA1:	0B236042602A645C5068F44F8FCBCC000C673BFE
SHA-256:	9D31024A76DCAD5E2B39810DFF530450EE5A1B3ECBC08C72523E6E7EA7365A0B
SHA-512:	48905A9FF4A2EC31A605030485925A8048E7B79AD3319391BC248F8F022813801D82EB2FF9900EBCB82812F16D89FDFF767EFA3D087303DF07C6C66D2DCB2473
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsAtom.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!..0..2...........P... ...`....@.. ...................................`.................................pP..K....`..T............<...5..........0P............................................... ............... ..H............text....0... ...2.................. ..`.rsrc...T....`.......4..............@..@.reloc...............:..............@..B.................P......H........i..(...........0....U...O.......................................(....(.................................0..............0..............0.....................0.....................2K........`.2........0.....................6F.......0..............0.....................MU.z.....0.............B(....(....(...................................................................................................0..............0.............*Ad..........

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsDatabase.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	170328
Entropy (8bit):	6.47551843695429
Encrypted:	false
SSDEEP:	3072:XR761d9cCg9+zhOzcx9R0KvvvvnPPH6Gi5tPArrYeiYiPKiF15fJ2K/Krrii555z:81TcpihOk0KvvvvnPPH6Gi5tPArrYeiG
MD5:	72689B177CD84AE5260532F5C7A10EBD
SHA1:	4129FBAB0F99F8420F25D772D2D62A26B1FADB3C
SHA-256:	062FD8045911EAAB4B5F505DADE6C0E23E6200C1AC1FDB86EA73E69AB801E037
SHA-512:	8649EB139AE3B695463210EA2E6061C35CD3580C0AD6A5D2D859835255DD6ACD334D791BFCC0D00D1B60573960C91C29009F3325EB8B37DACFBB7CEF401EC4EE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsDatabase.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................!..0..Z...........x... ........@.. ..............................$.....`..................................w..K.......\............d..X5...........w............................................... ............... ..H............text...$X... ...Z.................. ..`.rsrc...\............\..............@..@.reloc...............b..............@..B.................x......H.......\|l..`...............4k...w.......................................(....(....:+.(Nf%^.(......0.....................0..............0...................-....;.....0.....................VV.Q!....0.........................!....0.............AL......Z.......q...................j.......................................................................................................0.............A4.................Y...............s...........!....0..........

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsJSON.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	223016
Entropy (8bit):	6.7884547646820765
Encrypted:	false
SSDEEP:	3072:cBuq5tonhw9PY+fAKul0ZJXY9ooyJtTsbbiRl7m76m/GS+KKeA4dtrSsQDZ:VqDOhw9PY+4Zl0ZFY9ooyUbc3Kc4dtaF
MD5:	927934736C03A05209CB3DCC575DAF6A
SHA1:	A95562897311122BB451791D6E4749BF49D8275F
SHA-256:	589C228E22DAB9B848A9BD91292394E3BEF327D16B4C8FDD1CC37133EB7D2DA7
SHA-512:	12D4A116AEE39EB53A6BE1078D4F56F0EBD9D88B8777C7BD5C0A549AB5CFF1DB7F963914552EF0A68FF1096B1E1DC0F378F2D7E03FF97D2850CA6B766C4D6683
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsJSON.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....r.............!..0..&...........D... ...`....@.. ...............................B....`..................................D..K....`..D............0..(7..........cD............................................... ............... ..H............text....%... ...&.................. ..`.rsrc...D....`.......(..............@..@.reloc..............................@..B.................D......H........\|...............W..O....C.......................................(....(....:+.(..4g.(......0.............A...................:........0.............B(....(....(.........................................................................................................................................................................0..............0.....................0.....................0..............................0.............*....

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsLogger.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	181184
Entropy (8bit):	6.53382578985949
Encrypted:	false
SSDEEP:	3072:+0AqxqD7b0Qv6wIMCP1Yr+Xle9WQJTrz96JiBRqMadYMBpCA5LH3wjg:NRkD/0Q7IMCP3ePOUBRqKep5jZ
MD5:	F55948A2538A1AB3F6EDFEEFBA1A68AD
SHA1:	A0F4827983F1BF05DA9825007B922C9F4D0B2920
SHA-256:	DE487EDA80E7F3BCE9CD553BC2A766985E169C3A2CAE9E31730644B8A2A4AD26
SHA-512:	E9B52A9F90BAECB922C23DF9C6925B231827B8A953479E13F098D5E2C0DABD67263EEECED9A304A80B597010B863055F16196E0923922FEF2A63EB000CFF04C9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsLogger.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...ky.............!..0.................. ........@.. ....................................`.................................P...K.......P................5........................................................... ............... ..H............text........ ...................... ..`.rsrc...P...........................@..@.reloc..............................@..B........................H.......ds..............."...}...........................................(....(....:+.(...W.(\|...."...........0..............0..............0.................................................0..............0.....................0..............................0..............................0..............................0.....................00.......0..............................0.....................00.......0..............................0.............

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsStubLib.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	261232
Entropy (8bit):	6.520670838166452
Encrypted:	false
SSDEEP:	6144:L4TddrmwvYlpI+JxFKb708NFR75vp+uvewjLbqzm9iVkW:Ud8HI+DW75Hmwnlip
MD5:	FA4E3D9B299DA1ABC5F33F1FB00BFA4F
SHA1:	9919B46034B9EFF849AF8B34BC48AA39FB5B6386
SHA-256:	9631939542E366730A9284A63F1D0D5459C77EC0B3D94DE41196F719FC642A96
SHA-512:	D21CF55D6B537EF9882EACD737E153812C0990E6BDEA44F5352DFE0B1320E530F89F150662E88DB63BEDF7F691A11D89F432A3C32C8A14D1EB5FC99387420680
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....WG..........." ..0.................. ........... ....................... .......c....`.....................................O.......p...............p8..........4...8............................................ ............... ..H............text...X.... ...................... ..`.rsrc...p...........................@..@.reloc..............................@..B........................H.......l&..`............2..h.............................................{ .....{!...V.(".....} .....}!......0..A........u........4.,/(#....{ ....{ ...o$...,.(%....{!....{!...o&...... ..f. )UU.Z(#....{ ...o'...X )UU.Z(%....{!...o(...X...0..b........r...p......%..{ ......%q.........-.&.+.......o)....%..{!......%q.........-.&.+.......o)....(...*...0...........(....}4....("...........s+...o(.....}......}......}.......}.......}.......}.......}.......}.......}......(B....

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsSyncSvc.exe

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	814440
Entropy (8bit):	6.475738224302649
Encrypted:	false
SSDEEP:	12288:LkaJoYf9Z+uUMidkp22We0cRxoJy5DPbTtsqq5dlgM7qcNmP1bGq06ZIEUKth1OH:JJll87GY2q61llaOZBjKt5qq4i
MD5:	CC7167823D2D6D25E121FC437AE6A596
SHA1:	559C334CD3986879947653B7B37E139E0C3C6262
SHA-256:	6138D9EA038014B293DAC1C8FDE8C0D051C0435C72CD6E7DF08B2F095B27D916
SHA-512:	D4945C528E4687AF03B40C27F29B3CBF1A8D1DAF0EE7DE10CD0CB19288B7BC47FAE979E1462B3FA03692BF67DA51AB6FA562EB0E30B73E55828F3735BBFFFA48
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......lC. ("rs("rs("rscZqr""rscZwr."rscZvr;"rszWvr8"rszWqr""rszWwrv"rscZtr)"rscZsr?"rs("ss."rs.W{r "rs.W.s)"rs(".s)"rs.Wpr)"rsRich("rs........................PE..d...x6.d.........."......\...........(.........@.....................................q....`.................................................T........`..p.......xW..."..hK...p..........p...............................8............p...............................text....Z.......\.................. ..`.rdata...'...p...(...`..............@..@.data....F.......*..................@....pdata..xW.......X..................@..@_RDATA.......P......................@..@.rsrc...p....`......................@..@.reloc.......p......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsTime.dll

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	132112
Entropy (8bit):	6.108992422954668
Encrypted:	false
SSDEEP:	3072:SWGjyLgosGplJLT7AwoTFGmrY6sWGGHyj:SwgBGplJX7AHGm8UI
MD5:	167B304C9C615BE2852AC0BEF86E6F15
SHA1:	7C38A8AF0DE07B41D5E5AF771274B0D46B87B0E0
SHA-256:	6D5EA04F978E429C5CF0065A213BF28D8AF36540493C6564218EA51B0D5B961D
SHA-512:	557CF71B939D5F388E17B432DB5D2A15EDE76E6ABCF0476B985BBA0DE4FC22CB130A1A240FE92F41DE03B60E7EDBC9445BE2461079E28EBE985FF523B32EB456
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\7zS87E99B6F\rsTime.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.................!..0.................. ........@.. .......................@......0I....`.....................................K.......D................4... ......`................................................ ............... ..H............text........ ...................... ..`.rsrc...D...........................@..@.reloc....... ......................@..B........................H........Z...i...........................................................(@...(6....0............j.0....................j....0..................0..............0............j.0..............0............jB(@...(6...(......."..........".............l................."..................(@...(....:+.(r.S1.(6.....0..............0..............0..........(@...8].......E........G...R...8.... ....(....( ...o....(!........ .....9....&8....(R... ........8....(....

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\uninstall-dns.exe

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	269016
Entropy (8bit):	5.638348013030407
Encrypted:	false
SSDEEP:	3072:99jevmK0U7H/cF9P/V+FKDe/HfETJBLqw+foMCsbpM9NV:3FK0U7HkF9HVpe/HfASJCr9j
MD5:	772E66BF2ED9CA8F60C413576B9BFBA0
SHA1:	91A274E4B66966EB5D036835F8C99FFCD3E74F35
SHA-256:	C3A505A0BF9BB525DCFE981A5CB60D3B4DC4163F1A1179AA55DDB66E569CF2CB
SHA-512:	D3C5742FA5F0E663DF7809288B3159465323B9F8942EA684CAA1B98C912245C151E9F1C909129AB3EAFD5F6282B2B4C0BB983E929E945AA92EB6BC506CD19787
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[.L.5.L.5.L.5...6.I.5...0...5...1.F.5.L.5.M.5.M1.\.5.M6.].5.M0.`.5...3.M.5...4.I.5.L.4...5.N<.M.5.N..M.5.N7.M.5.RichL.5.........................PE..d.....Uf.........."....'.L.......... <.........@.............................0......p/....`.....................................................<....`.......0..d........8... ..........p...........................P...@............`..h............................text....J.......L.................. ..`.rdata.......`.......P..............@..@.data...h...........................@....pdata..d....0......................@..@_RDATA.......P......................@..@.rsrc........`......................@..@.reloc....... ......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\uninstall-epp.exe

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	332568
Entropy (8bit):	5.000961772420698
Encrypted:	false
SSDEEP:	3072:sbjak9Kn0bnccfHyeL+FRexTh6z6ryBLqB9fbUD6y9lvQzJLEX48:GdKn0bnfPjL1xTh6zub1QD3leLEI8
MD5:	8157D03D4CD74D7DF9F49555A04F4272
SHA1:	EAE3DAD1A3794C884FAE0D92B101F55393153F4E
SHA-256:	CDF775B4D83864B071DBCFEED6D5DA930A9F065919D195BB801B6FFAF9645B74
SHA-512:	64A764068810A49A8D3191BC534CD6D7031E636AE306D2204AF478B35D102012D8C7E502ED31AF88280689012DC8E6AFD3F7B2A1FE1E25DA6142388713B67FA7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[.L.5.L.5.L.5...6.I.5...0...5...1.F.5.L.5.M.5.M1.\.5.M6.].5.M0.`.5...3.M.5...4.I.5.L.4...5.N<.M.5.N..M.5.N7.M.5.RichL.5.........................PE..d.....Uf.........."....'.L...........<.........@.............................0.......[....`.....................................................<....`......0..d........;... ..........p...........................P...@............`..h............................text...`J.......L.................. ..`.rdata.......`.......P..............@..@.data...h...........................@....pdata..d....0......................@..@_RDATA.......P......................@..@.rsrc.......`......................@..@.reloc....... ......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS87E99B6F\uninstall-vpn.exe

Download File

Process:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	201880
Entropy (8bit):	6.4046209284871525
Encrypted:	false
SSDEEP:	3072:O9jevmK0U7H/cF9P/V+FKDe/HfETJBLqU+foMCdEiBhGo:eFK0U7HkF9HVpe/HfA6JCdEid
MD5:	410D4E81BE560D860339E12AC63ACB68
SHA1:	06A9F74874C76EBA0110CDD720DD1E66AA9C271A
SHA-256:	E4A8D1E07F851BE8070DD9B74255E9DD8B49262C338BFB6EF1537EDD8F088498
SHA-512:	4BBFFEEF276CE9B8FDD6D767BA00066309EEE0F65E49CEA999D48D1E8688C73D7011ED1301A668C69814457CAAD3981167A1E3FE2021329DD8FC05659103FB3A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[.L.5.L.5.L.5...6.I.5...0...5...1.F.5.L.5.M.5.M1.\.5.M6.].5.M0.`.5...3.M.5...4.I.5.L.4...5.N<.M.5.N..M.5.N7.M.5.RichL.5.........................PE..d.....Uf.........."....'.L.......... <.........@.............................0............`.....................................................<....`......0..d........6... ..........p...........................P...@............`..h............................text....J.......L.................. ..`.rdata.......`.......P..............@..@.data...h...........................@....pdata..d....0......................@..@_RDATA.......P......................@..@.rsrc.......`......................@..@.reloc....... ......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\ArchiveUtilityx64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	158512
Entropy (8bit):	6.366328902517048
Encrypted:	false
SSDEEP:	3072:ixAyrpDDw+Quvmsd3xsVjxlppyYlDB5sqnjJHSGzj2:aAWDUuvmsd3GnjpyYlt5pa
MD5:	C70238BD9FB1A0B38F50A30BE7623EB7
SHA1:	17B1452D783ED9FAE8FF00F1290498C397810D45
SHA-256:	88FB2446D4EAC42A41036354006AFADFCA5ACD38A0811110F7337DC5EC434884
SHA-512:	DD77E5C5CF0BF76BA480EB4682C965D0030171A7B7A165A6D1C3BA49895BC13388D17DDBB0FE3AC5D47B3D7D8110942C0D5B40E2FE3DF0A022E051696EC4FEB6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m...)...)...)...b...,...b.......b...#...)...(...............'.......8...b......)...t...C.9.......+.......(.....g.(.......(...Rich)...........PE..d...B.Uf.........." ...'.d................................................................`.............................................T.......(............`.......6..05......P.......p...........................@...@...............`............................text...pc.......d.................. ..`.rdata..............h..............@..@.data...p<... ......................@....pdata.......`......................@..@_RDATA.............................@..@.rsrc................,..............@..@.reloc..P...........................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Microsoft.Win32.TaskScheduler.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	349024
Entropy (8bit):	6.20930916625922
Encrypted:	false
SSDEEP:	3072:n1sSJApTSnQU/x0ImhuDzHfs4zbYOjujDRfygDgKQINXLLHIaKlay8weCycJ5DfT:n1sSmRIt/xhtsOju1DH5NXnIKAci
MD5:	87D7FB0770406BC9B4DC292FA9E1E116
SHA1:	6C2D9D5E290DF29CF4D95A4564DA541489A92511
SHA-256:	AAEB1EACBDAEB5425FD4B5C28CE2FD3714F065756664FA9F812AFDC367FBBB46
SHA-512:	25F7C875899C1F0B67F1ECEE82FE436B54C9A615F3E26A6BEC6233EB37F27CA09AE5CE7CF3DF9C3902207E1D5DDD394BE21A7B20608ADB0F730128BE978BEC9B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._O............" ..0..............-... ...@....... ....................................`.................................0-..O....@..................`;...`......(,..T............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................d-......H............V..........`...H....+........................................{......{....V.(......}......}.......0..A........u2.......4.,/(.....{.....{....o....,.(.....{.....{....o....... ..<. )UU.Z(.....{....o....X )UU.Z(.....{....o....X...0..b........r...p......%..{.......%q5....5...-.&.+...5...o.....%..{.......%q6....6...-.&.+...6...o.....(......{......{......{....r.(......}......}......}......0..Y........u7.......L.,G(.....{.....{....o....,/(.....{.....{....o....

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\System.Data.SQLite.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	370744
Entropy (8bit):	6.1104091244570675
Encrypted:	false
SSDEEP:	6144:VruNWxFaLx73+nRo2GGmZ2CRGpAM3JUGuT5up6zOPLyU0SJFNFaFeFOFwcGF6cmt:INWx6xz+nRo2GGWHQZMaLyJSJFNFaFeo
MD5:	FFBB71041C9A01DA9EA90BDD4C0096A2
SHA1:	D4E9E5B70B356489F1C6EEFCCD58B343F9D79E44
SHA-256:	178570575291B95C767BA304D71C5310A94E93B6C1F673B9179D41A75A48D0E8
SHA-512:	AE7926C6CE85464B66FD73C1FE046F51DEE1739DD7476C8FBAC39D8479E7F8CB891C216DDBB160E5CECF828EFDEB2BF1C10A630BA57ADCF302AA7A2D83CC9728
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.].........." ..0..b..........j.... ........... ..............................Fr....`.....................................O.......$............l..8<...........~............................................... ............... ..H............text....a... ...b.................. ..`.rsrc...$............d..............@..@.reloc...............j..............@..B................L.......H...............................`~......................................:.(:.....}......{....:.(:.....}......{.......0...........~;...}.....r...p}........(......~;...(<...,r.....s....}.......}............{............%......(=....%...:....%...!....%...%.........%....%.........s....(....z.{....,......(=...o>...s?...z..0..'........{....-..(......o........(A.....}.....*..................0..T........{....,K.{....o@....+...(A......(B.....,..o;.....(C...-...........oD.....{..

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\System.ValueTuple.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	75800
Entropy (8bit):	6.026203256069962
Encrypted:	false
SSDEEP:	1536:r784YWau8lqubx6WxXLA+o2SLFyEdux136ytgHo0AuresehSAA7sxR:r7NV8v36tI0XCKAAy
MD5:	F34410B23B973CE915C40345C96DD82D
SHA1:	57B1D2DD6600CBCC64062549A925A4548CF9A47C
SHA-256:	E461CD2F7700FD28A3869D7C65F805058E0C30D44D9BCAF390ADF1896548B0D3
SHA-512:	CAE7D1CDFC68CE705D6292BE1A60C074F1E5B56E58D1558C958FC1022465626669D38CDE891152247C8877985C63A4806A4F0F82664E40F3AE173BF2B1280702
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>.Z.........." ..0.................. ... ....... .......................`......$.....@.....................................O.... ..P................2...@......x................................................ ............... ..H............text........ ...................... ..`.rsrc...P.... ......................@..@.reloc.......@......................@..B........................H......................................................................6..o.........f..o...........o............o...........o...........o............o...........o ..........o!...........o"...........o#..........o$..........o%...........o&...........o'............0..L.........o(..........o)..........o...........o+...........o,...........o-.........0..Y.........o...........o/..........o0...........o1...........o2...........o3...........o4.... .......0..k.........o5....

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\cs-CZ\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.881485510441517
Encrypted:	false
SSDEEP:	192:LIY1pQ8vGO4xToxMi5eX2zUA8rYgLIgPrEyz23tMuuVWJkYUECd1Vl7Iru+M3YV+:L3pQ8vQToxMi5emzUA8rYgLIOrnz8uu0
MD5:	999C5174344E3AF9CCD1E17299448E76
SHA1:	B66455DEB863B0A928D4E55ACD886E3C16506DE6
SHA-256:	0748A7D73F44ACDC027ABF5177DA04DD69D773299138EA0B25D3DBE4C00AD4A0
SHA-512:	E4F0C9C443070BBE348BA142FFB28631D4B86CA9D4DC1AA18E0711650CF063F590E2383A54C693ECA4CBA57EEC946BB5DFD2FFEA45820682D2C49DBC3ACFF612
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&..........NE... ...`....... ....................................@..................................E..K....`............................................................................... ............... ..H............text...T%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................0E......H........A..d...........P ..J!..........................................F!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\da-DK\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.746338816012684
Encrypted:	false
SSDEEP:	192:IIYRN3EsGGj3fvKEx8rUrb+M0lIVixNPqDGomU3WUeQoXjAUwMXrAfeMA7AWmBHt:IXN3EsVfvVx8rUrb+M0lIVixNqiomyJZ
MD5:	C2819AE6DB238F0D9FDD865347819A40
SHA1:	35F19D2AEC295FD7F98CE039DA95A0A556517B2B
SHA-256:	DA090057B5388EF09CA5F6E72C729F0330FC3CC0352E2EE704982E979DC4E1F1
SHA-512:	FD015CE397D556A669B1D83CFE82400998B7484A1F50D8683AF80EDC1533784196DF9092EDB4F6E727C45DF8B8430745DED57F154833626CEE7C778883074385
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&..........>E... ...`....... ....................................@..................................D..K....`............................................................................... ............... ..H............text...D%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................ E......H........A..d...........P ..<!..........................................8!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\de-DE\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.758461459269092
Encrypted:	false
SSDEEP:	384:l5rayxOPAxMtzTxCmf6hC/s2TvOFk6AOPh3+yFdmyndC58i:2PAKtnHOdvPhO2dmyndC58i
MD5:	63DB7F10882D9A963496A27CE65A6F35
SHA1:	DED19C471C9139479F25FB5B5B42C48163491763
SHA-256:	50A5AF3023A6BE366350730D9962DA94DACA926CFB5F9C5C3EF04C5AB5A06103
SHA-512:	04E7A081CC7814C93E10A7D21768F864026B2DF6FB58D3D67CDBE8D643B7497B6FBFC2064A75F8CA8C6147E12A04A9CE2E9E492CE7906EE0EDA6E71A2690D51F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....(...........F... ...`....... ....................................@..................................F..S....`............................................................................... ............... ..H............text....&... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B.................F......H.......4C..d...........P ..."...........................................".............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\de\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.557060180794725
Encrypted:	false
SSDEEP:	192:0MiWWNv/jzSENtqcadVl8PandjJUf7ZJSqSi/ufP/1S5rxg0XWr:0D1Nvb5adVl8P2djJMZJSGu3A5rxg0Xq
MD5:	F83D720B236576C7D1F9F55D3BB988F9
SHA1:	105A4993E92646B5DBB50518187ABE07CA473276
SHA-256:	6909A1C134D0285FBA2422A40EA0E65C1F0CA3C3EF2B94A1166015AF2A87780F
SHA-512:	FD8A464F2BC9D5B6C2EFA80348C3A9362F7473D4D632B2ADDAD8C272E8874E7E67C15B99B67E6515906B86D01D57CD42F9F0F1E9251C0AF93A9391CCC30E3202
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................9... ...@....... ..............................-E....@..................................9..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................9......H........4............... ......P .......................................z..).........*SE.1r.2K58\p.`1....SJ..G.f0d.W.oQY....&1+E..z..:@.n@........S.XEp=C... T.q.l....S.Kg....%..l..._...0..'.+................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\el-GR\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	4.982978904707212
Encrypted:	false
SSDEEP:	384:EnpUcW/WJsxvxwKW9iu6Wxtp701zA27r+PMvozT958I:yJs5xEGzfOPMvMx58I
MD5:	765162C01B6A1D4B1EF68832658F4EDA
SHA1:	0054503A01721F374796199F2202F308BAF0B280
SHA-256:	0EF2B0E94D98919186598312218A6BDF5E5C58D7BBA15E85C08CC64454081970
SHA-512:	6CEE1EE72E0AF4246EF6DF458CF68EA66C3987F915FBA642610C00D1C7CF3F23596471B9176ADAEFDF61E7891462665588056DF0A51835130965B148246237C1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....2...........P... ...`....... ....................................@..................................P..O....`............................................................................... ............... ..H............text....1... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B.................P......H.......HM..d...........P ...,...........................................,.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\es-ES\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.713044834675741
Encrypted:	false
SSDEEP:	192:cIYVmGe/VGuDqni6wxCjfp3DocEs5dMvGPcDonP33TewxlhiYwEHU4dIyrokBD7F:cuGe/V0ni6wxCjfpzocEs5dMvkcDqPD7
MD5:	648AD011C505A34A9A756209FF749753
SHA1:	4325FBB69E9BE4B38DE9BFC81F91CC851FB16145
SHA-256:	0CA79AE16990C66CE642475AE2C48EDD9C7D93D1CA361A84FF67B046E3DB1272
SHA-512:	980C68CB78807190911CED7F013FAAB3036C39BA1CB45EB41AEE9010C048E2F149303E881D7AE6C8A7494D51E5760A6ED0039B0E13502E28EE4B76CBEFA2C52A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........E... ...`....... ....................................@..................................D..S....`............................................................................... ............... ..H............text...$%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H.......dA..d...........P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\es\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.425694157692337
Encrypted:	false
SSDEEP:	192:r0WWNv/jzSEStoC1vxx6hUltfxx+BE00cUnAP9115rxg0XWr:r01NvbGVxx6hUltfxgE00cLF5rxg0XWr
MD5:	15DB634B70D6D9D6CD41BAAE3F02EB14
SHA1:	1456FFE09DF896271A746F9CB40A230F188AD397
SHA-256:	E893C6907DA8D68C03B1A10E68B554AD5A8C0533F15912106F32E925F2BEABF0
SHA-512:	1230E5368D4DAB9776D57056993669327E95FE72E262EFA541ED5D43ABC1BCD3618DB13B6BD6B3A27DA053C103E3FB647EAE759CCAEB443F7D9FFD1ECAA1122B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!................n:... ...@....... ..............................pi....@................................. :..K....@.......................`....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B................P:......H.......,5............... ..\...P .......................................2M.. ,.,]...).].....@.l..~.u.....Oz.B.{~*;.......6\..s..$_BZS.b..x.S....-..g.......Jr...{...E..F...s..sa.p.eS....X..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\fi-FI\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.7226745243816906
Encrypted:	false
SSDEEP:	192:K9IYXkNcDGwgTsxJoRxAM2+9Ul/laxRe+PE8v+GA3kr29zrJzfPWCiqxskBbHUi6:K9RkNcDtxJMxAM2+9Ul/laxRe8ZGGWgL
MD5:	2D4061061AF403D74AF69EEC9DFE6BA3
SHA1:	ED9F6F00A4F2ADA56485294E6BE527BB155EDF9E
SHA-256:	3F3D9DD8A18721304CB4BBE992BA0F4F5429A848B1B07FCA1919223DEE35161C
SHA-512:	2CE44FA04FEF89295AB0729C2A6EAA03818D77F14E700700CD6C54BA25ED3F07793F575CB88C9332AD65D46E8124D81453035D4C097034529FAD43DB3AFD1F93
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........D... ...`....... ....................................@..................................D..W....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......@A..d...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\fil-PH\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.3998629103661635
Encrypted:	false
SSDEEP:	192:b0Zne9hwoGBjeCipxwU6LOl+DDUbqN4PPjjDr8d30LfmJyXOhZCa2m5sml+T9lmP:b0Y9hwoEipxwU6LOl+DDUbqN4Xjz8V4e
MD5:	119609E491507BF1AC03571959DFB46F
SHA1:	5BFA87B946F8EA2559DD3039EDAAB1F710EB7C67
SHA-256:	68B32C96F048BE6FDF16050A5D5C073E2F9C5B76A4305CFD0E0A7AC9A45E6726
SHA-512:	3DAF79B9C30BC7A64FA388B35C750951874ED114697AD9A9F4E8AB733BACC71770983A007C837989526F1F45A2D60D87A58E395E27864FD16BB545110519937F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!..... ...........>... ...@....... ....................................@..................................=..K....@.......................`....................................................... ............... ..H............text...4.... ... .................. ..`.rsrc........@......."..............@..@.reloc.......`.......(..............@..B.................>......H.......x:..h...........P ..'...........................................#..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....Q.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..]....b..`............)...s..%'..JA*......>.$.\.&...'

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\fr-FR\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.837603709696788
Encrypted:	false
SSDEEP:	384:oY0al1sBIxgyFzjXZfu14MpXrOUDlK8yXahGY7uXR58b:2BImyDM5DtyXwGY7uXR58b
MD5:	49308946ADC1C1565024EAB211D2A703
SHA1:	F0004DC3E436FEE811A79618D6029DB0497D4A42
SHA-256:	82C2F6F6A3F4870F8486EFB70BEBC6BA085838A051BD465AC2C638079C14B891
SHA-512:	7A17AFB06AB0D036C0D80D3326695F17E52C8365C4B7F86FA668F090CA5A4416B4881C2110D075C22F650CDE6B8D04135669B886AEBEB030DA9ABA74B796CFCF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....(...........G... ...`....... ....................................@.................................\G..O....`............................................................................... ............... ..H............text....'... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B.................G......H........C..d...........P ...#...........................................#.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\fr\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.588569516197988
Encrypted:	false
SSDEEP:	192:YWWNv/jzSEYtPpmKJiDjgmlRFI0HYZDKz/VP81g5rxg0XWr:Y1NvbdKJiDjgmlRi0HYZDMp5rxg0XWr
MD5:	3B4621370ADDCF4306669C9E7E45C865
SHA1:	EA1AB3C499E946E152C1FC4A63FA99E1F9BE94B4
SHA-256:	E3EE50E08124A7603BE7D996DCF596EB0D3F9C603768E86E003F7B942D7097F3
SHA-512:	586755F32D16AFD937BFC1FE3C52210AB815D5D4C904DE101150FA052A94BABFCBDC465669FF8C2537B782474658D7912037DDB76D8C9A8FD34715D1FE7B2857
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!................^;... ...@....... ..............................1.....@..................................;..W....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B................@;......H........6............... ..?...P .......................................ME....P.<......I.J...Q'D........................X7..'<F..q..o.6G..M-.$.v..i.>...z..'....OV?....+.9..V........I"..9........;..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\hi-IN\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17408
Entropy (8bit):	4.802138576816784
Encrypted:	false
SSDEEP:	384:lIE5h/2kXJsxw5w2UW4ctvHU+Th60iu2F6mKVZnCyJT2ox8mn9THjI5gE2ac7D5P:lXJsO57hOt9AZnttxKqN58Q
MD5:	A9854641A26F4C67F43C62808AE321AE
SHA1:	A89D6B3ABED21270B6311161D4118AA26D82A69F
SHA-256:	B91AAE7B8D476828108FCF99E4348EC533A7FCD2654F630B3B6255FEF2B32DA8
SHA-512:	E8291B1BE4F00CB41857CB5CA83D617369E9AF1AA58829A85D6A696C78E5CFA1B0B0CC5CB1041961A05B85C512CE7E2F15978DC62032ECA6899B9664472C0881
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....:...........X... ...`....... ....................................@.................................lX..O....`............................................................................... ............... ..H............text....8... ...:.................. ..`.rsrc........`.......<..............@..@.reloc...............B..............@..B.................X......H........U..d...........P ...4...........................................4.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\hr-HR\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.744554675762649
Encrypted:	false
SSDEEP:	192:+IYVdDpBwGpkiVlZPxZlrPy2o92kGetEQyPIlUVKC3JDsS7qSmKV/4jNni67gXWu:+1DpBwSkoZPxZlrPY92kGetEQII2oANn
MD5:	4D275EF7CE5F02C9C92F2D10A90B78CD
SHA1:	319785221773DDBAFFBBE29A9B04DAF37C517BD5
SHA-256:	A3B7D4A8462021F7DD05DD15273FB41EEBEAA566BE106CD71C9B8A28A03DFD8B
SHA-512:	45800341E338301FF27F6D6F1EEA52E12941883B3FFA45CA96DD76FFB9BCCB5AF8138C724ED078846F9AD5370FF2B5C1D9C5F584B5D121115C4257F6889C34D1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........D... ...`....... ....................................@.................................\|D..O....`............................................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H........A..d...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\hu-HU\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.7989297090684016
Encrypted:	false
SSDEEP:	384:adpTgTI4gNxtBqu+p5DXv00jiOKQosgcekILk0pltfN58x:q4gNrBnOVlgcekILfpltV58x
MD5:	ADF094F101CA6B84BB7E2296EABCB05D
SHA1:	1C6F38FCF1E072865118803DF5C7F356456D23EB
SHA-256:	85241CD496E646DB4EB9DF9C8808CBD1384964F61B7CB4FEDB1B812FC913E9F0
SHA-512:	89249C151395AB1D2E698221553634D1FB39B48A667A46139B4CCE5B890B6B1C66F646D0229A31699949F07336042C9A5604A10C0B51246091825CC01700D5E9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....(...........F... ...`....... ....................................@..................................E..W....`............................................................................... ............... ..H............text...$&... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B.................F......H.......`B..d...........P ..."...........................................".............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\id-ID\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.680086159864234
Encrypted:	false
SSDEEP:	192:LqIYIZcKqG4ny8ZxSWuwCoBWidWjZdPAhDHPBg37eXCIKKXgXruQm8X0tF8HgGCe:LqOZcKqG8ZxSWuwCoBWidWjZ9AhLJ2SI
MD5:	6863EB1B4658AC9D04729CCE4E70480A
SHA1:	E0731B472F8D535AFF29BE240659D601BAECFB3C
SHA-256:	80E43D515959F4F7EE8138C74FB5BCF1F3DD7BCB19666760812C5BC46AF94B98
SHA-512:	D84EC0BFC778AB0D3F066129EB2BBA4E13A60C1E7B66994F1087790AC9DA635DA0C7F506FE92C6E46A76756686566AEB83EB81899C5FBFE23503632B5B076673
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........D... ...`....... ....................................@..................................D..O....`............................................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......(A..d...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\it-IT\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.768378931838588
Encrypted:	false
SSDEEP:	192:nIYr9kupX/Gdq8SQxZdNYobyRXvujVf9UgPw/ev3nww3OajMRD1TLIjB5leULIp5:n3kupX/GSQxZdNYBRXvujVf9UOwGvwwy
MD5:	9D5CEBB0C561E0DA0BCE75E527465BC9
SHA1:	2851D4995D9E9A37A0C1404C8E215B204871204E
SHA-256:	35BD747676E8512899D56A80276CA1835E6FCB17B309F80E709860363DFAA52F
SHA-512:	0A276428145E9B42E88757D8D1BA5C20A54AD7E1A287F9A9BFACCEB319901822D17C0D28DD96895B752A14867B19E2907E49E5968B77A8114A1D41C2F431BB0A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........E... ...`....... ....................................@..................................E..S....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H.......4B..d...........P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\it\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.368637490829895
Encrypted:	false
SSDEEP:	192:vOiWWNv/jzSE5tyT1TNgr1nJIhZAf/07mPD1q5rxg0XWr:v11NvbGTNgr1nJI3+07MM5rxg0XWr
MD5:	1C331DA4BCE2809E16913C02E385576E
SHA1:	CF8E71E030347749596A53D1B13B9E9583EC0527
SHA-256:	1D0493E38D8B3FCC7EFA4916FEA1EEA69EE6449BF435E1869C1BC3F54D4090C5
SHA-512:	2871119690F3DF0F244384A3F5F65FFE7CF17F1F00F6B530512AEDEB8397C9E357079E8FBA76D2A5BF6BE4E2B18E4AC1AC104EA2D29F8F40CEF6F30A905ECF83
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................9... ...@....... ..............................GR....@..................................9..W....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B.................9......H........4............... ......P ........................................M..+..u.3...i.7.[H\G.4D..dy.*p..L.m..4.....d..dZ...m..f../.@..GXQ.. ...$..."a......-....4..pS.5`@...;.`....Q..mHBx3..w3,!................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\ja-JP\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.087780030270019
Encrypted:	false
SSDEEP:	384:WxwAHD6CkxQdCnvRl/oRHx8asale681v/e589:ZCkSdK0t81vW589
MD5:	E77665402F7750BFA2B38018E5CA72DA
SHA1:	F3974F0F8F7E2FB60B41B77F08D226FC8787C324
SHA-256:	BC57C5F54A2CFD2212504E19D84C2E5FACF29D940B8631538CE82207244C8BB6
SHA-512:	59682D579A6458902E7208CAE06492081A8233C2D2A383D65C2EF5A40D4DC36211D14005B684587AFF08E8B32DD83FD81C3C454441DD905F94AE967A65B08844
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....,...........J... ...`....... ....................................@..................................I..O....`............................................................................... ............... ..H............text...$... ...,.................. ..`.rsrc........`......................@..@.reloc...............4..............@..B.................J......H.......hF..d...........P ...&...........................................&.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\ko-KR\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	5.202416131377818
Encrypted:	false
SSDEEP:	384:DFWuuyUdKvx4W9SxBmJsEMGFW/uuH2LlLTDUCl9w5JHJ8/uDP58z:WdKv+WqV2ZLToU9wXi/ub58z
MD5:	6935598916AF67879EA1BFB9E1D1FC50
SHA1:	54EE67CB95C349F5286CF5E9B2E5C0B7E01E1875
SHA-256:	C4E8DBD22A2BC4DB1844B75E600DFB8810EC1BD79AE9244E9BF95D6CD07BA593
SHA-512:	CFBF6C99640064C04D57E7F01F44EC378DBEBB42193B375080B2BD6E413111B1AD5D3CDA30E40A7CD2C0D5E0668372ADE5A9B71DE825DC0F337D9D9C2CD732C0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....(..........NG... ...`....... ....................................@..................................F..W....`............................................................................... ............... ..H............text...T'... ...(.................. ..`.rsrc........`.....................@..@.reloc...............0..............@..B................0G......H........C..d...........P ..=#..........................................9#.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\nb-NO\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.693180822922721
Encrypted:	false
SSDEEP:	192:WIYfsK6eGOy+v3qxh7EFBYn1p4hVYTPMPhT9CEGF3aN3MfCExO4MV09J7wcLaaEc:WZsK6epv3qxh7EFBYn1p4hVYTqhTAEGV
MD5:	58AFB3AE460111832F87628A55578CD1
SHA1:	9E43CE2918E003B67B80C7A2ABD314D8C489BC35
SHA-256:	0EAC601A33C74E373EEA3B72C6826E9512154852D9EDA174F5959EB8551DEDC4
SHA-512:	9F95FA0EB3AE3E2400A1A399D2821F6BC40D065C1E182304DB67B55E03D934A54153524D67D73FB5302781A988A7A87EAA23040C44C598298E078239C3EA938B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........D... ...`....... ....................................@.................................dD..W....`............................................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H........A..d...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\nl-NL\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.73364372569939
Encrypted:	false
SSDEEP:	192:etIYBN1XfOGCvouQTxklOVw/lzyOl/dEf80gPCdmP347U9DC47aqFD37E/avkeZu:CTN1X2HQTxklOVylzyOl/dEf80OCQPAn
MD5:	3F2522D425B3CC674925C117F5EB7984
SHA1:	E43D21EBD065BB42C0D66FD09E741F3FE75D04A4
SHA-256:	0F2D18D4EA34E514BC0865EE2C4DB488E44AB96A6F60D8666FA1CBAA50F83BA0
SHA-512:	DBF57878A763147E2312BADC78B3FE3A35D9F06F03681B071C5D3DFD84EEFCCF8877693D591C63A8D92628B1CDD59A8C30489D2094E9F59BFFDFA9920721FA2A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&..........nE... ...`....... ....................................@................................. E..K....`............................................................................... ............... ..H............text...t%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................PE......H........A..d...........P ..i!..........................................e!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\pl-PL\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.8003614094777545
Encrypted:	false
SSDEEP:	192:aIYfp3DcrGr6SHAOzLxE6oMuN50rtbxn/XidPWd3SJC30Gh58xSoHR+hxWfbrVsu:aZp3Dcr2NAcLxE6oMy50rtbxn/Xi9Wdq
MD5:	046D8A330F45EFDE3EB3F83F446663DE
SHA1:	DAC7E590C64A39332FD6527CDD21B194257234D6
SHA-256:	1332F9D4F4189C94E25B7755D8BDB779C4C016229B93C10D8CFA978B1B41A6B4
SHA-512:	BCF70C1B1751D5DBFF1A6A97C07B04749603DB246EC40B3658F1E673BE4C80D1FFAAE1E3A8A70A1C949494B12531237FEF1EBB647EF7B2DF1C617F458A56CAA6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........D... ...`....... ....................................@..................................D..K....`............................................................................... ............... ..H............text....$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H........A..d...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\pl\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.594776627495051
Encrypted:	false
SSDEEP:	192:haWWNv/jzSEYtq2dE1cxy8ON0Qsk96sPb1V5rxg0XWr:g1NvbaG1cxy8ONHskdD5rxg0XWr
MD5:	B60817A69E314B22F746917C826DA53E
SHA1:	7D2785A6D1A53A0717C986B959AF67DE6F9300E4
SHA-256:	6E58D86C42B61226DD7AF35D7C9432CE6F0982D1D0D5A2F4120E8ABC5C787A02
SHA-512:	9A8F029329CE105B3F72FEE623E3AB8C88E1AF45F86FAB61F81BE418B2D70F83E4C0466010D312240A01E1EF8F9B9926EBF43E25BDC3C364C2D28AB9B0E5F6FC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................;... ...@....... ............................../c....@..................................:..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......&..............@..B.................:......H........5............... ......P .......................................T`.K.%...N.f..u.........Z..1....#CTR.v....:aq.i#:Z.oAkQ:D...q.6...l....J.W.Pn.J......d........3.F..[.c....#....$.F..0...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\pt-BR\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.717379118116406
Encrypted:	false
SSDEEP:	192:NIY1nlNKGnxGxIDx+sQ0Y4EQujHOVhPgdfBF3UTVV/Lea/FVgYISK+uZqiF4Afk5:NrnlNK/xIDx+sQ0Y4EQujHOVZgdBtofn
MD5:	81F5B0997E189FEC285ACD3443FD109B
SHA1:	0306EC1169E196997BF196EC985105EF1464A2C9
SHA-256:	0F4397AD0FA9627DF4B50BAEB213EDB790AAEDFC1862708B8D4D401620C6D47F
SHA-512:	156F7082E24FB87765F83859834DA4027AB473821B7E39C92E206D0F1DF827EA17F243A913C5FFC890ECB7506BA4A7E28986272A988A38D05619C7034B329ADB
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........E... ...`....... ....................................@..................................D..S....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......TA..d...........P ...!........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\pt-PT\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.728117001174555
Encrypted:	false
SSDEEP:	192:xIY1nlNKGnxOu7xKgUOVBQ6Bo19sPzPLegs8+3vCqV/LMa/FVKYIS+9wOTKQiF4I:xrnlNKNu7xKgUOVBQ6Bo19sPTLM80aol
MD5:	2955126EC370BB65EE76E53DCF1FBCDC
SHA1:	CFFCC8D9D2414863FD45DA41F03030878A7F8769
SHA-256:	A5FE29467CFE179EFA29C1A4C1DC39247517150E734ACB20AB29C3FF817CCD3B
SHA-512:	56F6164D09BACA5D86844D126BF557410F15B442D43DD072A102F78BC02192F2ED734012BB1127DD09C0821115DECB6E6B3E0BB637423FEBE7069BA8BF275617
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&..........>E... ...`....... ....................................@..................................D..S....`............................................................................... ............... ..H............text...D%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................ E......H........A..d...........P ..2!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\pt\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.725154076738642
Encrypted:	false
SSDEEP:	192:9IY1nlNKGnxOu7xKgUOVBQ6Bo19sPzPLegs8+3vCqV/LMa/FVKYIS+9wOTKQiF4U:9rnlNKNu7xKgUOVBQ6Bo19sPTLM80ao5
MD5:	ABE4A7998F99C8BDD303BE6AB09DC20A
SHA1:	577A7FDC5DBBF1BC231C8665603F48C15E674EDD
SHA-256:	DC166EA7286C26BE2CCF0A44677F228B660BFB6D9DD4C78FE0409B08327536DF
SHA-512:	B28AB5F36736AEDCCE65099734813E3260D95908EF457F67AAB96089EC3D50E2FA0562EC1454E4E1320433B50847001909E28F27AE87C3A7CBE66ABC24A5FD75
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&..........>E... ...`....... ....................................@..................................D..W....`............................................................................... ............... ..H............text...D%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................ E......H........A..`...........P ..2!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\ro-RO\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.785865587531196
Encrypted:	false
SSDEEP:	192:kdIY4puUhG9oHusJxWgAm/45t6lSertHPHrgCs324VfosqPXMdEqljSNPEinIOBZ:CapuUhg7sJxWgAm/45t6lSertvHrDapG
MD5:	5F6E31693AFF46FBDBCA6AABC5ED7E40
SHA1:	D1460A56FD08C8EE10D6E4E470B72BB53D3955A8
SHA-256:	31AA8F7D10891DB8188A5FB8999EE0CB8564253D8C91A39EC432764011BF42C8
SHA-512:	CDBD5C9C488BF31C0C8F772819D41E36546F8CAA7E0AB75281DAF59C401A60629DF00F1D6C85FB396A6FC1610AD5C24F17D2436397688E348FB55C312428E7B8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&..........^E... ...`....... ....................................@..................................E..W....`............................................................................... ............... ..H............text...d%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................@E......H........A..d...........P ..O!..........................................K!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\ru-RU\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	4.949048788389918
Encrypted:	false
SSDEEP:	384:NZ2vdzqaLxW8w5/EtHjl+dbA5eI00QF7jiS58U:3aL88/sd0QF7jiS58U
MD5:	566A9E0CEEA6C3CBF82B05C4F8470C27
SHA1:	C24F42AE5FC9A326B6526557501EA98150409F85
SHA-256:	CFB04DD1A62A3C5FE6D9AE898DF507B7567ABEEE7C871FA9AAD1A0D2475968AD
SHA-512:	ABA8482414B1D98313D37C58C4D19D7D197A440601175C9E3F1AEC5D7A86C53A43A289F843A3EFF85C0FEE043334A25E9D215A54FD4CA3DFF6E8A786E6FE85C3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.................M... ...`....... ....................................@..................................L..O....`............................................................................... ............... ..H............text...$-... ...................... ..`.rsrc........`.......0..............@..@.reloc...............6..............@..B.................M......H.......hI..d...........P ...)...........................................).............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\ru\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.846136752240531
Encrypted:	false
SSDEEP:	192:phbWWNv/jzSEfthb7O9JKggIOrCPPzm394in3fwB/CZPlAg1O5rxg0XWr:pN1NvbH7O9JKgglrCPChnYVC5A5rxg06
MD5:	DADE13E423762BDAE745D57CA3DC86EF
SHA1:	7B4122CBEF771C5548A7CB5641B6DB6743C8C3F6
SHA-256:	1A1D5FDAC027144BCAA0E8110F4DE717E80944420C59708B3DD8E2BD31BC7ED4
SHA-512:	77F5050BA87E8ABEB92298D16897D6CEC087FFB7B4C38442C854A0993B398DE529C15B5674ADAACFB3E39CE05165F05A38337B2DBD41E8A7D806751542F6E8D3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!................~=... ...@....... ..............................>"....@.................................,=..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......(..............@..B................`=......H.......88............... ..e...P ......................................w..4.8b^b..W..i8s....oz...t..tlhp...$.8p..c....U(O'....N.w`...<".1.w....?.*.0=z`Lz5..^....O...Q.....v..z...........`;..a..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\sk-SK\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.89773663933091
Encrypted:	false
SSDEEP:	192:mIYK1uOKGEXJ7hxwUmX+41C/TUMZc/ZgPPInsYJNM3TPGdTzXpPbf+oBumIJMr2P:m41uOKl7hx9mX+41CLUMZc/ZOPVYJN6b
MD5:	EF403938F8FDBFB9638F378774F93D97
SHA1:	020AAD53FEB53DD763CA422CE47BC75F0A06F426
SHA-256:	EDA401DC462FAB09262874A61915D30F7721FA7F3FFCA7242461D978C54E76BA
SHA-512:	B40A0F1CC1C0C9A99FAFB1F96BF44DA543364DAB15A1BA4F564B9D3014C3031881E67700240BBD5DF280439901EE36A9345A32EC83DAED80203C115712820DB6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&..........nE... ...`....... ....................................@..................................E..O....`............................................................................... ............... ..H............text...t%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................PE......H........A..d...........P ..f!..........................................b!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\sl-SI\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.769946515681843
Encrypted:	false
SSDEEP:	192:NIYV7AGeXGfqyuMxUY+iZWBe2v3gW0dFgPaVCe1d3qTS3xH4q9OYtRwbHUWPsLZ4:NTAGeXyuMxUY+iZWBei3gW0dFOaEe3C5
MD5:	E3D94C18654B6E3A630A7932298E989D
SHA1:	A46151D16A43728FC905578B04C97A6034BEEC48
SHA-256:	4A6897E25BEA93BC47A166AE7C02CB2858C6399A9360F12E6EE56C4FE110B537
SHA-512:	DFCF6207F5D1EE1CA490ECE1CEFCC0B4C073A74D9E7AC0C1E865181173328421115BAB4530AF995DF2B04893C801D5F8D58B9867905FC1F59A6416E4CBFD5710
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........E... ...`....... ....................................@..................................D..S....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......TA..d...........P ...!........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\sl\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.767196344145025
Encrypted:	false
SSDEEP:	192:5IYV7AGeXGfqyuMxUY+iZWBe2v3gW0dFgPaVCe1d3qTS3xH4q9OYtRwbHUWPsLZA:5TAGeXyuMxUY+iZWBei3gW0dFOaEe3C5
MD5:	B84137A373B458BFDB8E37BF68DBC93B
SHA1:	C66FEC010EDA81A93608892749F6CA44E01828E9
SHA-256:	CC83EDEBF62A1C0F0698C97180AB13D96301C531C7270D4BDE4C43FA96129728
SHA-512:	5CEFD56822A084B7AC139A306640474FF82B106CA8088991FF58432867A405CE5091D11F465EBEA4EA1F30D102854FFA79424B0430E5BDA88FA9494FD8D23E00
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........E... ...`....... ....................................@..................................D..W....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......TA..`...........P ...!........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\sv-SE\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.726343979225638
Encrypted:	false
SSDEEP:	192:3tIYShuTiGMuLj/kyxI0Nc/yGUbwMgWf2iPMXBSSky3WDeFzMShGOBZ7T3GyRKvL:3tUhuTiGj/HxI0Nc/yGUbwMgWf2YMXQd
MD5:	F26F586F37F77C4040A1110CD09C1A04
SHA1:	9511A7124B27AB89BDCB25F4D373CC08C25E06BC
SHA-256:	0C709CC4E21D236600DCB400713D93940BB96BFCC3BE184ABC27EAA25C50853C
SHA-512:	F48821C805E4359CD6FE1571050248DBB6496040528ECCC313C1ACC67088B91E391C412023C37E2B2F1BFFB2704EC6D25982819FF6487298E4E17EBB1F43E18B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........D... ...`....... ....................................@..................................D..W....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H.......@A..d...........P ... ........................................... .............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\th-TH\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	16896
Entropy (8bit):	4.847206773739568
Encrypted:	false
SSDEEP:	384:HWmNyydz3LxBD5uSw84x/d/dfwJGTV/cEJviNhsFx55n5z5OPMuQ5m5rPzzSvooG:T7LHDFGh0EJviNhsFx55n5z5OPMuQ5mP
MD5:	912EF860F4ACB26AFA205A91956990D3
SHA1:	8DB790876785FE61D10F4E8E4D32722B5AD35679
SHA-256:	E49F80929F50C19E430352B21851F8359D7061B3EF4CDC9264BCC1BE3620B987
SHA-512:	0E89322265A7B8827302DD91DFF85E82DF7ED87FC8C1F04F2B13C23FFD8471A01CD52A172C008D0AA40288322C2F1EF2913A7039539EF5C9D9ED06F90B8D57CC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....8...........W... ...`....... ....................................@.................................@W..K....`............................................................................... ............... ..H............text....7... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B................pW......H........S..d...........P ...3...........................................3.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\tr-TR\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.883497823407382
Encrypted:	false
SSDEEP:	192:wIY4kciiGg/kISxvnmkYsPV+tIqMvhBhPYTua1j3SfDpu6WbyLWFTXLgNzCii7oM:wKkciiwISxvnmkYsPV+tIqMvhBZYquLt
MD5:	0082F8E3C82E3BEC8FA2EC9B8F62030A
SHA1:	BD9790D90D940DA82015B1A003DDDE0E6A814388
SHA-256:	8094AD142AB016533528ECCCEB49182D1AF3BF0BFD34DDD940F3714D7D17A145
SHA-512:	5B737D66475DC957E53A2F88CEABA78DB7D76BE7B5184B75D8516C5A97161131DDCD3130200BA0DF2C000F46658EC01A5CB2ED60A876266DB4BAC95986BD763B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....&...........E... ...`....... ....................................@.................................dE..W....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H........B..d...........P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\vi-VN\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.077789016416725
Encrypted:	false
SSDEEP:	384:tTp4EAT1bY2bx1CxHdO35YFInizzX83tNeRFYMvF2Mr58N:CblbzC5jmtNeRN2y58N
MD5:	E224E6925C4274296BA7BEC71FF953A4
SHA1:	1BF409839D76EDB70B88426AC2C17106105EA3C9
SHA-256:	8CC2EAE4D338CC29846144136702F717E1379468A07919975FE6EEEB9007C558
SHA-512:	DAFABB12F383BD99CF0D1F1BD949CEE2F922C6CB03FFA51CD5583E45B2FF6B79C7B88B26CCD5E8DC0873388B7C61DE39DE968FC8E4A3E8B63C3B3D94711AC309
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!...............^I... ...`....... ....................................@..................................I..O....`............................................................................... ............... ..H............text...d)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B................@I......H........E..d...........P ..U%..........................................Q%.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\zh-CN\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.701646036890297
Encrypted:	false
SSDEEP:	192:HWWNv/jzSEhtiBbSEmfO2mdqeCtzEc6yCPVDA1L5rxg0XWr:H1NvbcbSEm22mdqet+wh25rxg0XWr
MD5:	3CEFEC17BAAC089C54C8102A4CFD160C
SHA1:	A54CD9BD4181A591937A99BE88BEB006279837DE
SHA-256:	AAFBE48966DBC5372A308AB9501245CE261D2715F336AD1908C799D354C981A2
SHA-512:	2D45193662C7CE2854CE2D3EE53AE199E094D09BC76D8D8A8E36B24EA60400A5F064CA16CE0078FE6CBDF4117C22565C04E47B99CD99868254C915DB6D18700F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................8... ...@....... ...................................@..................................8..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................8......H........3............... ......P ......................................%h...P...y.7....ON(..U.~vT]h.e9dfp*1...oDL..1.M..6.Ku...^5....RE.')f.$......{...mcc......E...g.l.Z.q..M..@._D.{...,...S....................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\zh-CN\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.080167063477581
Encrypted:	false
SSDEEP:	192:IIYXbXbaQGf0wwrCwYxzJSKqdy6eY5R6Q3Pyt7g0mY3IC1wx+bDqhbXpVuieenT1:IRbXbaQixwYxzJSKqdy6eY5Rt/A7c+hS
MD5:	93DDE9DE1910EC7C10CAF6A2A950E6E6
SHA1:	D9E977B3153676C2422374AD1D314046E1318806
SHA-256:	597FC5D537F33A564CDB2D467D2F588CA25954D6E758316D4911CA97C2A1A7CA
SHA-512:	300B6B873CF5C5487AD813D27823B4E899DA49342DB6F83FC0D23919A629AAAEC53334DAD63BEEBAD4D92372A76636F8069CF054D08C755A4C7CE76AA07C65D2
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....$...........B... ...`....... ....................................@.................................XB..S....`............................................................................... ............... ..H............text...."... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B.................B......H........>..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\zh-Hant\Microsoft.Win32.TaskScheduler.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	9728
Entropy (8bit):	4.728551774224484
Encrypted:	false
SSDEEP:	192:JWWNv/jzSEhtimYtEq40uI7Sr2fqmxkNeo7R7L7c7xM757odHK9nPol1f5rxg0Xq:J1NvbOtEq40uYSatEdHwWloA9Pk5rxgJ
MD5:	833F269BA6F0C34F49273DA7FBD7DCE7
SHA1:	D0253D322DCDF7F54E37C7E8911A8B77670D2967
SHA-256:	F8C769A357E6CD27452835E5288FE515FB50BFEEC83EF3969975171174B467E5
SHA-512:	4FA315E23D985AFFB46F6536CDF2DDC1B882F47098EE2D5A4B954DDEEB8904D1C83182B1598E4948A59728339945307B699A147ECD813C0F91986D95BDC57184
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b...........!.................8... ...@....... ....................................@..................................8..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`.......$..............@..B.................8......H........3............... ......P ......................................gh....R.xns+....2..b]...c........W\|..C.....\*.~w.?.....%...M.}..K?.`.Y.0%U..........I.:f...p.EB.....]O]..4Sy'.D4N..................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....G.......PADPADP..7...7....\.....`.Q......!...........:oH..S....c...........L.}..>.. 2...3...5......:...

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\Translations\zh-TW\UnifiedStub.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.067541414141853
Encrypted:	false
SSDEEP:	192:oIY26Y9TGjEWVWxzJS9gSKiLHQhcScP/yggS2w3tWGPO4JRy0ty6WGbdIY9MAFXx:ow6Y9TEVWxzJS9gSKiLwhcSSqgwmMGxp
MD5:	142024ABF19A89ED6DF37C56CE927361
SHA1:	B818199BB5D275F7E583D9E20F99CF7A393ED226
SHA-256:	9678E0D14BAC32C77BAAE8A4B697051E3ADE12B91278D7B01FDA00ED471167E4
SHA-512:	0FF2F4570F35DF7B44901E982D3D15FA1DA6D8D41EB6D98B8ECCB920A8345ACB5A2E89D400F6AC1DD0DF3DD0F70CD1FD4AD38DD4B613F7E72D07D49F7E045C33
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Uf...........!.....$...........B... ...`....... ....................................@.................................8B..S....`............................................................................... ............... ..H............text...."... ...$.................. ..`.rsrc........`.......&..............@..@.reloc...............,..............@..B................pB......H........>..d...........P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....V.......PADPADP.%z............u.$+.l.....o.G...4....!.L...0N....._).......85.[JF.13U.y.....(.w.N.....<..sxU./.h.L.......=:.lc...?Z....!.....V......rk.L...\.....T...=.i..)..].....D..b..`............)...s..%'..JA*......>.$.:.%

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\UnifiedStub-installer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1120648
Entropy (8bit):	6.282495231593689
Encrypted:	false
SSDEEP:	12288:nAIzN9/YaT6MIQtZM1A0+Nwhq3drYozTW0fbcIQTPFdWHJLKe:AIzNpG061A0ue8lYozK0fbNpNKe
MD5:	C7FE1EB6A82B9FFAAF8DCA0D86DEF7CA
SHA1:	3CD3D6592BBE9C06D51589E483CCE814BAB095EE
SHA-256:	61D225EEFB7D7AF3519A7E251217A7F803A07A6DDF42C278417C140B15D04B0B
SHA-512:	348A48B41C2978E48DDBEB8B46AD63EF7DDE805A5998F1730594899792462762A9EEE6E4FE474389923D6B995ECA6518C58563F9D1765087B7AC05CE2D91C096
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...`.L..........."...0......B........... ........@.. ....................................`.....................................O.......`?...............U..........$...8............................................ ............... ..H............text........ ...................... ..`.rsrc...`?.......@..................@..@.reloc..............................@..B.......................H........Y..................@............................................~.............0..`.......(....o....(....o....(....(.......r...p(....(....(....~.......(.........,..(......(........(.....0..............~....o......E............'...9.......o...........8....~....o....s,....~....o....s.....+h~....o....s.....+V~....o....s.....~....o....~....o....~....o ...s$....+ ~....o....s.....~....o....s.....~......o!.......0..........~....-..("...+....(#.....o$...-..o%.....(.....,.

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsAtom.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	160016
Entropy (8bit):	6.4048842736009
Encrypted:	false
SSDEEP:	3072:S6lrh8aWSI9uVDeMWoWVy5zmndQ1dTZjxO3S/9FVkmiGUV+fS:S6lrhISL9e1oWE56ndQ19aY9Fjs2S
MD5:	F5CF4F3E8DEDDC2BF3967B6BFF3E4499
SHA1:	0B236042602A645C5068F44F8FCBCC000C673BFE
SHA-256:	9D31024A76DCAD5E2B39810DFF530450EE5A1B3ECBC08C72523E6E7EA7365A0B
SHA-512:	48905A9FF4A2EC31A605030485925A8048E7B79AD3319391BC248F8F022813801D82EB2FF9900EBCB82812F16D89FDFF767EFA3D087303DF07C6C66D2DCB2473
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsAtom.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!..0..2...........P... ...`....@.. ...................................`.................................pP..K....`..T............<...5..........0P............................................... ............... ..H............text....0... ...2.................. ..`.rsrc...T....`.......4..............@..@.reloc...............:..............@..B.................P......H........i..(...........0....U...O.......................................(....(.................................0..............0..............0.....................0.....................2K........`.2........0.....................6F.......0..............0.....................MU.z.....0.............B(....(....(...................................................................................................0..............0.............*Ad..........

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsDatabase.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	170328
Entropy (8bit):	6.47551843695429
Encrypted:	false
SSDEEP:	3072:XR761d9cCg9+zhOzcx9R0KvvvvnPPH6Gi5tPArrYeiYiPKiF15fJ2K/Krrii555z:81TcpihOk0KvvvvnPPH6Gi5tPArrYeiG
MD5:	72689B177CD84AE5260532F5C7A10EBD
SHA1:	4129FBAB0F99F8420F25D772D2D62A26B1FADB3C
SHA-256:	062FD8045911EAAB4B5F505DADE6C0E23E6200C1AC1FDB86EA73E69AB801E037
SHA-512:	8649EB139AE3B695463210EA2E6061C35CD3580C0AD6A5D2D859835255DD6ACD334D791BFCC0D00D1B60573960C91C29009F3325EB8B37DACFBB7CEF401EC4EE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsDatabase.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................!..0..Z...........x... ........@.. ..............................$.....`..................................w..K.......\............d..X5...........w............................................... ............... ..H............text...$X... ...Z.................. ..`.rsrc...\............\..............@..@.reloc...............b..............@..B.................x......H.......\|l..`...............4k...w.......................................(....(....:+.(Nf%^.(......0.....................0..............0...................-....;.....0.....................VV.Q!....0.........................!....0.............AL......Z.......q...................j.......................................................................................................0.............A4.................Y...............s...........!....0..........

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsJSON.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	223016
Entropy (8bit):	6.7884547646820765
Encrypted:	false
SSDEEP:	3072:cBuq5tonhw9PY+fAKul0ZJXY9ooyJtTsbbiRl7m76m/GS+KKeA4dtrSsQDZ:VqDOhw9PY+4Zl0ZFY9ooyUbc3Kc4dtaF
MD5:	927934736C03A05209CB3DCC575DAF6A
SHA1:	A95562897311122BB451791D6E4749BF49D8275F
SHA-256:	589C228E22DAB9B848A9BD91292394E3BEF327D16B4C8FDD1CC37133EB7D2DA7
SHA-512:	12D4A116AEE39EB53A6BE1078D4F56F0EBD9D88B8777C7BD5C0A549AB5CFF1DB7F963914552EF0A68FF1096B1E1DC0F378F2D7E03FF97D2850CA6B766C4D6683
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsJSON.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....r.............!..0..&...........D... ...`....@.. ...............................B....`..................................D..K....`..D............0..(7..........cD............................................... ............... ..H............text....%... ...&.................. ..`.rsrc...D....`.......(..............@..@.reloc..............................@..B.................D......H........\|...............W..O....C.......................................(....(....:+.(..4g.(......0.............A...................:........0.............B(....(....(.........................................................................................................................................................................0..............0.....................0.....................0..............................0.............*....

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsLogger.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	181184
Entropy (8bit):	6.53382578985949
Encrypted:	false
SSDEEP:	3072:+0AqxqD7b0Qv6wIMCP1Yr+Xle9WQJTrz96JiBRqMadYMBpCA5LH3wjg:NRkD/0Q7IMCP3ePOUBRqKep5jZ
MD5:	F55948A2538A1AB3F6EDFEEFBA1A68AD
SHA1:	A0F4827983F1BF05DA9825007B922C9F4D0B2920
SHA-256:	DE487EDA80E7F3BCE9CD553BC2A766985E169C3A2CAE9E31730644B8A2A4AD26
SHA-512:	E9B52A9F90BAECB922C23DF9C6925B231827B8A953479E13F098D5E2C0DABD67263EEECED9A304A80B597010B863055F16196E0923922FEF2A63EB000CFF04C9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsLogger.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...ky.............!..0.................. ........@.. ....................................`.................................P...K.......P................5........................................................... ............... ..H............text........ ...................... ..`.rsrc...P...........................@..@.reloc..............................@..B........................H.......ds..............."...}...........................................(....(....:+.(...W.(\|...."...........0..............0..............0.................................................0..............0.....................0..............................0..............................0..............................0.....................00.......0..............................0.....................00.......0..............................0.............

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsStubLib.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	261232
Entropy (8bit):	6.520670838166452
Encrypted:	false
SSDEEP:	6144:L4TddrmwvYlpI+JxFKb708NFR75vp+uvewjLbqzm9iVkW:Ud8HI+DW75Hmwnlip
MD5:	FA4E3D9B299DA1ABC5F33F1FB00BFA4F
SHA1:	9919B46034B9EFF849AF8B34BC48AA39FB5B6386
SHA-256:	9631939542E366730A9284A63F1D0D5459C77EC0B3D94DE41196F719FC642A96
SHA-512:	D21CF55D6B537EF9882EACD737E153812C0990E6BDEA44F5352DFE0B1320E530F89F150662E88DB63BEDF7F691A11D89F432A3C32C8A14D1EB5FC99387420680
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....WG..........." ..0.................. ........... ....................... .......c....`.....................................O.......p...............p8..........4...8............................................ ............... ..H............text...X.... ...................... ..`.rsrc...p...........................@..@.reloc..............................@..B........................H.......l&..`............2..h.............................................{ .....{!...V.(".....} .....}!......0..A........u........4.,/(#....{ ....{ ...o$...,.(%....{!....{!...o&...... ..f. )UU.Z(#....{ ...o'...X )UU.Z(%....{!...o(...X...0..b........r...p......%..{ ......%q.........-.&.+.......o)....%..{!......%q.........-.&.+.......o)....(...*...0...........(....}4....("...........s+...o(.....}......}......}.......}.......}.......}.......}.......}.......}......(B....

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsSyncSvc.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	814440
Entropy (8bit):	6.475738224302649
Encrypted:	false
SSDEEP:	12288:LkaJoYf9Z+uUMidkp22We0cRxoJy5DPbTtsqq5dlgM7qcNmP1bGq06ZIEUKth1OH:JJll87GY2q61llaOZBjKt5qq4i
MD5:	CC7167823D2D6D25E121FC437AE6A596
SHA1:	559C334CD3986879947653B7B37E139E0C3C6262
SHA-256:	6138D9EA038014B293DAC1C8FDE8C0D051C0435C72CD6E7DF08B2F095B27D916
SHA-512:	D4945C528E4687AF03B40C27F29B3CBF1A8D1DAF0EE7DE10CD0CB19288B7BC47FAE979E1462B3FA03692BF67DA51AB6FA562EB0E30B73E55828F3735BBFFFA48
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......lC. ("rs("rs("rscZqr""rscZwr."rscZvr;"rszWvr8"rszWqr""rszWwrv"rscZtr)"rscZsr?"rs("ss."rs.W{r "rs.W.s)"rs(".s)"rs.Wpr)"rsRich("rs........................PE..d...x6.d.........."......\...........(.........@.....................................q....`.................................................T........`..p.......xW..."..hK...p..........p...............................8............p...............................text....Z.......\.................. ..`.rdata...'...p...(...`..............@..@.data....F.......*..................@....pdata..xW.......X..................@..@_RDATA.......P......................@..@.rsrc...p....`......................@..@.reloc.......p......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsTime.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	132112
Entropy (8bit):	6.108992422954668
Encrypted:	false
SSDEEP:	3072:SWGjyLgosGplJLT7AwoTFGmrY6sWGGHyj:SwgBGplJX7AHGm8UI
MD5:	167B304C9C615BE2852AC0BEF86E6F15
SHA1:	7C38A8AF0DE07B41D5E5AF771274B0D46B87B0E0
SHA-256:	6D5EA04F978E429C5CF0065A213BF28D8AF36540493C6564218EA51B0D5B961D
SHA-512:	557CF71B939D5F388E17B432DB5D2A15EDE76E6ABCF0476B985BBA0DE4FC22CB130A1A240FE92F41DE03B60E7EDBC9445BE2461079E28EBE985FF523B32EB456
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\rsTime.dll, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.................!..0.................. ........@.. .......................@......0I....`.....................................K.......D................4... ......`................................................ ............... ..H............text........ ...................... ..`.rsrc...D...........................@..@.reloc....... ......................@..B........................H........Z...i...........................................................(@...(6....0............j.0....................j....0..................0..............0............j.0..............0............jB(@...(6...(......."..........".............l................."..................(@...(....:+.(r.S1.(6.....0..............0..............0..........(@...8].......E........G...R...8.... ....(....( ...o....(!........ .....9....&8....(R... ........8....(....

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\uninstall-dns.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	269016
Entropy (8bit):	5.638348013030407
Encrypted:	false
SSDEEP:	3072:99jevmK0U7H/cF9P/V+FKDe/HfETJBLqw+foMCsbpM9NV:3FK0U7HkF9HVpe/HfASJCr9j
MD5:	772E66BF2ED9CA8F60C413576B9BFBA0
SHA1:	91A274E4B66966EB5D036835F8C99FFCD3E74F35
SHA-256:	C3A505A0BF9BB525DCFE981A5CB60D3B4DC4163F1A1179AA55DDB66E569CF2CB
SHA-512:	D3C5742FA5F0E663DF7809288B3159465323B9F8942EA684CAA1B98C912245C151E9F1C909129AB3EAFD5F6282B2B4C0BB983E929E945AA92EB6BC506CD19787
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[.L.5.L.5.L.5...6.I.5...0...5...1.F.5.L.5.M.5.M1.\.5.M6.].5.M0.`.5...3.M.5...4.I.5.L.4...5.N<.M.5.N..M.5.N7.M.5.RichL.5.........................PE..d.....Uf.........."....'.L.......... <.........@.............................0......p/....`.....................................................<....`.......0..d........8... ..........p...........................P...@............`..h............................text....J.......L.................. ..`.rdata.......`.......P..............@..@.data...h...........................@....pdata..d....0......................@..@_RDATA.......P......................@..@.rsrc........`......................@..@.reloc....... ......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\uninstall-epp.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	332568
Entropy (8bit):	5.000961772420698
Encrypted:	false
SSDEEP:	3072:sbjak9Kn0bnccfHyeL+FRexTh6z6ryBLqB9fbUD6y9lvQzJLEX48:GdKn0bnfPjL1xTh6zub1QD3leLEI8
MD5:	8157D03D4CD74D7DF9F49555A04F4272
SHA1:	EAE3DAD1A3794C884FAE0D92B101F55393153F4E
SHA-256:	CDF775B4D83864B071DBCFEED6D5DA930A9F065919D195BB801B6FFAF9645B74
SHA-512:	64A764068810A49A8D3191BC534CD6D7031E636AE306D2204AF478B35D102012D8C7E502ED31AF88280689012DC8E6AFD3F7B2A1FE1E25DA6142388713B67FA7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[.L.5.L.5.L.5...6.I.5...0...5...1.F.5.L.5.M.5.M1.\.5.M6.].5.M0.`.5...3.M.5...4.I.5.L.4...5.N<.M.5.N..M.5.N7.M.5.RichL.5.........................PE..d.....Uf.........."....'.L...........<.........@.............................0.......[....`.....................................................<....`......0..d........;... ..........p...........................P...@............`..h............................text...`J.......L.................. ..`.rdata.......`.......P..............@..@.data...h...........................@....pdata..d....0......................@..@_RDATA.......P......................@..@.rsrc.......`......................@..@.reloc....... ......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zS8CE1A82F\uninstall-vpn.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\Stub.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	201880
Entropy (8bit):	6.4046209284871525
Encrypted:	false
SSDEEP:	3072:O9jevmK0U7H/cF9P/V+FKDe/HfETJBLqU+foMCdEiBhGo:eFK0U7HkF9HVpe/HfA6JCdEid
MD5:	410D4E81BE560D860339E12AC63ACB68
SHA1:	06A9F74874C76EBA0110CDD720DD1E66AA9C271A
SHA-256:	E4A8D1E07F851BE8070DD9B74255E9DD8B49262C338BFB6EF1537EDD8F088498
SHA-512:	4BBFFEEF276CE9B8FDD6D767BA00066309EEE0F65E49CEA999D48D1E8688C73D7011ED1301A668C69814457CAAD3981167A1E3FE2021329DD8FC05659103FB3A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[.L.5.L.5.L.5...6.I.5...0...5...1.F.5.L.5.M.5.M1.\.5.M6.].5.M0.`.5...3.M.5...4.I.5.L.4...5.N<.M.5.N..M.5.N7.M.5.RichL.5.........................PE..d.....Uf.........."....'.L.......... <.........@.............................0............`.....................................................<....`......0..d........6... ..........p...........................P...@............`..h............................text....J.......L.................. ..`.rdata.......`.......P..............@..@.data...h...........................@....pdata..d....0......................@..@_RDATA.......P......................@..@.rsrc.......`......................@..@.reloc....... ......................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Cheat Engine Symbols\structures.sqlite

Download File

Process:	C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3008008, page size 1024, file counter 1, database pages 10, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	1.6211119274023298
Encrypted:	false
SSDEEP:	24:ri4sWLMSpHJCSHBv52qolhdQZSRmAH/0UkEvWTtSDGsWLMSpHJCSHBv52qolhdQU:3s6pHj55XQp8UkEESSs6pHj55XQZ
MD5:	551F7A35DEC7A2436EFA7181DF0F5DB4
SHA1:	38EEA293AB5906FEAD7DF8351863FD75171F864E
SHA-256:	9F5C71448B5A562560E138BA873E4D827DA45C83745E570FD40DF43D4BEC56D6
SHA-512:	CE47D79874F71FED3B9930717A8BD2B827DCD6F8CD1D1DE7E1B913D69C9DFC050B6314538A0AEF88A3F89ADC78CE1E5C55A8661395E1AF373DE34C296093271F
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .........................................................................-....................._....................................................................................................................................................................................../...C...indexsqlite_autoindex_elements_1elements.[...!!...indexnamelookupstructures.CREATE INDEX namelookup on structures(moduleid, tablename).F...!!..Wtablestructuresstructures.CREATE TABLE structures(moduleid INTEGER NOT NULL, typeid INTEGER NOT NULL, tablename varchar(255) NOT NULL, length INTEGER NOT NULL, PRIMARY KEY (moduleid, typeid))3...G!..indexsqlite_autoindex_structures_1structures.P...++.Ytablesqlite_sequencesqlite_sequence.CREATE TABLE sqlite_sequence(name,seq).>.......Stablemodulesmodules.CREATE TABLE modules(moduleid INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT, modulename varchar(255) NOT NULL, timestamp int NOT NULL, UNIQUE (modulename, timestamp))-...A...indexsqlite_autoind

C:\Users\user\AppData\Local\Temp\Cheat Engine Symbols\structures.sqlite-journal

Download File

Process:	C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.28499812076190567
Encrypted:	false
SSDEEP:	3:7FEG2l/2Vtt/lxll:7+/l/at
MD5:	5EC38307986BB9C1F82DB8EFF8591378
SHA1:	703363B249937538859110E9AD52CFBD5DC6F074
SHA-256:	05B15D373C0C21C1D0CF434D7B84F78B988B36EF06C001A1493C4BFA42708C79
SHA-512:	CB9A18E5E694DF668DFB63939686E14ED017055382757FB56553B8B705D49E32457A6AC18E0A4152E1166BFB3C3C8AE0DB3D82E025084078E0FF8115512BDD46
Malicious:	false
Reputation:	unknown
Preview:	.... .c........5................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Cheat Engine\{90E9A075-7EA8-4515-A287-60B992508B82}\ADDRESSES.TMP.FILETEST

Download File

Process:	C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	3.8280729963885096
Encrypted:	false
SSDEEP:	3:XlhDM8FGQEmB:vDHUmB
MD5:	826273A91309B13197041791BA18034C
SHA1:	C1D7C61766E2CC7C8F4FC156C0F002017EB73721
SHA-256:	4876AAF849BBFBE676C85E6F9A2D842C5EC7D2BC6078302956101030F155A7EE
SHA-512:	835A3F71D485E690A13945F3D5EB71FB507B07EB18E0288548569C953AB2EB59211696FFA87CE8A7481DF929B3277DEA1FBD0495FE771994B1D2F3E4869FB9DD
Malicious:	false
Reputation:	unknown
Preview:	....This file can be recreated

C:\Users\user\AppData\Local\Temp\Stub.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2366456
Entropy (8bit):	7.412019669265582
Encrypted:	false
SSDEEP:	49152:UfH6zTpzzrjEEiNjbBnfnsKm8Igo+tDO6admDTDb:A6nxbqFnIdmS50PDb
MD5:	70FD2613E8171383FCB917E2F22B71A2
SHA1:	FC6D26F501F57C2E3B5B71A5054AF847C7C368FC
SHA-256:	8CAF8DDC69826C56C2BFC66DEE054F19AE607709155FC18600B9478EA9FDB316
SHA-512:	7C42924A255909BACC216EF11245FAFC2C529F99ABD13AC26A2A9D1DA18ED173911EE76D81790475EDE840879B55037681DDF6B4833B8F9911104B2CDE421AE0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Ka...S..S..S.5.S..Sn6.S..S.5.S..S.5.S..Sc"PS..S..Sd.Sn"RS..S...S..S.U.R..S...S..S...S..SuX.R..S,.S..SRich.*.S........................PE..L....\.d........../.................l.............@...................................$.........................................x....0...A.......... .#..l...........................................................................................text............................... ..`.rdata...:.......<..................@..@.data....$..........................@....sxdata...... ......................@....rsrc....A...0...B..................@..@................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\CheatEngine75.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3223968
Entropy (8bit):	6.338087367720092
Encrypted:	false
SSDEEP:	49152:vdx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEjT333TYfx:0HDYsqiPRhINnq95FoHVBT333T+
MD5:	9AA2ACD4C96F8BA03BB6C3EA806D806F
SHA1:	9752F38CC51314BFD6D9ACB9FB773E90F8EA0E15
SHA-256:	1B81562FDAEAA1BC22CBAA15C92BAB90A12080519916CFA30C843796021153BB
SHA-512:	B0A00082C1E37EFBFC2058887DB60DABF6E9606713045F53DB450F16EBAE0296ABFD73A025FFA6A8F2DCB730C69DD407F7889037182CE46C68367F54F4B1DC8D
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...oGXb.................B,.........`V,......`,...@...........................1......u1...@......@....................-.......-..9....................0..k....................................-.......................-.......-......................text.....,.......,................. ..`.itext...(...0,..*....,............. ..`.data........`,......F,.............@....bss.....y....-..........................idata...9....-..:....,.............@....didata.......-.......-.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-...... -.............@..@.rsrc................"-.............@..@..............1.......0.............@..@........................................................

C:\Users\user\AppData\Local\Temp\is-H908U.tmp\CheatEngine75.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	27406384
Entropy (8bit):	7.993410954401878
Encrypted:	true
SSDEEP:	786432:37YPcmlabhBx9CrdUxTvngF7oUNUQWQu7pquEKLR:rGTabv+CVYhoLXQ8BR
MD5:	E0F666FE4FF537FB8587CCD215E41E5F
SHA1:	D283F9B56C1E36B70A74772F7CA927708D1BE76F
SHA-256:	F88B0E5A32A395AB9996452D461820679E55C19952EFFE991DEE8FEDEA1968AF
SHA-512:	7F6CABD79CA7CDACC20BE8F3324BA1FDAAFF57CB9933693253E595BFC5AF2CB7510AA00522A466666993DA26DDC7DF4096850A310D7CFF44B2807DE4E1179D1A
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...oGXb.................R...^.......^.......p....@.................................".....@......@...................@....... .......p..................k...................................`......................."..T....0.......................text....9.......:.................. ..`.itext.......P.......>.............. ..`.data....7...p...8...V..............@....bss.....m...............................idata....... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc........p......................@..@....................................@..@........................................................

C:\Users\user\AppData\Local\Temp\is-H908U.tmp\RAV_Cross.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp
File Type:	PNG image data, 700 x 360, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	75974
Entropy (8bit):	7.973739579566582
Encrypted:	false
SSDEEP:	1536:cyfQCzB7fBVwtW5EGtWO7Cemktbbv36SEOW9izF:cyfJ/2WXz7Fbbf61OW9aF
MD5:	CD09F361286D1AD2622BA8A57B7613BD
SHA1:	4CD3E5D4063B3517A950B9D030841F51F3C5F1B1
SHA-256:	B92A31D4853D1B2C4E5B9D9624F40B439856D0C6A517E100978CBDE8D3C47DC8
SHA-512:	F73D60C92644E0478107E0402D1C7B4DFA1674F69B41856F74F937A7B57CEAA2B3BE9242F2B59F1FCF71063AAC6CBE16C594618D1A8CDD181510DE3240F31DFF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......h.......(.....pHYs.................sRGB.........gAMA......a...([IDATx.....U./.?...0'.H.%.A$.N....t.+. .1....].8..8...q...D.OQ.t>G...}Z.x.t.(.....#..........vF0'<;!..;.k..].T....t...._U...k.........................................................................................................................................................................[.````````p.c..v*..jii.,.Z.+...B.tySSSc......3.&..........G$J.....:X2v3....mkk.P... ..K.n.X,R.......n.............j.g..].v..>...P}..Mo.z........Am`c.4.h.`..E.F.f..-........G..6............$..=p......Floh.................Fc..mP..R.........50000008".7.)S2.6=..c+P....K.].]=. ..]..{.........$L...IM+. ...!.?.q.g....4..............SZ".Xe..G.-]#..7.!.)]t\|VW..-]...}.KW.t..8.."...-.."..`...u.0...uI...q(.N.?.0.J.p..m$/S.H..D.cJx. hU.]q.j...t...T.m......A...Y....r.........0.f....UD.J.V.g0.y/\|C.4l!..jix.{V...o.. ..V...9K..7:..D...u....e.\|.-.J.Z../. . .. !.:.,...u...50000008R`...W.c.2.(..

C:\Users\user\AppData\Local\Temp\is-H908U.tmp\WeatherZero.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp
File Type:	PNG image data, 700 x 360, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	30586
Entropy (8bit):	7.919646221064304
Encrypted:	false
SSDEEP:	768:Fk7fJC9WjOI1DaGmnitN039DODp56Ys+9S/IUM+:FktpB4FiQ3qd9S/BN
MD5:	9AC6287111CB2B272561781786C46CDD
SHA1:	6B02F2307EC17D9325523AF1D27A6CB386C8F543
SHA-256:	AB99CDB7D798CB7B7D8517584D546AA4ED54ECA1B808DE6D076710C8A400C8C4
SHA-512:	F998A4E0CE14B3898A72E0B8A3F7154FC87D2070BADCFA98582E3B570CA83A562D5A0C95F999A4B396619DB42AB6269A2BAC47702597C5A2C37177441723D837
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......h.......(.....pHYs.................sRGB.........gAMA......a...w.IDATx....]Wu.5....$...U....!...t.H"...#9.yI'...30H........$'a6...D..NwB...4.tB.$...'......0.d.z}W.+/-.3.[u.=....S..{X{.i.}....B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!D.1#.I....C.g.~.....1...3_r....OB.!..bJ...2k......;..~....q`.f..ov.B.!...!.w.....<..S..w.}?f.^\|..w.s.=o.i..M.!...&2.&...~..mt.a;`.>h.....o.}........n.u..?...B.!D-d.N2../...3g..5k.o...<.....s..7C.I....3f._I.!..B.B....n.i.......f...[..}.........;b...........k.Gg.{.....v...fa...^x_.B.!......dFFF0:....Uf.>...,<{..6..C........g.s.=.f.....;<<\|8.!..B.Z...$..../8~....h]o...8.Q./.../..?OB.!...cd.N....^j...;........N.....\|......B..`.....W.............1..#....C........ ..C...X.\|.U.....^...;.x...w../..;6.a....W-Z..$..B4.3t.mpg{{..6;.[.z.8...t..!3t....<Xg.....p....F.o.\|.+_y.y.>k..........=.IO.&....Y..a.c....k...[....{$.!....

C:\Users\user\AppData\Local\Temp\is-H908U.tmp\WebAdvisor.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp
File Type:	PNG image data, 700 x 360, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	48743
Entropy (8bit):	7.952703392311964
Encrypted:	false
SSDEEP:	768:RtwR1Dy4rQznr1GYfvLn6froelhVNSyCPtSOeVlTTqYueg:zwR1DybhPwhvSyClSOk/geg
MD5:	4CFFF8DC30D353CD3D215FD3A5DBAC24
SHA1:	0F4F73F0DDDC75F3506E026EF53C45C6FAFBC87E
SHA-256:	0C430E56D69435D8AB31CBB5916A73A47D11EF65B37D289EE7D11130ADF25856
SHA-512:	9D616F19C2496BE6E89B855C41BEFC0235E3CE949D2B2AE7719C823F10BE7FE0809BDDFD93E28735B36271083DD802AE349B3AB7B60179B269D4A18C6CEF4139
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......h.......(.....pHYs.................sRGB.........gAMA......a.....IDATx...eIu....(..Y31.}q....`...t....Z..8t;x3._@.3.0.{.E.".&.5.g.C..@..%.>r.5....B...O...^.*..s....{.7..{....r..+W...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(.n+.t.B.p.x.....^.?/....p,..7...{.P(...B.H...r.y..\|.....{l\tO.\|..<..P(....w......o..P(.<h...n[\tO..?......E...}...F.P83....<z.....W..7...w.....?..?.YW(.N.......?N[..E..A..z..[...'.$..'....8...?~.K.\|........[#.....6........;.......s.=...}.c...{.._..z....;w..........(../..n...?..??..?.........z.......~....[o.<.......x.).Z.(..s.N..Wb.....f....../.P8.\|.......?..#......2vO....F......@.\|..w7].\|..$..}?.L.Go...A.1..^...j...$.6....~..x...{..IwD`\|..?.....?...{..~~........).........`$.......tG....\|.n.2..........[..._....e.}.=..<........h.7\|?Kg....+

C:\Users\user\AppData\Local\Temp\is-H908U.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-H908U.tmp\botva2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	6.216405702855349
Encrypted:	false
SSDEEP:	768:kyNq+QWR4gxSUzF08/zFlKcLdQxNld36fJPHw5g4wT1C:jNq+Qw0+JLAqf9Hw5C1C
MD5:	67965A5957A61867D661F05AE1F4773E
SHA1:	F14C0A4F154DC685BB7C65B2D804A02A0FB2360D
SHA-256:	450B9B0BA25BF068AFBC2B23D252585A19E282939BF38326384EA9112DFD0105
SHA-512:	C6942818B9026DC5DB2D62999D32CF99FE7289F79A28B8345AF17ACF9D13B2229A5E917A48FF1F6D59715BDBCB00C1625E0302ABCFE10CA7E0475762E0A3F41B
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................r........................@.................................................................................................................................................................................................CODE.....p.......r.................. ..`DATA.................v..............@...BSS..................x...................idata...............x..............@....edata..............................@..P.reloc..............................@..P.rsrc...............................@..P....................................@..P................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-H908U.tmp\error.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp
File Type:	PNG image data, 768 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	264312
Entropy (8bit):	7.933893788279908
Encrypted:	false
SSDEEP:	6144:28uJEU4QOgo51V0XxDvBpIPR4kYSvGXP/ooOj5dOqhKpcVnJS4LcWTD:RuJNur+XxDvBpIPSkYSvYP/6DVECVncW
MD5:	6B7CB2A5A8B301C788C3792802696FE8
SHA1:	DA93950273B0C256DAB64BB3BB755AC7C14F17F3
SHA-256:	3EED2E41BC6CA0AE9A5D5EE6D57CA727E5CBA6AC8E8C5234AC661F9080CEDADF
SHA-512:	4183DBB8FD7DE5FD5526A79B62E77FC30B8D1EC34EBAA3793B4F28BEB36124084533E08B595F77305522BC847EDFED1F9388C0D2ECE66E6AC8ACB7049B48EE86
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................... .IDATx^...].u&x^......AR..%j.....fw=....P..){5.q..S.;5.[..H....N.$.k.fmy<...EI.$R2.H...htz....;.=.......F...nt.t.......\|'B...(..."..(..."..(.5.@.f.T.T.P...E@.P...E@.P.H....E@.P...E@.P...E...P.PC'[.U.P...E@.P...E@.P..k@.P...E@.P...E@..!.......CU...E@.P...E@.P.....P...E@.P...E@.P.j..%.5t..P..E@.P...E@.P...%.....E@.P...E@.P....B@.@..l=TE@.P...E@.P...E@....E@.P...E@.P...E...P.PC'[.U.P...E@.P...E@.P..k@.P...E@.P...E@..!.......CU...E@.P...E@.P.....P...E@.P...E@.P.j..%.5t..P..E@.P...E@.P...%.....E@.P...E@.P....B@.@..l=TE@.P...E@.P...E@....E@.P...E@.P...E...P.PC'[.U.P...E@.P...E@.P..k@.P...E@.P...E@..!.......CU...E@.P...E@.P.....P...E@.P...E@.P.j..%.5t..P..E@.P...E@.P...%.....E@.P...E@.P....B@.@..l=TE@.P...E@.P...E@....E@.P...E@.P...E...P.PC'[.U.P...E@.P...E@.P..k@.P...E@.P...E@..!.......CU...E@.P...E@.P.....P...E@.P...E@.P.j..%.5t..P..E@.P...E@.P...%.....E@.P...E@.P....B@.@..l=TE@.P...E@.P...E@....E@.P...E@.P...E...P.PC'[.U.P...E@.P...E@.P..k@.P...E@.P

C:\Users\user\AppData\Local\Temp\is-H908U.tmp\finish.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp
File Type:	PNG image data, 768 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	264312
Entropy (8bit):	7.933893788279908
Encrypted:	false
SSDEEP:	6144:28uJEU4QOgo51V0XxDvBpIPR4kYSvGXP/ooOj5dOqhKpcVnJS4LcWTD:RuJNur+XxDvBpIPSkYSvYP/6DVECVncW
MD5:	6B7CB2A5A8B301C788C3792802696FE8
SHA1:	DA93950273B0C256DAB64BB3BB755AC7C14F17F3
SHA-256:	3EED2E41BC6CA0AE9A5D5EE6D57CA727E5CBA6AC8E8C5234AC661F9080CEDADF
SHA-512:	4183DBB8FD7DE5FD5526A79B62E77FC30B8D1EC34EBAA3793B4F28BEB36124084533E08B595F77305522BC847EDFED1F9388C0D2ECE66E6AC8ACB7049B48EE86
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................... .IDATx^...].u&x^......AR..%j.....fw=....P..){5.q..S.;5.[..H....N.$.k.fmy<...EI.$R2.H...htz....;.=.......F...nt.t.......\|'B...(..."..(..."..(.5.@.f.T.T.P...E@.P...E@.P.H....E@.P...E@.P...E...P.PC'[.U.P...E@.P...E@.P..k@.P...E@.P...E@..!.......CU...E@.P...E@.P.....P...E@.P...E@.P.j..%.5t..P..E@.P...E@.P...%.....E@.P...E@.P....B@.@..l=TE@.P...E@.P...E@....E@.P...E@.P...E...P.PC'[.U.P...E@.P...E@.P..k@.P...E@.P...E@..!.......CU...E@.P...E@.P.....P...E@.P...E@.P.j..%.5t..P..E@.P...E@.P...%.....E@.P...E@.P....B@.@..l=TE@.P...E@.P...E@....E@.P...E@.P...E...P.PC'[.U.P...E@.P...E@.P..k@.P...E@.P...E@..!.......CU...E@.P...E@.P.....P...E@.P...E@.P.j..%.5t..P..E@.P...E@.P...%.....E@.P...E@.P....B@.@..l=TE@.P...E@.P...E@....E@.P...E@.P...E...P.PC'[.U.P...E@.P...E@.P..k@.P...E@.P...E@..!.......CU...E@.P...E@.P.....P...E@.P...E@.P.j..%.5t..P..E@.P...E@.P...%.....E@.P...E@.P....B@.@..l=TE@.P...E@.P...E@....E@.P...E@.P...E...P.PC'[.U.P...E@.P...E@.P..k@.P...E@.P

C:\Users\user\AppData\Local\Temp\is-H908U.tmp\is-4A4A4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp
File Type:	PNG image data, 700 x 360, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	75974
Entropy (8bit):	7.973739579566582
Encrypted:	false
SSDEEP:	1536:cyfQCzB7fBVwtW5EGtWO7Cemktbbv36SEOW9izF:cyfJ/2WXz7Fbbf61OW9aF
MD5:	CD09F361286D1AD2622BA8A57B7613BD
SHA1:	4CD3E5D4063B3517A950B9D030841F51F3C5F1B1
SHA-256:	B92A31D4853D1B2C4E5B9D9624F40B439856D0C6A517E100978CBDE8D3C47DC8
SHA-512:	F73D60C92644E0478107E0402D1C7B4DFA1674F69B41856F74F937A7B57CEAA2B3BE9242F2B59F1FCF71063AAC6CBE16C594618D1A8CDD181510DE3240F31DFF
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......h.......(.....pHYs.................sRGB.........gAMA......a...([IDATx.....U./.?...0'.H.%.A$.N....t.+. .1....].8..8...q...D.OQ.t>G...}Z.x.t.(.....#..........vF0'<;!..;.k..].T....t...._U...k.........................................................................................................................................................................[.````````p.c..v*..jii.,.Z.+...B.tySSSc......3.&..........G$J.....:X2v3....mkk.P... ..K.n.X,R.......n.............j.g..].v..>...P}..Mo.z........Am`c.4.h.`..E.F.f..-........G..6............$..=p......Floh.................Fc..mP..R.........50000008".7.)S2.6=..c+P....K.].]=. ..]..{.........$L...IM+. ...!.?.q.g....4..............SZ".Xe..G.-]#..7.!.)]t\|VW..-]...}.KW.t..8.."...-.."..`...u.0...uI...q(.N.?.0.J.p..m$/S.H..D.cJx. hU.]q.j...t...T.m......A...Y....r.........0.f....UD.J.V.g0.y/\|C.4l!..jix.{V...o.. ..V...9K..7:..D...u....e.\|.-.J.Z../. . .. !.:.,...u...50000008R`...W.c.2.(..

C:\Users\user\AppData\Local\Temp\is-H908U.tmp\is-6P0VE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	527389
Entropy (8bit):	7.995975187354872
Encrypted:	true
SSDEEP:	12288:ib5kasT/hWZEu58IbccPqwozk/2rYJb69+J2W:M5kzT/hWZjfbccPOzk/aIb3J2W
MD5:	F68008B70822BD28C82D13A289DEB418
SHA1:	06ABBE109BA6DFD4153D76CD65BFFFAE129C41D8
SHA-256:	CC6F4FAF4E8A9F4D2269D1D69A69EA326F789620FB98078CC98597F3CB998589
SHA-512:	FA482942E32E14011AE3C6762C638CCB0A0E8EC0055D2327C3ACC381DDDF1400DE79E4E9321A39A418800D072E59C36B94B13B7EB62751D3AEC990FB38CE9253
Malicious:	false
Reputation:	unknown
Preview:	PK.........\zX...............saBSI.exe.Z.pT.u.+i..eW c....&....l.....Y[...-@`....e.....;r.T...MJ3.a.]..h:.VF?.u...T...+..()..;...v..[v...........]....s......[..!.....A!?N..?%&!.....1...}AS...U)._t4.;z........9r....A..G...86l}.....EVk.J......t.[E....w...x..+Wx...gg.Qz>...f...8.q^.?..)~..o..B.!z...)....m.{7..F...w....O.+.lz..].......I.......v..=....S.i.=.r..J.....!.xI2D...!.5..S..r...Rz..@`......Ol....]4..(......]..K..%.I,.8?]"..Y..k\|...%.W.#.p....5.li....r.A.5-......X....B.e.J.s.9...s."..S.NE.Fq...D\...0!....v..../..{....sL(6l.E8g...G...!V......^..\|.Dp.k....W-B9.."B-.-...h.(..4.9>..&.3.2<.V.x.\|T...Ke}.b.G.&1...!..>..P(..2~....~...S....B.d.$......,...O..B9.`.....X}B......B9.`a.8..0....l..B......\|..0.b....N...0....%.^.`..0....{...MY.....4..H.'......Il....(..&.e.:&.X=$...+..P..na...C.~]...n...2..n..a0.U...>.0..2.....`..4...<.0.e..a._f0...[.....2..i._c0..i.^....(.).G.\|.....$....^.YR..R...<.`.....l'@..2...V[..0..B*.s......2x...........`'.(.Y...\.`..$

C:\Users\user\AppData\Local\Temp\is-H908U.tmp\is-H8HA6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33432
Entropy (8bit):	5.35760641987685
Encrypted:	false
SSDEEP:	768:Wj1b3suKzD3S8AktYcFA/Vc6KB5YiR2yAMxkE4PP:FzDC8AY8Vclv7jxwP
MD5:	36D1B7C42C37FF8217B07851D0C4C39A
SHA1:	6A6AD6023F9E1AB89AEC4A3177D05815A6E3A2CD
SHA-256:	3679E7D61D7AFDCBA2828739767EEE608E4C082519EF5814E0AA9D9CBB5408EB
SHA-512:	6390A23866076E45FB82B9360CC347DA902351FB3E6C248829AB3CF36F0A35DE5AB3C31A8A64C33B493552153A965B984FD41E28B33EBE1A024E06D00F2D9CC6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0.............N1... ...@....@.. ...............................O....`..................................0..O....@..................X...`......P0..8............................................ ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......(..............@..B................01......H........#...............................................................0..N........r...p~....o.......o....,,.o....o.....1...o.....o....r...p.(....o......o.......0..3........o....(.......o....,...o.......o......o....o.....*..0..........r...prO..p(....s.....(....(....r...p(....(..............-...........8...............%..:..o..........o.........i.0.~....+.........r...p(....-H..r...p(....-:..r...p(....-,..r...p(....-{..r...p(....-q..r...p(....-g+h..( ...-_..(........o!...

C:\Users\user\AppData\Local\Temp\is-H908U.tmp\is-K1D3S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6227973
Entropy (8bit):	7.999704627939555
Encrypted:	true
SSDEEP:	98304:ppxj2IwVGwxnd+P0fY8eHeM1euEuR+HW84l7mKN2Yjwov3I7qs4zLGGlFtSNNkoo:ppxZ7k00fxeHejFHW3l113I7d4zLGGTL
MD5:	7CC0288A2A8BBE014F9E344F3068C8F1
SHA1:	EB47D401AE30A308DD66BDCAFDE06CDD35E25C94
SHA-256:	200E9BC4FCF2C6682DDC8C7F172A0D02BEFECD25CA882F66C6ABC868A54B8975
SHA-512:	869F0A01EF0BCBBFC501C1786E14BFFEAA2DAAA00210C312874FC67A724C77EF61394BB5854B9A02AF654CD045C4D39AE30D73F1B4EC8AA9E531DFEEA1714476
Malicious:	false
Reputation:	unknown
Preview:	PK........v..U......_..._.....WZSetup.exe.}xT.7..+...{..F.....R4`.Ct..!X.&.....Bp.#......l6c9.zlk-.=.-..Z.....IP..Q.Bk.T.8Q..a.....g..y.{......?Np.^..Z.^..Zko=...Y8..".:...?7...u!................77......uk7m....-l.6.n.TX..Wx_....99YE)..z...q..p.].G.,^yt!K_}.#<..x...../?..t. .O..+p.".....%k.y..o.6ep..$...$.[...!L5.F.(.P.=._..%&....a.........@....pU....\|..\.....9.i..]<C.....Z......$..B.[3.a.Z...>.3...z=7..aT......R..O..glJU.......S...u.3..7\%.-_...?#......F..W.M.^,.o..I9rU.S.68.S..^]r.C..z...n.>..q>.:{&..s./+Z.".v.S.GT.3..6....:aM.m....r)......FS...h..c......z....(.F..........S_G.Z,..;.P...-8-...{.........'.q..Y..B....C.....t)O?&....I.w....r].....U..m.....2.:.>'..)hv<..E..oY......:;.H@?aL8X.z..,....v..@9..x2P...w..i....'.......#..G.......l.:`..D.c.]....q....CT..0.U.P.,Z.$&...(..%.Cba.9.sJ..;%....J.Q.m.....]..<`..Vk.X./7.Q.:..Pr.r&.x..B....Y...8...yJ....Q...........gRy.GV.T...II.4m(..-.0<.3.6<.H$]6..v7.R...:`..aN<#7%91C^lw'>V

C:\Users\user\AppData\Local\Temp\is-H908U.tmp\is-KHOE8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp
File Type:	PNG image data, 700 x 360, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	48743
Entropy (8bit):	7.952703392311964
Encrypted:	false
SSDEEP:	768:RtwR1Dy4rQznr1GYfvLn6froelhVNSyCPtSOeVlTTqYueg:zwR1DybhPwhvSyClSOk/geg
MD5:	4CFFF8DC30D353CD3D215FD3A5DBAC24
SHA1:	0F4F73F0DDDC75F3506E026EF53C45C6FAFBC87E
SHA-256:	0C430E56D69435D8AB31CBB5916A73A47D11EF65B37D289EE7D11130ADF25856
SHA-512:	9D616F19C2496BE6E89B855C41BEFC0235E3CE949D2B2AE7719C823F10BE7FE0809BDDFD93E28735B36271083DD802AE349B3AB7B60179B269D4A18C6CEF4139
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......h.......(.....pHYs.................sRGB.........gAMA......a.....IDATx...eIu....(..Y31.}q....`...t....Z..8t;x3._@.3.0.{.E.".&.5.g.C..@..%.>r.5....B...O...^.*..s....{.7..{....r..+W...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(...B.P(.n+.t.B.p.x.....^.?/....p,..7...{.P(...B.H...r.y..\|.....{l\tO.\|..<..P(....w......o..P(.<h...n[\tO..?......E...}...F.P83....<z.....W..7...w.....?..?.YW(.N.......?N[..E..A..z..[...'.$..'....8...?~.K.\|........[#.....6........;.......s.=...}.c...{.._..z....;w..........(../..n...?..??..?.........z.......~....[o.<.......x.).Z.(..s.N..Wb.....f....../.P8.\|.......?..#......2vO....F......@.\|..w7].\|..$..}?.L.Go...A.1..^...j...$.6....~..x...{..IwD`\|..?.....?...{..~~........).........`$.......tG....\|.n.2..........[..._....e.}.=..<........h.7\|?Kg....+

C:\Users\user\AppData\Local\Temp\is-H908U.tmp\is-T84Q6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp
File Type:	PNG image data, 700 x 360, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	30586
Entropy (8bit):	7.919646221064304
Encrypted:	false
SSDEEP:	768:Fk7fJC9WjOI1DaGmnitN039DODp56Ys+9S/IUM+:FktpB4FiQ3qd9S/BN
MD5:	9AC6287111CB2B272561781786C46CDD
SHA1:	6B02F2307EC17D9325523AF1D27A6CB386C8F543
SHA-256:	AB99CDB7D798CB7B7D8517584D546AA4ED54ECA1B808DE6D076710C8A400C8C4
SHA-512:	F998A4E0CE14B3898A72E0B8A3F7154FC87D2070BADCFA98582E3B570CA83A562D5A0C95F999A4B396619DB42AB6269A2BAC47702597C5A2C37177441723D837
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR.......h.......(.....pHYs.................sRGB.........gAMA......a...w.IDATx....]Wu.5....$...U....!...t.H"...#9.yI'...30H........$'a6...D..NwB...4.tB.$...'......0.d.z}W.+/-.3.[u.=....S..{X{.i.}....B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!..B.!D.1#.I....C.g.~.....1...3_r....OB.!..bJ...2k......;..~....q`.f..ov.B.!...!.w.....<..S..w.}?f.^\|..w.s.=o.i..M.!...&2.&...~..mt.a;`.>h.....o.}........n.u..?...B.!D-d.N2../...3g..5k.o...<.....s..7C.I....3f._I.!..B.B....n.i.......f...[..}.........;b...........k.Gg.{.....v...fa...^x_.B.!......dFFF0:....Uf.>...,<{..6..C........g.s.=.f.....;<<\|8.!..B.Z...$..../8~....h]o...8.Q./.../..?OB.!...cd.N....^j...;........N.....\|......B..`.....W.............1..#....C........ ..C...X.\|.U.....^...;.x...w../..;6.a....W-Z..$..B4.3t.mpg{{..6;.[.z.8...t..!3t....<Xg.....p....F.o.\|.+_y.y.>k..........=.IO.&....Y..a.c....k...[....{$.!....

C:\Users\user\AppData\Local\Temp\is-H908U.tmp\logo.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp
File Type:	PNG image data, 768 x 768, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	264312
Entropy (8bit):	7.933893788279908
Encrypted:	false
SSDEEP:	6144:28uJEU4QOgo51V0XxDvBpIPR4kYSvGXP/ooOj5dOqhKpcVnJS4LcWTD:RuJNur+XxDvBpIPSkYSvYP/6DVECVncW
MD5:	6B7CB2A5A8B301C788C3792802696FE8
SHA1:	DA93950273B0C256DAB64BB3BB755AC7C14F17F3
SHA-256:	3EED2E41BC6CA0AE9A5D5EE6D57CA727E5CBA6AC8E8C5234AC661F9080CEDADF
SHA-512:	4183DBB8FD7DE5FD5526A79B62E77FC30B8D1EC34EBAA3793B4F28BEB36124084533E08B595F77305522BC847EDFED1F9388C0D2ECE66E6AC8ACB7049B48EE86
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................... .IDATx^...].u&x^......AR..%j.....fw=....P..){5.q..S.;5.[..H....N.$.k.fmy<...EI.$R2.H...htz....;.=.......F...nt.t.......\|'B...(..."..(..."..(.5.@.f.T.T.P...E@.P...E@.P.H....E@.P...E@.P...E...P.PC'[.U.P...E@.P...E@.P..k@.P...E@.P...E@..!.......CU...E@.P...E@.P.....P...E@.P...E@.P.j..%.5t..P..E@.P...E@.P...%.....E@.P...E@.P....B@.@..l=TE@.P...E@.P...E@....E@.P...E@.P...E...P.PC'[.U.P...E@.P...E@.P..k@.P...E@.P...E@..!.......CU...E@.P...E@.P.....P...E@.P...E@.P.j..%.5t..P..E@.P...E@.P...%.....E@.P...E@.P....B@.@..l=TE@.P...E@.P...E@....E@.P...E@.P...E...P.PC'[.U.P...E@.P...E@.P..k@.P...E@.P...E@..!.......CU...E@.P...E@.P.....P...E@.P...E@.P.j..%.5t..P..E@.P...E@.P...%.....E@.P...E@.P....B@.@..l=TE@.P...E@.P...E@....E@.P...E@.P...E...P.PC'[.U.P...E@.P...E@.P..k@.P...E@.P...E@..!.......CU...E@.P...E@.P.....P...E@.P...E@.P.j..%.5t..P..E@.P...E@.P...%.....E@.P...E@.P....B@.@..l=TE@.P...E@.P...E@....E@.P...E@.P...E...P.PC'[.U.P...E@.P...E@.P..k@.P...E@.P

C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33432
Entropy (8bit):	5.35760641987685
Encrypted:	false
SSDEEP:	768:Wj1b3suKzD3S8AktYcFA/Vc6KB5YiR2yAMxkE4PP:FzDC8AY8Vclv7jxwP
MD5:	36D1B7C42C37FF8217B07851D0C4C39A
SHA1:	6A6AD6023F9E1AB89AEC4A3177D05815A6E3A2CD
SHA-256:	3679E7D61D7AFDCBA2828739767EEE608E4C082519EF5814E0AA9D9CBB5408EB
SHA-512:	6390A23866076E45FB82B9360CC347DA902351FB3E6C248829AB3CF36F0A35DE5AB3C31A8A64C33B493552153A965B984FD41E28B33EBE1A024E06D00F2D9CC6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0.............N1... ...@....@.. ...............................O....`..................................0..O....@..................X...`......P0..8............................................ ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......(..............@..B................01......H........#...............................................................0..N........r...p~....o.......o....,,.o....o.....1...o.....o....r...p.(....o......o.......0..3........o....(.......o....,...o.......o......o....o.....*..0..........r...prO..p(....s.....(....(....r...p(....(..............-...........8...............%..:..o..........o.........i.0.~....+.........r...p(....-H..r...p(....-:..r...p(....-,..r...p(....-{..r...p(....-q..r...p(....-g+h..( ...-_..(........o!...

C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33432
Entropy (8bit):	5.35760641987685
Encrypted:	false
SSDEEP:	768:Wj1b3suKzD3S8AktYcFA/Vc6KB5YiR2yAMxkE4PP:FzDC8AY8Vclv7jxwP
MD5:	36D1B7C42C37FF8217B07851D0C4C39A
SHA1:	6A6AD6023F9E1AB89AEC4A3177D05815A6E3A2CD
SHA-256:	3679E7D61D7AFDCBA2828739767EEE608E4C082519EF5814E0AA9D9CBB5408EB
SHA-512:	6390A23866076E45FB82B9360CC347DA902351FB3E6C248829AB3CF36F0A35DE5AB3C31A8A64C33B493552153A965B984FD41E28B33EBE1A024E06D00F2D9CC6
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0.............N1... ...@....@.. ...............................O....`..................................0..O....@..................X...`......P0..8............................................ ............... ..H............text...T.... ...................... ..`.rsrc........@......................@..@.reloc.......`.......(..............@..B................01......H........#...............................................................0..N........r...p~....o.......o....,,.o....o.....1...o.....o....r...p.(....o......o.......0..3........o....(.......o....,...o.......o......o....o.....*..0..........r...prO..p(....s.....(....(....r...p(....(..............-...........8...............%..:..o..........o.........i.0.~....+.........r...p(....-H..r...p(....-:..r...p(....-,..r...p(....-{..r...p(....-q..r...p(....-g+h..( ...-_..(........o!...

C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	527389
Entropy (8bit):	7.995975187354872
Encrypted:	true
SSDEEP:	12288:ib5kasT/hWZEu58IbccPqwozk/2rYJb69+J2W:M5kzT/hWZjfbccPOzk/aIb3J2W
MD5:	F68008B70822BD28C82D13A289DEB418
SHA1:	06ABBE109BA6DFD4153D76CD65BFFFAE129C41D8
SHA-256:	CC6F4FAF4E8A9F4D2269D1D69A69EA326F789620FB98078CC98597F3CB998589
SHA-512:	FA482942E32E14011AE3C6762C638CCB0A0E8EC0055D2327C3ACC381DDDF1400DE79E4E9321A39A418800D072E59C36B94B13B7EB62751D3AEC990FB38CE9253
Malicious:	false
Reputation:	unknown
Preview:	PK.........\zX...............saBSI.exe.Z.pT.u.+i..eW c....&....l.....Y[...-@`....e.....;r.T...MJ3.a.]..h:.VF?.u...T...+..()..;...v..[v...........]....s......[..!.....A!?N..?%&!.....1...}AS...U)._t4.;z........9r....A..G...86l}.....EVk.J......t.[E....w...x..+Wx...gg.Qz>...f...8.q^.?..)~..o..B.!z...)....m.{7..F...w....O.+.lz..].......I.......v..=....S.i.=.r..J.....!.xI2D...!.5..S..r...Rz..@`......Ol....]4..(......]..K..%.I,.8?]"..Y..k\|...%.W.#.p....5.li....r.A.5-......X....B.e.J.s.9...s."..S.NE.Fq...D\...0!....v..../..{....sL(6l.E8g...G...!V......^..\|.Dp.k....W-B9.."B-.-...h.(..4.9>..&.3.2<.V.x.\|T...Ke}.b.G.&1...!..>..P(..2~....~...S....B.d.$......,...O..B9.`.....X}B......B9.`a.8..0....l..B......\|..0.b....N...0....%.^.`..0....{...MY.....4..H.'......Il....(..&.e.:&.X=$...+..P..na...C.~]...n...2..n..a0.U...>.0..2.....`..4...<.0.e..a._f0...[.....2..i._c0..i.^....(.).G.\|.....$....^.YR..R...<.`.....l'@..2...V[..0..B*.s......2x...........`'.(.Y...\.`..$

C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1.zip (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	527389
Entropy (8bit):	7.995975187354872
Encrypted:	true
SSDEEP:	12288:ib5kasT/hWZEu58IbccPqwozk/2rYJb69+J2W:M5kzT/hWZjfbccPOzk/aIb3J2W
MD5:	F68008B70822BD28C82D13A289DEB418
SHA1:	06ABBE109BA6DFD4153D76CD65BFFFAE129C41D8
SHA-256:	CC6F4FAF4E8A9F4D2269D1D69A69EA326F789620FB98078CC98597F3CB998589
SHA-512:	FA482942E32E14011AE3C6762C638CCB0A0E8EC0055D2327C3ACC381DDDF1400DE79E4E9321A39A418800D072E59C36B94B13B7EB62751D3AEC990FB38CE9253
Malicious:	false
Reputation:	unknown
Preview:	PK.........\zX...............saBSI.exe.Z.pT.u.+i..eW c....&....l.....Y[...-@`....e.....;r.T...MJ3.a.]..h:.VF?.u...T...+..()..;...v..[v...........]....s......[..!.....A!?N..?%&!.....1...}AS...U)._t4.;z........9r....A..G...86l}.....EVk.J......t.[E....w...x..+Wx...gg.Qz>...f...8.q^.?..)~..o..B.!z...)....m.{7..F...w....O.+.lz..].......I.......v..=....S.i.=.r..J.....!.xI2D...!.5..S..r...Rz..@`......Ol....]4..(......]..K..%.I,.8?]"..Y..k\|...%.W.#.p....5.li....r.A.5-......X....B.e.J.s.9...s."..S.NE.Fq...D\...0!....v..../..{....sL(6l.E8g...G...!V......^..\|.Dp.k....W-B9.."B-.-...h.(..4.9>..&.3.2<.V.x.\|T...Ke}.b.G.&1...!..>..P(..2~....~...S....B.d.$......,...O..B9.`.....X}B......B9.`a.8..0....l..B......\|..0.b....N...0....%.^.`..0....{...MY.....4..H.'......Il....(..&.e.:&.X=$...+..P..na...C.~]...n...2..n..a0.U...>.0..2.....`..4...<.0.e..a._f0...[.....2..i._c0..i.^....(.).G.\|.....$....^.YR..R...<.`.....l'@..2...V[..0..B*.s......2x...........`'.(.Y...\.`..$

C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\installer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29504216
Entropy (8bit):	7.992759398379778
Encrypted:	true
SSDEEP:	786432:04e7iJzW/sw/H8gbacchaQh0T1iWcO1Q3+Bu+:wiJusw/8gvc0C0prcObB5
MD5:	E1DD69840A8965E125AA7F311B6D8EFB
SHA1:	ECEBA8DA71B7A767C674BFB5E704AEA6857E0827
SHA-256:	94F19254D9F0B4D11BD99E23CFD2ACFC4498BCCD1B163CA7BF4DC19FC303A088
SHA-512:	4FA041DD7B6DCE8EE43D579BA0DC2E383A4B0CA3AEA56EE967C7FE5079647C644189A1E5C7BFE27375CC54E96DDB1ABEC5C56E91185C58BE977CC77D6A7C1913
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t.K=0.%n0.%n0.%nk.&o:.%nk.!o".%nk. o..%nb.!o .%nb.&o:.%nb. oj.%nk.$o5.%n0.$n..%n..,o<.%n...n1.%n..'o1.%nRich0.%n........................PE..d....j)f.........."..........\|.................@....................................t.....`.................................................8$..(............p..p2...........p.........p.......................(.......8...............p...H"..`....................text............................... ..`.rdata..............................@..@.data....1...0......................@....pdata..p2...p...4...4..............@..@_RDATA...............h..............@..@.rsrc................j..............@..@.reloc.......p......................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1184128
Entropy (8bit):	6.623147525519113
Encrypted:	false
SSDEEP:	24576:WF66IUpqM/XAl0drYaL6NFEXXN6abiklqOYadJ0CbmpV4CsCa0wDisO4qG:k/M0drYaIaXXOAqOYadJ0Cbmrhq0wTb5
MD5:	143255618462A577DE27286A272584E1
SHA1:	EFC032A6822BC57BCD0C9662A6A062BE45F11ACB
SHA-256:	F5AA950381FBCEA7D730AA794974CA9E3310384A95D6CF4D015FBDBD9797B3E4
SHA-512:	C0A084D5C0B645E6A6479B234FA73C405F56310119DD7C8B061334544C47622FDD5139DB9781B339BB3D3E17AC59FDDB7D7860834ECFE8AAD6D2AE8C869E1CB9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......2..}vn..vn..vn..-../xn..-../.n..$../bn..$../on..G2r.tn..$../.n..-../on..-../wn..-../yn...../wn...../~n...../Zn..vn..=o...../{n...../hn....p.wn...../wn..Richvn..................PE..L...V..e.....................h...... .............@..................................1....@.............................................p...............................p...................@.......X...@...............0....... ....................text............................... ..`.rdata..............................@..@.data..............................@....didat...............T..............@....rsrc...p............V..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2 (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6227973
Entropy (8bit):	7.999704627939555
Encrypted:	true
SSDEEP:	98304:ppxj2IwVGwxnd+P0fY8eHeM1euEuR+HW84l7mKN2Yjwov3I7qs4zLGGlFtSNNkoo:ppxZ7k00fxeHejFHW3l113I7d4zLGGTL
MD5:	7CC0288A2A8BBE014F9E344F3068C8F1
SHA1:	EB47D401AE30A308DD66BDCAFDE06CDD35E25C94
SHA-256:	200E9BC4FCF2C6682DDC8C7F172A0D02BEFECD25CA882F66C6ABC868A54B8975
SHA-512:	869F0A01EF0BCBBFC501C1786E14BFFEAA2DAAA00210C312874FC67A724C77EF61394BB5854B9A02AF654CD045C4D39AE30D73F1B4EC8AA9E531DFEEA1714476
Malicious:	false
Reputation:	unknown
Preview:	PK........v..U......_..._.....WZSetup.exe.}xT.7..+...{..F.....R4`.Ct..!X.&.....Bp.#......l6c9.zlk-.=.-..Z.....IP..Q.Bk.T.8Q..a.....g..y.{......?Np.^..Z.^..Zko=...Y8..".:...?7...u!................77......uk7m....-l.6.n.TX..Wx_....99YE)..z...q..p.].G.,^yt!K_}.#<..x...../?..t. .O..+p.".....%k.y..o.6ep..$...$.[...!L5.F.(.P.=._..%&....a.........@....pU....\|..\.....9.i..]<C.....Z......$..B.[3.a.Z...>.3...z=7..aT......R..O..glJU.......S...u.3..7\%.-_...?#......F..W.M.^,.o..I9rU.S.68.S..^]r.C..z...n.>..q>.:{&..s./+Z.".v.S.GT.3..6....:aM.m....r)......FS...h..c......z....(.F..........S_G.Z,..;.P...-8-...{.........'.q..Y..B....C.....t)O?&....I.w....r].....U..m.....2.:.>'..)hv<..E..oY......:;.H@?aL8X.z..,....v..@9..x2P...w..i....'.......#..G.......l.:`..D.c.]....q....CT..0.U.P.,Z.$&...(..%.Cba.9.sJ..;%....J.Q.m.....]..<`..Vk.X./7.Q.:..Pr.r&.x..B....Y...8...yJ....Q...........gRy.GV.T...II.4m(..-.0<.3.6<.H$]6..v7.R...:`..aN<#7%91C^lw'>V

C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2.zip (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6227973
Entropy (8bit):	7.999704627939555
Encrypted:	true
SSDEEP:	98304:ppxj2IwVGwxnd+P0fY8eHeM1euEuR+HW84l7mKN2Yjwov3I7qs4zLGGlFtSNNkoo:ppxZ7k00fxeHejFHW3l113I7d4zLGGTL
MD5:	7CC0288A2A8BBE014F9E344F3068C8F1
SHA1:	EB47D401AE30A308DD66BDCAFDE06CDD35E25C94
SHA-256:	200E9BC4FCF2C6682DDC8C7F172A0D02BEFECD25CA882F66C6ABC868A54B8975
SHA-512:	869F0A01EF0BCBBFC501C1786E14BFFEAA2DAAA00210C312874FC67A724C77EF61394BB5854B9A02AF654CD045C4D39AE30D73F1B4EC8AA9E531DFEEA1714476
Malicious:	false
Reputation:	unknown
Preview:	PK........v..U......_..._.....WZSetup.exe.}xT.7..+...{..F.....R4`.Ct..!X.&.....Bp.#......l6c9.zlk-.=.-..Z.....IP..Q.Bk.T.8Q..a.....g..y.{......?Np.^..Z.^..Zko=...Y8..".:...?7...u!................77......uk7m....-l.6.n.TX..Wx_....99YE)..z...q..p.].G.,^yt!K_}.#<..x...../?..t. .O..+p.".....%k.y..o.6ep..$...$.[...!L5.F.(.P.=._..%&....a.........@....pU....\|..\.....9.i..]<C.....Z......$..B.[3.a.Z...>.3...z=7..aT......R..O..glJU.......S...u.3..7\%.-_...?#......F..W.M.^,.o..I9rU.S.68.S..^]r.C..z...n.>..q>.:{&..s./+Z.".v.S.GT.3..6....:aM.m....r)......FS...h..c......z....(.F..........S_G.Z,..;.P...-8-...{.........'.q..Y..B....C.....t)O?&....I.w....r].....U..m.....2.:.>'..)hv<..E..oY......:;.H@?aL8X.z..,....v..@9..x2P...w..i....'.......#..G.......l.:`..D.c.]....q....CT..0.U.P.,Z.$&...(..%.Cba.9.sJ..;%....J.Q.m.....]..<`..Vk.X./7.Q.:..Pr.r&.x..B....Y...8...yJ....Q...........gRy.GV.T...II.4m(..-.0<.3.6<.H$]6..v7.R...:`..aN<#7%91C^lw'>V

C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	6261520
Entropy (8bit):	7.998950113701314
Encrypted:	true
SSDEEP:	98304:O/KXgWUBu+NlRk9OfK2GTyYX+eyaB135PSuXTm0LuM74eL3o1+ykb5io5dtWx9eJ:O/KXNs6OfxGTyHwnXZB3o1jkb5ioPtE2
MD5:	3C17F28CC001F6652377D3B5DEEC10F0
SHA1:	EEB13CF47836FF0A0D5CC380618F33E7818F9D75
SHA-256:	FA352552306B80F3F897F8F21D8579AE642C97D12298E113AE1ADC03902C69B8
SHA-512:	240B31F29D439C09A56D3BF8D4A3EA14F75C2286E209E7DF3F4FF301BFA3AD8228D7BEBE01ACEA6F2F702A0BA7ECDB5583B97372725C77EF497E749740F644B3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG.sw..PG..VA..PG.Rich.PG.........PE..L...<.Oa.................f...\|.......3............@.......................... ........`...@.................................D...........HD...........2_..Y...........................................................................................text....e.......f.................. ..`.rdata...............j..............@..@.data...8U...........~..............@....ndata...................................rsrc...HD.......F..................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-H908U.tmp\zbShieldUtils.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2060288
Entropy (8bit):	6.6100200574741494
Encrypted:	false
SSDEEP:	49152:iLDTmgoGpODyFCdZlcY6loEvcx+zI0KpCt5yngWmfLgH:iDJ7myFC/lZ6loEvVzI0KYt5yntm
MD5:	FAD0877741DA31AB87913EF1F1F2EB1A
SHA1:	21ABB83B8DFC92A6D7EE0A096A30000E05F84672
SHA-256:	73FF938887449779E7A9D51100D7BE2195198A5E2C4C7DE5F93CEAC7E98E3E02
SHA-512:	F626B760628E16B9AA8B55E463C497658DD813CF5B48A3C26A85D681DA1C3A33256CAE012ACC1257B1F47EA37894C3A306F348EB6BD4BBDF94C9D808646193EC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}./}9.A.9.A.9.A.r.B/$.A.r.F/8.A.r.E/..A.r.D/..A.r.G/8.A.r.@/..A.9.@.3.A.k.E/+.A.k.B/!.A.k.D/G.A...H/:.A...A/8.A.....8.A.9...8.A...C/8.A.Rich9.A.........PE..L.....c...........!.....f...N............................................................@.........................0...........T........A..............................p...............................@............................................text...`e.......f.................. ..`.rdata..>L.......N...j..............@..@.data............Z..................@....rsrc....A.......B..................@..@.reloc...............T..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3014144
Entropy (8bit):	6.393837791441553
Encrypted:	false
SSDEEP:	49152:fLJwSihjOb6GLb4SKEs3DyOMC2DlUt0+yO3A32ASNTvu:dwSi0b67zeCzt0+yO3kS
MD5:	C47A946F3D41363C77CA4C719516E49B
SHA1:	01CB165E95FB6590F66673D25917B838C847BA8B
SHA-256:	32361DA66CBEDF8AC39A309427A132A1927350A38F1BC3F32F0EA78562B24848
SHA-512:	4520A1BF4754DCE663EE038FF34DE33B9BC73CDB93E3CB7674BBBC9096002664EDD6ADEE6257677277C6FDF48418BDECFB26C26D113E241EAB0A621A9A1888D7
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...p.._.................$,.........P6,......@,...@.......................................@......@....................-......`-.49....-.......................................................-......................i-.......-......................text...P.+.......+................. ..`.itext..t(....,..*....+............. ..`.data.......@,......(,.............@....bss.....x....,..........................idata..49...`-..:....,.............@....didata.......-.......,.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-.......-.............@..@.rsrc.........-.......-.............@..@......................-.............@..@........................................................

C:\Users\user\AppData\Local\Temp\is-UC9I1.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsqF14F.tmp\INetC.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.666921368237103
Encrypted:	false
SSDEEP:	384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i
MD5:	2B342079303895C50AF8040A91F30F71
SHA1:	B11335E1CB8356D9C337CB89FE81D669A69DE17E
SHA-256:	2D5D89025911E2E273F90F393624BE4819641DBEE1606DE792362E442E54612F
SHA-512:	550452DADC86ECD205F40668894116790A456FE46E9985D68093D36CF32ABF00EDECB5C56FF0287464A0E819DB7B3CC53926037A116DE6C651332A7CC8035D47
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9<.EXR.EXR.EXR.b.).LXR.EXS..XR.b. .FXR.b.(.DXR.b...DXR.b.*.DXR.RichEXR.................PE..L....T.[...........!.....8...P......I?.......P...................................................................... G..l....?..d.......(...............................................................................P............................text....7.......8.................. ..`.data....<...P.......<..............@....rsrc...(............D..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsqF14F.tmp\WeatherZeroNSISPlugin.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	711952
Entropy (8bit):	6.021498979818168
Encrypted:	false
SSDEEP:	12288:1WNrNNNifmpPFyCrHQnfYWiWJHA7LeLJRHRNJOYHQ93AjN:1WNrNNNifmpPFyCrHQnfYWiWJHcLeLJ3
MD5:	2EAF88651D6DE968BF14EC9DB52FD3B5
SHA1:	1C37626526572FDB6378AA4BEDBF7B941886A9A1
SHA-256:	070190292DF544DA87F84DC8CF8ECC0A0337085A3FE744FA60CE00A6879B6146
SHA-512:	15754A8F097F9C8D7BDA65FB881720AF5E4C4DB1E35F555563B9BAFE6426A6A0E50953A47F628FE3DC0F461E48ABBF77DB7C997902FF483CF33396D0D8E2CD17
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........S...S...S...G...^...G.......G...E.....\.....F.........G...V...S...:.....V.....R.....N.R.....R...RichS...........PE..L.....b...........!.........f.......n.......@............................................@......................... H.......H..<........................Y......x,..(+..8...........................`+..@............@..h............................text....,.......................... ..`.rdata.......@.......2..............@..@.data...\|#...`.......D..............@....rsrc................T..............@..@.reloc..x,...........V..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\Cheat Engine.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Sat Jul 27 21:42:39 2024, mtime=Sat Jul 27 21:42:48 2024, atime=Fri Sep 30 18:37:02 2022, length=399264, window=hide
Category:	dropped
Size (bytes):	931
Entropy (8bit):	4.516743106623278
Encrypted:	false
SSDEEP:	12:8md9C40YXaDh9Ji+dpF4AzKID8dDg0zKl6TjEjAKQ/M+bdpMwkbdpMG1bgsgsmV:8mdNG9ddfKmSKloQAT/jdidT1bgsgsm
MD5:	9B39A3C0819F4EC3CB4A7488FE9EAD4A
SHA1:	83251BACDB8F237AA659F88AD002CC065537B872
SHA-256:	527BBA8BCF8DE34AF4EDEBAF1ACFD3CB0D44A75BBBCD71932D7C28EA417430E5
SHA-512:	93171ECAAE9A5049B65E3E9D483F06B7D4032EA8E03509C14E16D5CC69464572BB59225E3126B7DA7B0460578447898D0188B2A7C125FEBBFA29BEE83BD02EB6
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ...+9.Iv....5^Nv....CV..................................P.O. .:i.....+00.../C:\.....................1......XT...PROGRA~1..t......O.I.XT.....B...............J......%X.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1......XY...CHEATE~1.5..R.......XT..XY.....xT........................C.h.e.a.t. .E.n.g.i.n.e. .7...5.....n.2.....>U.. .CHEATE~1.EXE..R.......XT..XT......T........................C.h.e.a.t. .E.n.g.i.n.e...e.x.e.......a...............-.......`....................C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe..8.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.\.C.h.e.a.t. .E.n.g.i.n.e...e.x.e.!.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.h.e.a.t. .E.n.g.i.n.e. .7...5.`.......X.......128757...........hT..CrF.f4... .c..Yc...,...E...hT..CrF.f4... .c..Yc...,...E..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.99529226555835
TrID:	Win32 Executable (generic) a (10002005/4) 98.04% Inno Setup installer (109748/4) 1.08% InstallShield setup (43055/19) 0.42% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe
File size:	29'977'368 bytes
MD5:	28a85ba5396fcfa8a5f794f04dce35e4
SHA1:	c730d730e167d68a41a8382823c181ff9a75a891
SHA256:	d77fbaa35585f25de3f492e4e3d0bfa6f0f73b053fd6a64058766fef75eca04e
SHA512:	9aa41988b028689ed848ab18bfbc8957d139ccdbd452cda2fa9f0a7a5fb7b73751e0006a0f7830eac43127d9042fff9deb9041f3a3076a1f397e4b7bbd9019f9
SSDEEP:	786432:4CxuEnwFho+zM77UDZiZCd08jFZJAI5E70TZFHOP:dEXFhV0KAcNjxAItjOP
TLSH:	1E67333FA264743EC89E5E320A739250A57B6A60781F8D1E0BF0494DCF365711E3EA5B
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x4b5eec
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5FB0F96E [Sun Nov 15 09:48:30 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	5a594319a0d69dbc452e748bcf05892e

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	14/12/2022 01:00:00 14/12/2024 00:59:59
Subject Chain	CN=EngineGame, O=EngineGame, S=Tel Aviv, C=IL
Version:	3
Thumbprint MD5:	B057F334F42D0F37E84463F374A5B612
Thumbprint SHA-1:	9CD94C59500A37C757F126042A8CD752D0C7964D
Thumbprint SHA-256:	FAEC8CE72964F915A0FE531FDB46BBF6094F24246F654A9B2A08939A9D366C6F
Serial:	00FBD01E95FDDDDC33E3C218C60DA73E12

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004B10F0h
call 00007F73E928E255h
xor eax, eax
push ebp
push 004B65E2h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 004B659Eh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [004BE634h]
call 00007F73E933097Fh
call 00007F73E93304D2h
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007F73E92A3CC8h
mov edx, dword ptr [ebp-14h]
mov eax, 004C1D84h
call 00007F73E9288E47h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [004C1D84h]
mov dl, 01h
mov eax, dword ptr [004237A4h]
call 00007F73E92A4D2Fh
mov dword ptr [004C1D88h], eax
xor edx, edx
push ebp
push 004B654Ah
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F73E9330A07h
mov dword ptr [004C1D90h], eax
mov eax, dword ptr [004C1D90h]
cmp dword ptr [eax+0Ch], 01h
jne 00007F73E9336FEAh
mov eax, dword ptr [004C1D90h]
mov edx, 00000028h
call 00007F73E92A5624h
mov edx, dword ptr [004C1D90h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xc4000	0x9a	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc2000	0xf36	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x4800	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1c955a0	0x1578
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc6000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc22e4	0x244	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xc3000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb361c	0xb3800	ad6e46e3a3acdb533eb6a077f6d065af	False	0.3448639341051532	data	6.356058204328091	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xb5000	0x1688	0x1800	d40fc822339d01f2abcc5493ac101c94	False	0.544921875	data	5.972750055221053	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xb7000	0x37a4	0x3800	4c195d5591f6d61265df08a3733de3a2	False	0.36097935267857145	data	5.044400562007734	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xbb000	0x6de8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xc2000	0xf36	0x1000	a73d686f1e8b9bb06ec767721135e397	False	0.3681640625	data	4.8987046479600425	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xc3000	0x1a4	0x200	41b8ce23dd243d14beebc71771885c89	False	0.345703125	data	2.7563628682496506	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xc4000	0x9a	0x200	37c1a5c63717831863e018c0f51dabb7	False	0.2578125	data	1.8722228665884297	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xc5000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xc6000	0x5d	0x200	8f2f090acd9622c88a6a852e72f94e96	False	0.189453125	data	1.3838943752217987	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc7000	0x4800	0x4800	9f25ea605614c16e9bf3ed44e2511d8b	False	0.3160807291666667	data	4.4211085622066575	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc74c8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Dutch	Netherlands	0.5675675675675675
RT_ICON	0xc75f0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	Dutch	Netherlands	0.4486994219653179
RT_ICON	0xc7b58	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Dutch	Netherlands	0.4637096774193548
RT_ICON	0xc7e40	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	Dutch	Netherlands	0.3935018050541516
RT_STRING	0xc86e8	0x360	data			0.34375
RT_STRING	0xc8a48	0x260	data			0.3256578947368421
RT_STRING	0xc8ca8	0x45c	data			0.4068100358422939
RT_STRING	0xc9104	0x40c	data			0.3754826254826255
RT_STRING	0xc9510	0x2d4	data			0.39226519337016574
RT_STRING	0xc97e4	0xb8	data			0.6467391304347826
RT_STRING	0xc989c	0x9c	data			0.6410256410256411
RT_STRING	0xc9938	0x374	data			0.4230769230769231
RT_STRING	0xc9cac	0x398	data			0.3358695652173913
RT_STRING	0xca044	0x368	data			0.3795871559633027
RT_STRING	0xca3ac	0x2a4	data			0.4275147928994083
RT_RCDATA	0xca650	0x10	data			1.5
RT_RCDATA	0xca660	0x2c4	data			0.6384180790960452
RT_RCDATA	0xca924	0x2c	data			1.25
RT_GROUP_ICON	0xca950	0x3e	data	English	United States	0.8387096774193549
RT_VERSION	0xca990	0x584	data	English	United States	0.26416430594900847
RT_MANIFEST	0xcaf14	0x726	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4005464480874317

Imports

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
netapi32.dll	NetWkstaGetInfo, NetApiBufferFree
advapi32.dll	RegQueryValueExW, AdjustTokenPrivileges, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x454060
__dbk_fcall_wrapper	2	0x40d0a0
dbkFCallWrapperAddr	1	0x4be63c

Possible Origin

Language of compilation system	Country where language is spoken	Map
Dutch	Netherlands
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-28T00:42:46.302134+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49746	20.114.59.183	192.168.2.8
2024-07-28T00:42:05.132066+0200	TCP	2053283	ET ADWARE_PUP Win32/OfferCore Checkin M2	49713	443	192.168.2.8	18.173.206.112
2024-07-28T00:43:08.257538+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49755	80	192.168.2.8	146.185.153.16
2024-07-28T00:43:07.054429+0200	TCP	2803305	ETPRO MALWARE Common Downloader Header Pattern H	49755	80	192.168.2.8	146.185.153.16
2024-07-28T00:41:56.746449+0200	TCP	2053283	ET ADWARE_PUP Win32/OfferCore Checkin M2	49707	443	192.168.2.8	18.173.206.112
2024-07-28T00:42:36.134525+0200	TCP	2053283	ET ADWARE_PUP Win32/OfferCore Checkin M2	49728	443	192.168.2.8	18.173.206.112
2024-07-28T00:42:03.851118+0200	TCP	2053283	ET ADWARE_PUP Win32/OfferCore Checkin M2	49712	443	192.168.2.8	18.173.206.112
2024-07-28T00:42:00.673154+0200	TCP	2053283	ET ADWARE_PUP Win32/OfferCore Checkin M2	49710	443	192.168.2.8	18.173.206.112
2024-07-28T00:42:34.298833+0200	TCP	2053283	ET ADWARE_PUP Win32/OfferCore Checkin M2	49725	443	192.168.2.8	18.173.206.112
2024-07-28T00:42:31.158635+0200	TCP	2053283	ET ADWARE_PUP Win32/OfferCore Checkin M2	49723	443	192.168.2.8	18.173.206.112
2024-07-28T00:42:08.010918+0200	TCP	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	443	49715	20.114.59.183	192.168.2.8
2024-07-28T00:42:54.309052+0200	TCP	2053283	ET ADWARE_PUP Win32/OfferCore Checkin M2	49750	443	192.168.2.8	18.173.206.112
2024-07-28T00:42:02.064048+0200	TCP	2053283	ET ADWARE_PUP Win32/OfferCore Checkin M2	49711	443	192.168.2.8	18.173.206.112
2024-07-28T00:43:12.900165+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49763	443	192.168.2.8	104.20.94.94
2024-07-28T00:43:11.985969+0200	TCP	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	49761	443	192.168.2.8	104.20.94.94
2024-07-28T00:41:55.357573+0200	TCP	2053280	ET ADWARE_PUP Win32/OfferCore Checkin M1	49706	443	192.168.2.8	18.173.206.112

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 28, 2024 00:41:53.873357058 CEST	49706	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:53.873399973 CEST	443	49706	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:53.873473883 CEST	49706	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:53.876810074 CEST	49706	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:53.876827955 CEST	443	49706	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:54.670356989 CEST	443	49706	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:54.670449018 CEST	49706	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:54.674402952 CEST	49706	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:54.674415112 CEST	443	49706	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:54.674717903 CEST	443	49706	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:54.727601051 CEST	49706	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:54.910182953 CEST	49706	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:54.910260916 CEST	49706	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:54.910453081 CEST	443	49706	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:55.357503891 CEST	443	49706	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:55.357561111 CEST	443	49706	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:55.357584953 CEST	443	49706	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:55.357620001 CEST	443	49706	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:55.357769966 CEST	443	49706	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:55.357784033 CEST	49706	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:55.357784033 CEST	49706	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:55.357882977 CEST	443	49706	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:55.357935905 CEST	49706	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:55.357994080 CEST	443	49706	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:55.358062983 CEST	49706	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:55.361133099 CEST	49706	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:55.361176014 CEST	443	49706	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:55.361223936 CEST	49706	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:55.361238956 CEST	443	49706	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:55.434288979 CEST	49707	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:55.434335947 CEST	443	49707	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:55.434432030 CEST	49707	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:55.434727907 CEST	49707	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:55.434742928 CEST	443	49707	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:56.194597960 CEST	443	49707	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:56.194681883 CEST	49707	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:56.196008921 CEST	49707	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:56.196014881 CEST	443	49707	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:56.196255922 CEST	443	49707	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:56.197657108 CEST	49707	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:56.197680950 CEST	49707	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:56.197685003 CEST	443	49707	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:56.746614933 CEST	443	49707	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:56.746766090 CEST	443	49707	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:56.747235060 CEST	49707	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:56.747235060 CEST	49707	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:56.747277021 CEST	49707	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:56.747298956 CEST	443	49707	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:56.853748083 CEST	49708	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:56.853797913 CEST	443	49708	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:56.853866100 CEST	49708	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:56.854120970 CEST	49708	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:56.854135990 CEST	443	49708	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:57.648371935 CEST	443	49708	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:57.648468971 CEST	49708	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:57.649764061 CEST	49708	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:57.649775028 CEST	443	49708	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:57.650018930 CEST	443	49708	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:57.651109934 CEST	49708	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:57.692504883 CEST	443	49708	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:57.932106018 CEST	443	49708	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:57.932135105 CEST	443	49708	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:57.932149887 CEST	443	49708	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:57.932218075 CEST	49708	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:57.932249069 CEST	443	49708	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:57.932300091 CEST	49708	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:58.017668009 CEST	443	49708	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:58.017714977 CEST	443	49708	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:58.017744064 CEST	49708	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:58.017771006 CEST	443	49708	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:58.017806053 CEST	49708	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:58.017827988 CEST	49708	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:58.022443056 CEST	443	49708	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:58.022459030 CEST	443	49708	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:58.022526026 CEST	49708	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:58.022535086 CEST	443	49708	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:58.022586107 CEST	49708	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:58.110002041 CEST	443	49708	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:58.110027075 CEST	443	49708	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:58.110121012 CEST	49708	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:58.110146046 CEST	443	49708	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:58.110193014 CEST	49708	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:58.110703945 CEST	443	49708	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:58.110744953 CEST	443	49708	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:58.110769987 CEST	49708	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:58.110774040 CEST	443	49708	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:58.110819101 CEST	49708	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:58.110836029 CEST	49708	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:58.111022949 CEST	49708	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:58.111037970 CEST	443	49708	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:58.111051083 CEST	49708	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:58.111057043 CEST	443	49708	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:58.145893097 CEST	49709	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:58.145945072 CEST	443	49709	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:58.146040916 CEST	49709	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:58.146373987 CEST	49709	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:58.146393061 CEST	443	49709	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:58.925618887 CEST	443	49709	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:58.925717115 CEST	49709	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:58.927267075 CEST	49709	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:58.927275896 CEST	443	49709	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:58.927512884 CEST	443	49709	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:58.929171085 CEST	49709	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:58.976496935 CEST	443	49709	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:59.209197044 CEST	443	49709	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:59.219140053 CEST	443	49709	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:59.219156981 CEST	443	49709	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:59.219234943 CEST	49709	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:59.219269037 CEST	443	49709	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:59.219285011 CEST	49709	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:59.219542027 CEST	49709	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:59.305932045 CEST	443	49709	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:59.305989981 CEST	443	49709	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:59.306018114 CEST	49709	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:59.306045055 CEST	443	49709	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:59.306061029 CEST	49709	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:59.306083918 CEST	49709	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:59.311379910 CEST	443	49709	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:59.311439991 CEST	443	49709	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:59.311536074 CEST	49709	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:59.311536074 CEST	49709	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:59.311561108 CEST	443	49709	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:59.311587095 CEST	443	49709	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:59.311599970 CEST	49709	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:59.311634064 CEST	49709	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:59.313064098 CEST	49709	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:59.313081980 CEST	443	49709	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:59.313095093 CEST	49709	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:59.313100100 CEST	443	49709	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:59.373009920 CEST	49710	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:59.373059034 CEST	443	49710	18.173.206.112	192.168.2.8
Jul 28, 2024 00:41:59.373152971 CEST	49710	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:59.373430967 CEST	49710	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:41:59.373449087 CEST	443	49710	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:00.119931936 CEST	443	49710	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:00.120157003 CEST	49710	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:00.121423006 CEST	49710	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:00.121431112 CEST	443	49710	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:00.121665001 CEST	443	49710	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:00.122982979 CEST	49710	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:00.123019934 CEST	49710	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:00.123024940 CEST	443	49710	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:00.673177004 CEST	443	49710	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:00.673326015 CEST	443	49710	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:00.673438072 CEST	49710	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:00.675415993 CEST	49710	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:00.675431967 CEST	443	49710	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:00.675442934 CEST	49710	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:00.675447941 CEST	443	49710	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:00.788815975 CEST	49711	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:00.788860083 CEST	443	49711	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:00.788959980 CEST	49711	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:00.789253950 CEST	49711	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:00.789268017 CEST	443	49711	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:01.511096001 CEST	443	49711	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:01.511282921 CEST	49711	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:01.512978077 CEST	49711	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:01.513009071 CEST	443	49711	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:01.513374090 CEST	443	49711	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:01.524246931 CEST	49711	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:01.524246931 CEST	49711	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:01.524292946 CEST	443	49711	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:02.064121008 CEST	443	49711	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:02.064207077 CEST	443	49711	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:02.064297915 CEST	49711	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:02.066957951 CEST	49711	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:02.066982985 CEST	443	49711	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:02.066994905 CEST	49711	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:02.067001104 CEST	443	49711	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:02.089139938 CEST	49712	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:02.089178085 CEST	443	49712	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:02.089251041 CEST	49712	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:02.089551926 CEST	49712	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:02.089565992 CEST	443	49712	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:03.307446003 CEST	443	49712	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:03.307571888 CEST	49712	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:03.308824062 CEST	49712	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:03.308831930 CEST	443	49712	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:03.309230089 CEST	443	49712	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:03.310695887 CEST	49712	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:03.310731888 CEST	49712	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:03.310736895 CEST	443	49712	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:03.851291895 CEST	443	49712	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:03.851484060 CEST	443	49712	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:03.851550102 CEST	49712	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:03.851797104 CEST	49712	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:03.851815939 CEST	443	49712	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:03.851826906 CEST	49712	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:03.851831913 CEST	443	49712	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:04.023268938 CEST	49713	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:04.023313046 CEST	443	49713	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:04.023395061 CEST	49713	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:04.023893118 CEST	49713	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:04.023905993 CEST	443	49713	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:04.769087076 CEST	443	49713	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:04.769370079 CEST	49713	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:04.770832062 CEST	49713	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:04.770839930 CEST	443	49713	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:04.771840096 CEST	443	49713	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:04.773061991 CEST	49713	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:04.773061991 CEST	49713	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:04.773073912 CEST	443	49713	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:05.132230997 CEST	443	49713	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:05.132402897 CEST	443	49713	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:05.132507086 CEST	49713	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:05.132683992 CEST	49713	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:05.132683992 CEST	49713	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:05.132699013 CEST	443	49713	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:05.132707119 CEST	443	49713	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:05.155599117 CEST	49714	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:05.155622959 CEST	443	49714	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:05.156004906 CEST	49714	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:05.156743050 CEST	49714	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:05.156753063 CEST	443	49714	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:05.923202038 CEST	443	49714	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:05.923305988 CEST	49714	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:05.924407959 CEST	49714	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:05.924417019 CEST	443	49714	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:05.924644947 CEST	443	49714	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:05.925976992 CEST	49714	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:05.972498894 CEST	443	49714	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:06.205519915 CEST	443	49714	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:06.215606928 CEST	443	49714	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:06.215626001 CEST	443	49714	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:06.215678930 CEST	49714	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:06.215697050 CEST	443	49714	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:06.215708971 CEST	49714	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:06.215755939 CEST	49714	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:06.300055981 CEST	443	49714	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:06.300122023 CEST	443	49714	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:06.300189018 CEST	49714	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:06.300189018 CEST	49714	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:06.300199986 CEST	443	49714	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:06.300357103 CEST	443	49714	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:06.300425053 CEST	49714	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:06.300448895 CEST	443	49714	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:06.300460100 CEST	49714	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:06.300460100 CEST	49714	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:06.300467014 CEST	443	49714	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:06.300472975 CEST	443	49714	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:20.362338066 CEST	49720	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:20.362375975 CEST	443	49720	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:20.362495899 CEST	49720	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:20.362977982 CEST	49720	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:20.362994909 CEST	443	49720	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:21.096031904 CEST	443	49720	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:21.096159935 CEST	49720	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:21.099061966 CEST	49720	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:21.099072933 CEST	443	49720	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:21.099380970 CEST	443	49720	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:21.106693029 CEST	49720	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:21.152514935 CEST	443	49720	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:21.639353991 CEST	443	49720	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:21.639427900 CEST	443	49720	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:21.639527082 CEST	49720	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:21.639539003 CEST	443	49720	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:21.680782080 CEST	49720	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:21.733422995 CEST	443	49720	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:21.733438969 CEST	443	49720	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:21.733511925 CEST	49720	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:21.733542919 CEST	49720	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:21.733549118 CEST	443	49720	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:21.737035036 CEST	443	49720	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:21.737129927 CEST	49720	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:21.737138987 CEST	443	49720	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:21.737183094 CEST	49720	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:21.739901066 CEST	443	49720	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:21.739952087 CEST	49720	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:21.818451881 CEST	443	49720	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:21.818557978 CEST	443	49720	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:21.818604946 CEST	443	49720	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:21.818656921 CEST	49720	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:21.818665981 CEST	443	49720	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:21.818725109 CEST	49720	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:21.818732023 CEST	443	49720	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:21.818840027 CEST	443	49720	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:21.818895102 CEST	49720	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:21.819329023 CEST	49720	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:21.819344997 CEST	443	49720	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:21.819355011 CEST	49720	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:21.819360971 CEST	443	49720	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:21.830823898 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:21.830909967 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:21.831106901 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:21.831396103 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:21.831429005 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:22.987688065 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:22.987890005 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:22.989765882 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:22.989778996 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:22.990009069 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:22.991431952 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.032510996 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.267630100 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.278069019 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.278112888 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.278213978 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.278213978 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.278289080 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.278368950 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.364576101 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.364638090 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.364742041 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.364922047 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.364996910 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.365034103 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.365056992 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.370349884 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.370397091 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.370465994 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.370481014 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.370507956 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.370532036 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.455801010 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.455873013 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.456058025 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.456084013 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.456156015 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.456156969 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.472136021 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.472181082 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.472281933 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.472306013 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.472393990 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.476701021 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.476742029 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.476788998 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.476797104 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.476818085 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.476841927 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.478019953 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.478060961 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.478094101 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.478101015 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.478122950 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.478140116 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.548096895 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.548129082 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.548278093 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.548300982 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.548377037 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.552180052 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.552229881 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.552280903 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.552288055 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.552315950 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.552335978 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.565231085 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.565299034 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.565412998 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.565412998 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.565448046 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.565458059 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.565481901 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.565485954 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.565510988 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.565520048 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.565578938 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.569447994 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.569494963 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.569578886 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.569593906 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.569628000 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.569639921 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.570324898 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.570375919 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.570437908 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.570456028 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.570470095 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.570504904 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.571197033 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.571239948 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.571281910 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.571294069 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.571316957 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.571337938 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.674509048 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.674571037 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.674742937 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.674846888 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.674846888 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.674918890 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.675018072 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.675041914 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.675466061 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.675509930 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.675559998 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.675580978 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.675610065 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.678848982 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.678896904 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.678936005 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.678950071 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.678982019 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.691432953 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.691478014 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.691584110 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.691601992 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.691746950 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.694194078 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.694253922 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.694288969 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.694303989 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.694353104 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.696156979 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.696201086 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.696253061 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.696274996 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.696297884 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.696340084 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.696841002 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.696898937 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.696924925 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.696944952 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.696974039 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.696995974 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.767869949 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.767898083 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.767988920 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.767999887 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.768055916 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.768306971 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.768325090 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.768377066 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.768382072 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.768418074 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.768436909 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.768703938 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.768719912 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.768783092 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.768789053 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.768825054 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.771791935 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.771810055 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.771868944 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.771874905 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.771918058 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.771939993 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.783339024 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.783360958 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.783449888 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.783462048 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.783504963 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.787226915 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.787242889 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.787324905 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.787331104 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.787389040 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.788957119 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.788974047 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.789047003 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.789052963 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.789100885 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.789504051 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.789514065 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.789612055 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.789619923 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.789663076 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.860551119 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.860572100 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.860759974 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.860775948 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.860850096 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.861421108 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.861438036 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.861510038 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.861515045 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.861560106 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.861573935 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.861634016 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.861639023 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.861650944 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.861841917 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.866249084 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.866269112 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.866280079 CEST	49721	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.866285086 CEST	443	49721	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.887940884 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.887969971 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:23.888050079 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.888355970 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:23.888370991 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:24.613095999 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:24.613259077 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:24.614583969 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:24.614593983 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:24.614823103 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:24.616090059 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:24.660490036 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:24.896223068 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:24.896250963 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:24.896270037 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:24.896334887 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:24.896358967 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:24.896528006 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:24.977010965 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:24.977068901 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:24.977164984 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:24.977233887 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:24.977271080 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:24.977293015 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:24.984093904 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:24.984148026 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:24.984198093 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:24.984213114 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:24.984261036 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:24.984282017 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.062479973 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.062514067 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.062730074 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.062757969 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.062946081 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.063261032 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.063285112 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.063349009 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.063359022 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.063399076 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.064779043 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.064807892 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.064851046 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.064860106 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.064884901 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.064908028 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.074655056 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.074682951 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.074767113 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.074788094 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.074831009 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.149270058 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.149303913 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.149436951 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.149451971 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.149528980 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.150034904 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.150053978 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.150114059 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.150120974 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.150158882 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.150902033 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.150918961 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.151094913 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.151099920 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.151143074 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.151678085 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.151698112 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.151761055 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.151767969 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.151808023 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.154660940 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.154681921 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.154748917 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.154757023 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.154794931 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.155472040 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.155487061 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.155546904 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.155550957 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.155586958 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.161406994 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.161422968 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.161494017 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.161504030 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.161550999 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.167046070 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.167062044 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.167134047 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.167144060 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.167182922 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.236248970 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.236270905 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.236578941 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.236593008 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.236644030 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.237231016 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.237248898 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.237306118 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.237309933 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.237349033 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.237874031 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.237889051 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.237941980 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.237945080 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.237982035 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.239433050 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.239454985 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.239511013 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.239515066 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.239558935 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.240317106 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.240331888 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.240385056 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.240389109 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.240430117 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.241028070 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.241045952 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.241097927 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.241101980 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.241139889 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.248375893 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.248400927 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.248490095 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.248500109 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.248542070 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.259574890 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.259601116 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.259681940 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.259694099 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.259876013 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.323055983 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.323088884 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.323218107 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.323232889 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.323278904 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.323939085 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.323955059 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.324014902 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.324019909 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.324058056 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.324610949 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.324626923 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.324681044 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.324686050 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.324722052 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.325397015 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.325411081 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.325498104 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.325501919 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.325544119 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.325968981 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.325984001 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.326036930 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.326040030 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.326081038 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.328298092 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.328313112 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.328388929 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.328393936 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.328430891 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.335103989 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.335135937 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.335201979 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.335206985 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.335247993 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.359553099 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.359576941 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.359767914 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.359793901 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.359853983 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.410001040 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.410022974 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.410248041 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.410264969 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.410320044 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.410800934 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.410814047 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.410883904 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.410892010 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.410936117 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.411392927 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.411407948 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.411458969 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.411465883 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.411504984 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.412053108 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.412070990 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.412137032 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.412142992 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.412179947 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.412738085 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.412755966 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.412828922 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.412836075 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.412873983 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.414907932 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.414923906 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.415016890 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.415030003 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.415081978 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.421992064 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.422013044 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.422096014 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.422102928 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.422149897 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.439925909 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.439954996 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.440087080 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.440109015 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.440258026 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.501912117 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.501929045 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.502192020 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.502238035 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.502306938 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.502578020 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.502590895 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.502671957 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.502684116 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.502746105 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.503041983 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.503055096 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.503117085 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.503128052 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.503184080 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.503674030 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.503685951 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.503763914 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.503776073 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.503830910 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.504360914 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.504373074 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.504440069 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.504456043 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.504504919 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.505090952 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.505103111 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.505213022 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.505224943 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.505290031 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.508830070 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.508852005 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.508966923 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.508981943 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.509041071 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.526732922 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.526746988 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.526928902 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.526941061 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.527004004 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.592308998 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.592328072 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.592533112 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.592571020 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.592638969 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.593261957 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.593276978 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.593358994 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.593372107 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.593430996 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.593702078 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.593714952 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.593786001 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.593796968 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.593849897 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.594356060 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.594369888 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.594443083 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.594454050 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.594513893 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.595355034 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.595372915 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.595446110 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.595458031 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.595514059 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.596015930 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.596029997 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.596093893 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.596107006 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.596162081 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.598114967 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.598129034 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.598196030 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.598210096 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.598258018 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.619843960 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.619879961 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.619987011 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.619996071 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.620044947 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.679286957 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.679318905 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.679455042 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.679462910 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.679507017 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.680161953 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.680185080 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.680227041 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.680232048 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.680269957 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.680583954 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.680604935 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.680658102 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.680663109 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.680700064 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.681205988 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.681225061 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.681279898 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.681284904 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.681320906 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.681952000 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.681972980 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.682029009 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.682034016 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.682069063 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.682454109 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.682481050 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.682513952 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.682519913 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.682547092 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.682560921 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.685242891 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.685265064 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.685328007 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.685333014 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.685368061 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.717444897 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.717468023 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.717541933 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.717549086 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.717698097 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.773056030 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.773089886 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.773183107 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.773189068 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.773233891 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.773792028 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.773813963 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.773869991 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.773875952 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.773901939 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.773920059 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.774832010 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.774857044 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.774905920 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.774914980 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.774954081 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.776382923 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.776412010 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.776459932 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.776464939 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.776489973 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.776525021 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.778598070 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.778625965 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.778728008 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.778728008 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.778733969 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.778769970 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.780545950 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.780565977 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.780652046 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.780657053 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.780697107 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.781086922 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.781109095 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.781162024 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.781167030 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.781203032 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.796211958 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.796243906 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.796315908 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.796320915 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.796369076 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.873244047 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.873280048 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.873402119 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.873419046 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.873462915 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.873747110 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.873775005 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.873811960 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.873817921 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.873847961 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.873868942 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.874280930 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.874300957 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.874345064 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.874351025 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.874381065 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.874397993 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.875300884 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.875323057 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.875379086 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.875384092 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.875422955 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.876316071 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.876341105 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.876379013 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.876385927 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.876404047 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.876411915 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.876431942 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.876435995 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.876451969 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.876467943 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.876506090 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.877223969 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.877249002 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.877290964 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.877296925 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.877312899 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.877334118 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.887934923 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.887963057 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.888047934 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.888062000 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.888103008 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.960280895 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.960314989 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.960417986 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.960480928 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.960556984 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.960704088 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.960726023 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.960761070 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.960777044 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.960803986 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.960835934 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.961426020 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.961451054 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.961499929 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.961512089 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.961536884 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.961559057 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.962203979 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.962225914 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.962291002 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.962304115 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.962368965 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.963018894 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.963040113 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.963103056 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.963115931 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.963174105 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.963604927 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.963624954 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.963689089 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.963701010 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.963761091 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.964323044 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.964344978 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.964413881 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.964426041 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.964519024 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.981584072 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.981616020 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.981734037 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:25.981746912 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:25.981807947 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.047379017 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.047413111 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.047533989 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.047597885 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.047667980 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.047992945 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.048021078 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.048070908 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.048089027 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.048126936 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.048163891 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.048343897 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.048366070 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.048423052 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.048439026 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.048506021 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.048866034 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.048893929 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.048953056 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.048970938 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.049017906 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.049420118 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.049439907 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.049499989 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.049520969 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.049571037 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.050059080 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.050079107 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.050162077 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.050179005 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.050231934 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.050770998 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.050791979 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.050836086 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.050851107 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.050879002 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.050896883 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.068463087 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.068470955 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.068593025 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.068612099 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.068656921 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.134680033 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.134712934 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.134892941 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.134896994 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.134896994 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.134927034 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.134968042 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.134993076 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.135355949 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.135377884 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.135421038 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.135435104 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.135466099 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.136029005 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.136053085 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.136094093 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.136106968 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.136132956 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.136251926 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.136271000 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.136301041 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.136315107 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.136341095 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.136850119 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.136882067 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.136961937 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.136976957 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.137392998 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.137413979 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.137459993 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.137474060 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.137499094 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.155447960 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.155477047 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.155561924 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.155580997 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.155607939 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.196676970 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.223371029 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.223396063 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.223536968 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.223557949 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.223614931 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.227106094 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.227128029 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.227236032 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.227252960 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.227309942 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.229943037 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.229968071 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.230050087 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.230065107 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.230132103 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.230346918 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.230366945 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.230431080 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.230444908 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.230496883 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.231153011 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.231173038 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.231214046 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.231228113 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.231255054 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.231287003 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.232083082 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.232103109 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.232160091 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.232163906 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.232177973 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.232214928 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.232230902 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.232265949 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.232275963 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.232300997 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.232320070 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.245851040 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.245874882 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.245965004 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.245980978 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.246032953 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.317219019 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.317257881 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.317399979 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.317426920 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.317471981 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.317501068 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.317503929 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.317523003 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.317542076 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.317595005 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.318156004 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.318177938 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.318252087 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.318264961 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.318316936 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.318746090 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.318767071 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.318825006 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.318841934 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.318870068 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.318888903 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.319705963 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.319730043 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.319786072 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.319798946 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.319823980 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.319861889 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.320681095 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.320700884 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.320750952 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.320770025 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.320787907 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.320818901 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.320859909 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.330117941 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.330143929 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.330239058 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.330251932 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.384001017 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.410351992 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.410397053 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.410453081 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.410480976 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.410505056 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.410562992 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.410839081 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.410865068 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.410928011 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.410938978 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.410952091 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.410976887 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.411607981 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.411633968 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.411706924 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.411719084 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.411756992 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.412069082 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.412091017 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.412131071 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.412137985 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.412163019 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.412179947 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.412631989 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.412656069 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.412694931 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.412703037 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.412730932 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.412745953 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.413099051 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.413121939 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.413161993 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.413170099 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.413196087 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.413213968 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.414011955 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.414033890 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.414082050 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.414092064 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.414139986 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.414139986 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.417428017 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.417458057 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.417517900 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.417536974 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.417547941 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.417578936 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.504401922 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.504437923 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.504582882 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.504616976 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.504612923 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.504633904 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.504652023 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.504692078 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.505045891 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.505069017 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.505106926 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.505115986 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.505130053 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.505877972 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.505906105 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.505942106 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.505947113 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.505975008 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.506906986 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.506930113 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.506967068 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.506973028 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.506983995 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.506997108 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.507013083 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.507044077 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.507049084 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.507075071 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.507716894 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.507740021 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.507751942 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.507757902 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.507803917 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.508552074 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.508575916 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.508645058 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.508651018 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.508680105 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.511555910 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.591367006 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.591408014 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.591514111 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.591532946 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.591583014 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.591800928 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.591824055 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.591886997 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.591893911 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.591923952 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.591938019 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.592223883 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.592243910 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.592293024 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.592298985 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.592325926 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.592344999 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.593168020 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.593192101 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.593251944 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.593257904 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.593296051 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.593971968 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.593996048 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.594047070 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.594055891 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.594062090 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.594082117 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.594090939 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.594110966 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.594114065 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.594141960 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.594161034 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.594949007 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.594976902 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.595040083 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.595046043 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.595065117 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.595088959 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.595638037 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.595663071 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.595716000 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.595724106 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.595762968 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.678323030 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.678363085 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.678504944 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.678570032 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.678639889 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.679016113 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.679037094 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.679085970 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.679102898 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.679130077 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.679158926 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.681643009 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.681668997 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.681723118 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.681735992 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.681767941 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.681787014 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.681952953 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.681986094 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.682094097 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.682113886 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.682173014 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.682466030 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.682487011 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.682585001 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.682585001 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.682601929 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.682651997 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.683219910 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.683242083 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.683284998 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.683299065 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.683324099 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.683346033 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.684078932 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.684098959 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.684150934 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.684163094 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.684194088 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.684214115 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.684629917 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.684654951 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.684737921 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.684750080 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.684807062 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.771390915 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.771425009 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.771538019 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.771555901 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.771594048 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.772028923 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.772051096 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.772136927 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.772142887 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.772183895 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.772418022 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.772443056 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.772490025 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.772496939 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.772531033 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.772651911 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.772672892 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.772720098 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.772727013 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.772761106 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.773480892 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.773504019 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.773585081 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.773591995 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.773627996 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.774410963 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.774430990 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.774491072 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.774507046 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.774518013 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.774532080 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.774564028 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.775351048 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.775372028 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.775420904 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.775429010 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:26.775454998 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:26.821403980 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.071218967 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.071258068 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.071372032 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.071400881 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.071445942 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.071825027 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.071846008 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.071883917 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.071893930 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.071918011 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.071935892 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.072563887 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.072587013 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.072619915 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.072628021 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.072655916 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.072674990 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.072793961 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.072817087 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.072845936 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.072853088 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.072876930 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.072891951 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.073877096 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.073901892 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.073939085 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.073945999 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.073966980 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.073982000 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.074925900 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.074951887 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.074994087 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.075000048 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.075068951 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.075134039 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.075160027 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.075170994 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.075176954 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.075186014 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.075220108 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.076102018 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.076133013 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.076162100 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.076169014 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.076200962 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.076217890 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.078531027 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.078564882 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.078599930 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.078607082 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.078629971 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.078648090 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.079564095 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.079590082 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.079622984 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.079628944 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.079654932 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.079672098 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.080250978 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.080277920 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.080312014 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.080317974 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.080341101 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.080385923 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.080802917 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.080827951 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.080883980 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.080890894 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.080910921 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.080914974 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.080926895 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.080933094 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.080950022 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.080960989 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.081001043 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.081005096 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.081043005 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.081723928 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.081753016 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.081803083 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.081809998 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.081831932 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.081846952 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.081919909 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.081944942 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.081974030 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.081979990 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.082004070 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.082027912 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.082739115 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.082772970 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.082803965 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.082811117 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.082834959 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.082850933 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.083710909 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.083735943 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.083811045 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.083820105 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.083873034 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.083916903 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.083939075 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.084006071 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.084012032 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.084073067 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.084510088 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.084597111 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.084625959 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.084708929 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.084714890 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.084753036 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.084866047 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.084889889 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.084918976 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.084923983 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.084939003 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.084963083 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.085752964 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.085777044 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.085809946 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.085815907 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.085849047 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.085864067 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.085891008 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.085922003 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.085927963 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.085942984 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.085958004 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.086393118 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.086815119 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.086836100 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.086867094 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.086873055 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.086895943 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.086899042 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.086920977 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.086926937 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.086939096 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.086947918 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.087004900 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.087090969 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.122129917 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.122168064 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.122333050 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.122351885 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.122366905 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.122406006 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.122436047 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.122875929 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.122900009 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.122953892 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.122961044 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.123589039 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.123615026 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.123646975 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.123653889 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.123670101 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.123678923 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.123697996 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.123725891 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.123733044 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.123750925 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.124332905 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.124361038 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.124391079 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.124398947 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.124423981 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.124696016 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.124725103 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.124762058 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.124773026 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.124794006 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.125479937 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.125504971 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.125544071 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.125551939 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.125571966 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.165190935 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.209420919 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.209454060 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.209605932 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.209615946 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.209657907 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.210064888 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.210094929 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.210125923 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.210136890 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.210156918 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.210171938 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.210468054 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.210495949 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.210524082 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.210530996 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.210556030 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.210571051 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.210773945 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.210797071 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.210834980 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.210840940 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.210859060 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.210879087 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.211165905 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.211189032 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.211224079 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.211231947 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.211241961 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.211262941 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.217514038 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.217551947 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.217591047 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.217597961 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.217633963 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.219042063 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.219065905 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.219239950 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.219249010 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.219288111 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.219856977 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.219877005 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.219935894 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.219944000 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.219983101 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.296572924 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.296606064 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.296755075 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.296781063 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.296833992 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.297188044 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.297214985 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.297249079 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.297255993 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.297282934 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.297302961 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.297574997 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.297599077 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.297643900 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.297651052 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.297666073 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.297683001 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.297862053 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.297888994 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.297921896 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.297928095 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.297955990 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.297972918 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.298433065 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.298456907 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.298486948 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.298492908 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.298520088 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.298537970 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.307476997 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.307511091 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.307609081 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.307626009 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.307652950 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.307670116 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.313751936 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.313781023 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.313877106 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.313920021 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.313977957 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.314024925 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.314045906 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.314083099 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.314095974 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.314131021 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.314146042 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.383485079 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.383517027 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.383693933 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.383769989 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.383835077 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.383970976 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.383991957 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.384047031 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.384066105 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.384099960 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.384133101 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.384401083 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.384422064 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.384500027 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.384529114 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.384578943 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.384578943 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.384784937 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.384810925 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.384872913 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.384896040 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.384946108 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.385411978 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.385433912 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.385493994 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.385510921 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.385566950 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.394684076 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.394709110 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.394787073 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.394798994 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.394839048 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.400537968 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.400564909 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.400630951 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.400645018 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.400664091 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.400681973 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.400883913 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.400898933 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.400973082 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.400979996 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.401015043 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.470489025 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.470518112 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.470644951 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.470663071 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.470706940 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.471034050 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.471057892 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.471132994 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.471139908 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.471184015 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.471196890 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.471539974 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.471560955 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.471613884 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.471623898 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.471652985 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.471662998 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.471949100 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.471968889 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.472011089 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.472019911 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.472040892 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.472069025 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.472361088 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.472387075 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.472446918 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.472455025 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.472493887 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.481743097 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.481765985 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.481875896 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.481884956 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.481935024 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.487543106 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.487564087 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.487770081 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.487780094 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.487845898 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.488055944 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.488075018 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.488145113 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.488152027 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.488199949 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.557739973 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.557769060 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.557904959 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.557935953 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.557987928 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.558213949 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.558232069 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.558321953 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.558330059 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.558378935 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.558782101 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.558806896 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.558892012 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.558898926 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.558948994 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.559278965 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.559297085 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.559370995 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.559379101 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.559427023 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.559773922 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.559793949 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.559859991 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.559866905 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.559910059 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.571825981 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.571851969 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.571989059 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.572029114 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.572089911 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.585463047 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.585481882 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.585683107 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.585740089 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.585839033 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.586649895 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.586668968 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.586767912 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.586813927 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.586885929 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.646305084 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.646337986 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.646528959 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.646555901 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.646605968 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.646775007 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.646799088 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.646837950 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.646845102 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.646893024 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.647232056 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.647249937 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.647310972 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.647317886 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.647375107 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.647917032 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.647939920 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.647993088 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.648015022 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.648025990 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.648061037 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.648106098 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.658886909 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.658915997 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.659079075 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.659096003 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.675024986 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.675055981 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.675215006 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.675231934 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.676332951 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.676353931 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.676489115 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.676497936 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.727741003 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.733498096 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.733524084 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.733592033 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.733650923 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.733727932 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.733752966 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.733791113 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.738712072 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.738733053 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.738890886 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.738936901 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.739017010 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.739034891 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.739069939 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.739084005 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.739109039 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.739533901 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.739550114 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.739625931 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.739640951 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.745826006 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.745856047 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.745981932 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.745991945 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.762065887 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.762090921 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.762213945 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.762257099 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.763484001 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.763508081 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.763571024 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.763590097 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.763617039 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.805847883 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.824800014 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.824834108 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.824959993 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.825026035 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.825054884 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.825081110 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.825093031 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.825114965 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.825145960 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.825161934 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.825185061 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.827919960 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.827946901 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.828046083 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.828063965 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.828125954 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.828341961 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.828360081 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.828450918 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.828465939 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.828519106 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.828890085 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.828907013 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.828979015 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.828994036 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.829051971 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.833880901 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.833905935 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.834012985 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.834029913 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.834090948 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.849312067 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.849337101 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.849507093 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.849555969 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.849620104 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.850533009 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.850553036 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.850635052 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.850651979 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.850706100 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.911730051 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.911755085 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.912087917 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.912154913 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.912230968 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.912250996 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.912336111 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.912354946 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.912394047 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.912477970 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.914192915 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.914212942 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.914364100 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.914402962 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.914484978 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.914530993 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.914545059 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.914681911 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.914696932 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.914788961 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.915276051 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.915293932 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.915411949 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.915431976 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.915518045 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.920599937 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.920619965 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.920727015 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.920783997 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.920862913 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.936444998 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.936465979 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.936603069 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.936656952 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.936724901 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.937815905 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.937834978 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.937942028 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.937956095 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.938025951 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.999182940 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.999250889 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.999466896 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.999485970 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.999566078 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.999634027 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:27.999634981 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.999674082 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:27.999764919 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.001348972 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.001394987 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.001493931 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.001502037 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.001602888 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.002111912 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.002151966 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.002244949 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.002254009 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.002341032 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.002546072 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.002597094 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.002655983 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.002664089 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.002736092 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.008338928 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.008392096 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.008498907 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.008517981 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.008609056 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.023824930 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.023849010 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.024041891 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.024056911 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.024256945 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.025002003 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.025018930 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.025135040 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.025142908 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.025227070 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.085686922 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.085711956 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.086180925 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.086210966 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.086226940 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.086236954 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.086443901 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.088244915 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.088259935 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.088376045 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.088392019 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.089118004 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.089138985 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.089227915 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.089236975 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.089714050 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.089730978 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.089824915 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.089832067 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.095012903 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.095035076 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.095144033 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.095151901 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.111001968 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.111025095 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.111176968 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.111190081 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.113779068 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.113797903 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.113907099 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.113915920 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.165206909 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.174441099 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.174472094 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.174748898 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.174774885 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.174822092 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.174843073 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.174906015 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.174916983 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.175043106 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.175266027 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.175288916 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.175426960 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.175436020 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.175523996 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.176112890 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.176134109 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.176224947 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.176232100 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.176315069 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.176441908 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.176459074 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.176548958 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.176556110 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.176642895 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.182142973 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.182159901 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.182281017 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.182288885 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.182387114 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.197974920 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.198014975 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.198081970 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.198097944 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.198124886 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.198184967 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.208291054 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.208333969 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.208576918 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.208592892 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.208663940 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.261161089 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.261189938 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.261261940 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.261279106 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.261344910 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.261596918 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.261614084 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.261677027 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.261682987 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.261707067 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.261734009 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.262252092 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.262267113 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.262353897 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.262360096 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.262432098 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.262983084 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.263001919 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.263073921 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.263079882 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.263147116 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.263556957 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.263573885 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.263648987 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.263654947 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.263726950 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.264832973 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.269309044 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.269328117 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.269449949 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.269462109 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.269541979 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.285115004 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.285134077 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.285223961 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.285229921 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.285274029 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.297739029 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.297760010 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.297997952 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.298003912 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.298059940 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.355742931 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.355767965 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.355981112 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.356008053 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.356158018 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.356333017 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.356349945 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.356442928 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.356447935 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.356539011 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.356887102 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.356906891 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.357027054 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.357032061 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.357122898 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.357449055 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.357472897 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.357537985 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.357559919 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.357567072 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.357685089 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.358366966 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.358382940 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.358480930 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.358489037 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.377871990 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.377892017 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.377963066 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.377971888 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.378036022 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.384732962 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.384747982 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.384839058 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.384845018 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.430804968 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.439249039 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.439277887 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.439380884 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.439397097 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.439440966 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.440677881 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.440697908 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.440767050 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.440773010 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.440835953 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.442357063 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.442378044 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.442419052 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.442425013 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.442466974 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.445662022 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.445682049 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.445755959 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.445761919 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.445975065 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.450618982 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.450642109 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.450680017 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.450685978 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.450716019 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.450742006 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.451474905 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.451498985 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.451530933 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.451536894 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.451567888 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.451592922 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.464761019 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.464782000 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.464831114 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.464837074 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.464935064 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.464935064 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.476593018 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.476614952 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.476658106 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.476661921 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.476696014 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.477032900 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.526571989 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.526596069 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.526909113 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.526973963 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.527080059 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.527873039 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.527888060 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.527971029 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.527987957 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.528048038 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.529844999 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.529860973 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.529956102 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.529969931 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.530035973 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.532424927 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.532439947 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.532536030 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.532550097 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.532620907 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.537802935 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.537817955 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.537925005 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.537955999 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.538012981 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.538125038 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.538141966 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.538213015 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.538225889 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.538286924 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.551907063 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.551963091 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.552088022 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.552109003 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.552139044 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.552169085 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.564975977 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.564996958 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.565160036 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.565180063 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.565349102 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.613765001 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.613832951 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.614135981 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.614203930 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.614362955 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.617918015 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.617978096 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.618057966 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.618076086 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.618177891 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.618419886 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.618467093 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.618529081 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.618541956 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.618606091 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.618658066 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.620086908 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.620131016 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.620238066 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.620271921 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.620359898 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.625766993 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.625818014 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.625960112 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.626017094 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.626059055 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.626121044 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.626183033 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.626243114 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.626291990 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.626308918 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.626409054 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.638866901 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.638926983 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.639039993 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.639050007 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.639061928 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.639101028 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.651945114 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.652004004 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.652080059 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.652091980 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.652169943 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.700716972 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.700743914 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.700934887 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.700949907 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.701029062 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.704150915 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.704169989 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.704314947 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.704324007 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.704468012 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.704567909 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.704586029 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.704670906 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.704679012 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.704755068 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.706887960 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.706907034 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.706993103 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.706999063 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.707050085 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.712294102 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.712316036 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.712404966 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.712415934 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.712460995 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.712821007 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.712840080 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.712937117 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.712941885 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.713041067 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.726286888 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.726311922 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.726501942 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.726515055 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.726603031 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.738887072 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.738910913 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.739300013 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.739310980 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.739433050 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.795310020 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.795337915 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.795655012 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.795671940 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.795780897 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.795964003 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.795983076 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.796089888 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.796097040 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.796183109 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.797199011 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.797218084 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.797312975 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.797321081 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.797425032 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.797859907 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.797875881 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.797980070 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.797986031 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.798067093 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.800236940 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.800259113 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.800379038 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.800385952 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.800474882 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.800620079 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.800637007 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.800719023 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.800725937 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.800812006 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.814380884 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.814403057 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.814500093 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.814510107 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.814559937 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.825737953 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.825759888 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.825977087 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.825989008 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.826073885 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.888191938 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.888302088 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.888479948 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.888561964 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.888622046 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.888642073 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.888719082 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.888756990 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.888803959 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.888818026 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.888854980 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.888879061 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.888912916 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.888943911 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.888988018 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.888999939 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.889024973 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.889048100 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.889276981 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.889296055 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.889338017 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.889348984 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.889383078 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.889410973 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.889434099 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.889450073 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.889520884 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.889534950 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.889600039 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.890397072 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.890414000 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.890482903 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.890496016 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.890554905 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.900780916 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.900805950 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.904026031 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.904041052 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.904113054 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.912813902 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.912842035 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.912940025 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.912952900 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.912981033 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.913018942 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.974514961 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.974543095 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.974673033 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.974699020 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.974746943 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.974945068 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.974961042 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.975020885 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.975028038 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.975069046 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.975569963 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.975585938 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.975655079 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.975661039 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.975703955 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.975807905 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.975826979 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.975920916 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.975927114 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.975975037 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.976584911 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.976599932 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.976800919 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.976807117 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.976876974 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.976948977 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.976964951 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.977036953 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.977041960 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.977083921 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.989865065 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.989883900 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.990015984 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:28.990021944 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:28.990067959 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.000097036 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.000113964 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.000266075 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.000272989 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.000366926 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.061351061 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.061369896 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.061541080 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.061549902 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.061598063 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.061737061 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.061753035 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.061816931 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.061821938 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.061866045 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.062278032 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.062294960 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.062375069 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.062380075 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.062422037 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.062861919 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.062877893 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.062947035 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.062952995 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.062995911 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.063008070 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.063024044 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.063082933 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.063087940 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.063127995 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.063560009 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.063575029 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.063647985 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.063653946 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.063695908 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.076756954 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.076772928 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.076863050 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.076868057 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.076910019 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.091675043 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.091690063 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.091779947 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.091785908 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.091833115 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.148571014 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.148588896 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.148708105 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.148716927 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.148780107 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.149122000 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.149138927 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.149223089 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.149228096 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.149283886 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.149688959 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.149708033 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.149791956 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.149797916 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.149862051 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.150351048 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.150366068 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.150415897 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.150449991 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.150458097 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.150463104 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.150544882 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.163304090 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.163319111 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.163482904 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.163489103 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.178047895 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.178066969 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.178240061 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.178246021 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.178638935 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.178652048 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.178841114 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.178847075 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.227861881 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.235517025 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.235543013 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.235675097 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.235686064 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.235769033 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.235944033 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.235960960 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.236022949 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.236028910 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.236071110 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.236308098 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.236324072 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.236382961 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.236388922 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.236426115 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.236614943 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.236632109 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.236685038 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.236690044 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.236732960 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.237117052 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.237133026 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.237164021 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.237188101 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.237195015 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.237236023 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.237236977 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.237287045 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.237400055 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.237412930 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.237426043 CEST	49722	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.237431049 CEST	443	49722	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.794275999 CEST	49723	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.794337034 CEST	443	49723	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:29.795185089 CEST	49723	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.796504974 CEST	49723	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:29.796518087 CEST	443	49723	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:30.582948923 CEST	443	49723	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:30.583106041 CEST	49723	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:30.584978104 CEST	49723	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:30.584990025 CEST	443	49723	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:30.585227966 CEST	443	49723	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:30.586565971 CEST	49723	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:30.586616039 CEST	49723	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:30.586625099 CEST	443	49723	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:30.596242905 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:30.596275091 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:30.596388102 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:30.617419004 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:30.617429972 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:31.158688068 CEST	443	49723	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:31.158773899 CEST	443	49723	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:31.158885956 CEST	49723	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:31.159189939 CEST	49723	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:31.159209967 CEST	443	49723	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:31.159235001 CEST	49723	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:31.159240961 CEST	443	49723	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:31.347433090 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:31.347532988 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:31.357333899 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:31.357356071 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:31.357656956 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:31.399537086 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:31.523344040 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:31.564495087 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:31.998593092 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:31.998625994 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:31.998658895 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:31.998815060 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:31.998878956 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:31.998958111 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.091731071 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.091753960 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.091825008 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.096642971 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.096735001 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.096754074 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.096829891 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.101773024 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.101811886 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.101867914 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.101891041 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.101897955 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.149705887 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.176187992 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.176357031 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.186471939 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.186481953 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.186512947 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.186597109 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.186609983 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.186624050 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.189075947 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.189163923 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.189172029 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.189218044 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.199337006 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.199389935 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.199440956 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.199450016 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.199502945 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.206701994 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.206809044 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.206815958 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.206861973 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.266828060 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.266896963 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.267026901 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.267100096 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.267138004 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.267162085 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.279834986 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.279889107 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.279968023 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.279983997 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.280072927 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.282016039 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.294653893 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.294673920 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.294780970 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.294796944 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.294892073 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.309618950 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.309642076 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.309743881 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.309762955 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.309823036 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.320647955 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.320671082 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.320735931 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.320749998 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.320811987 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.358222961 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.358247042 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.358398914 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.358431101 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.358484983 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.360671997 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.360688925 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.360779047 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.360795021 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.360852003 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.366955996 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.366974115 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.367090940 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.367100954 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.367153883 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.373192072 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.373209953 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.373354912 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.373368979 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.373414040 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.382158995 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.382179022 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.382320881 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.382330894 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.382386923 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.389878988 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.389900923 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.389986992 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.389997959 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.390042067 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.400342941 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.400363922 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.400461912 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.400475025 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.400518894 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.408504009 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.408524036 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.408664942 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.408677101 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.408746958 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.419137001 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.419156075 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.419259071 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.419270992 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.419342041 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.447417974 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.447436094 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.447551012 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.447563887 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.447634935 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.452089071 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.452106953 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.452181101 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.452188969 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.452270031 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.460445881 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.460467100 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.460567951 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.460577011 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.460619926 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.466675997 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.466695070 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.466795921 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.466804028 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.466850042 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.475558996 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.475575924 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.475691080 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.475699902 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.475769043 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.485771894 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.485790968 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.485908031 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.485920906 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.485965014 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.494046926 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.494096041 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.494138956 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.494148970 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.494221926 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.504156113 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.504187107 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.504302025 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.504313946 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.504364014 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.536184072 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.536243916 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.536390066 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.536461115 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.536533117 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.536534071 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.542236090 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.542283058 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.542344093 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.542360067 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.542388916 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.542452097 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.549473047 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.549516916 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.549587965 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.549602032 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.549649000 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.549670935 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.555558920 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.555655003 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.555669069 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.555685043 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.555757046 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.555814028 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.564153910 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.564223051 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.564287901 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.564305067 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.564332962 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.564358950 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.564372063 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.574340105 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.574362993 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.574417114 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.574501038 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.574520111 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.574547052 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.582604885 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.582626104 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.582737923 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.582767963 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.593029976 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.593060970 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.593197107 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.593230009 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.624566078 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.624588966 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.624716997 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.624735117 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.629456997 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.629484892 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.629542112 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.629553080 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.629617929 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.637546062 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.637562990 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.637656927 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.637664080 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.637711048 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.643774033 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.643790007 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.643886089 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.643912077 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.643956900 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.652390003 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.652411938 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.652510881 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.652520895 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.652591944 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.662857056 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.662875891 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.662971973 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.662998915 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.663078070 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.671011925 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.671029091 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.671137094 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.671173096 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.671233892 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.681467056 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.681483984 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.681626081 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.681634903 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.681683064 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.713128090 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.713143110 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.713242054 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.713253975 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.713299036 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.718337059 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.718357086 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.718453884 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.718461990 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.718507051 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.726000071 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.726016045 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.726089001 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.726097107 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.726141930 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.732772112 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.732820034 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.732847929 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.732856989 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.732912064 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.740875006 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.740892887 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.740942001 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.740951061 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.740991116 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.751316071 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.751338005 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.751427889 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.751436949 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.759548903 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.759562969 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.759610891 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.759619951 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.759675026 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.759701014 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.759756088 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.770092964 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.770111084 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.770184040 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.770193100 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.802061081 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.802135944 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.802211046 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.802238941 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.802261114 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.802297115 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.806669950 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.806787014 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.806802988 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.806889057 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.814951897 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.815057993 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.815068960 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.815099955 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.815150023 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.823980093 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.824034929 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.824096918 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.824126005 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.824151993 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.830590963 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.830631018 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.830678940 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.830693960 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.830737114 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.840590954 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.840646029 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.840677023 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.840692043 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.840718985 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.847964048 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.848021030 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.848083973 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.848098993 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.848148108 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.859035015 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.859086990 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.859129906 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.859144926 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.859173059 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.890664101 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.890685081 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.890796900 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.890815973 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.895649910 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.895704031 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.895935059 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.895962000 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.903687954 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.903733015 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.903784990 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.903800964 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.903830051 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.903867006 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.912398100 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.912458897 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.912535906 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.912535906 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.912553072 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.912611008 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.919049025 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.919071913 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.919183969 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.919183969 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.919199944 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.919254065 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.928400993 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.928442955 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.928519964 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.928534985 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.928564072 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.928600073 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.936469078 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.936542034 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.936561108 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.936575890 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.936614037 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.936634064 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.948559046 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.948620081 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.948679924 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.948694944 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.948741913 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.948767900 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.979038000 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.979088068 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.979146957 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.979156017 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.979187012 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.979213953 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.984016895 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.984148026 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.984169960 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.984177113 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.984231949 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.987263918 CEST	49725	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:32.987308025 CEST	443	49725	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:32.987422943 CEST	49725	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:32.987890005 CEST	49725	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:32.987906933 CEST	443	49725	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:32.992755890 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.992818117 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.992876053 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:32.992892027 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:32.992935896 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.001024008 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.001084089 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.001163006 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.001199007 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.001233101 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.007493019 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.007533073 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.007601976 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.007620096 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.007649899 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.017129898 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.017184973 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.017251968 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.017298937 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.017338037 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.024969101 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.025011063 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.025083065 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.025100946 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.025129080 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.036000013 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.036053896 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.036125898 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.036175966 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.036216021 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.068126917 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.068154097 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.068213940 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.068243980 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.068268061 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.072743893 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.072770119 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.072829962 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.072841883 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.072870016 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.081187010 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.081207991 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.081265926 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.081279993 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.081295013 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.089942932 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.089965105 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.090051889 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.090060949 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.096266031 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.096282005 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.096373081 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.096380949 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.108784914 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.108814955 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.108913898 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.108939886 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.114032984 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.114078045 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.114139080 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.114154100 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.114181042 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.124821901 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.124850988 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.124958992 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.125011921 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.156594038 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.156712055 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.156830072 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.156862020 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.156876087 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.161305904 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.161362886 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.161422968 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.161447048 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.161483049 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.169601917 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.169647932 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.169701099 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.169724941 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.169751883 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.178565025 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.178623915 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.178664923 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.178688049 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.178730011 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.184704065 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.184747934 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.184827089 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.184849977 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.184864998 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.194655895 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.194709063 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.194749117 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.194771051 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.194797993 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.202702045 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.202744961 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.202788115 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.202810049 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.202828884 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.213306904 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.213367939 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.213406086 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.213429928 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.213443995 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.245171070 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.245193005 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.245273113 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.245301008 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.245317936 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.247350931 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.247417927 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.247433901 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.254226923 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.254302025 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.254328966 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.254352093 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.254378080 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.262501955 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.262547016 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.262590885 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.262613058 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.262638092 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.267584085 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.267642975 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.267693996 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.267713070 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.267771006 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.277896881 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.277940035 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.278021097 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.278040886 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.278075933 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.286094904 CEST	49726	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:33.286132097 CEST	443	49726	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:33.286232948 CEST	49726	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:33.286840916 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.286911964 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.286952019 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.286967993 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.286999941 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.287827015 CEST	49726	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:33.287851095 CEST	443	49726	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:33.296252966 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.296315908 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.296410084 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.296431065 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.296530008 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.331103086 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.331166983 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.331204891 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.331227064 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.331257105 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.335489035 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.335526943 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.335563898 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.335576057 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.335608006 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.342976093 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.343027115 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.343072891 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.343085051 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.343115091 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.356364965 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.356421947 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.356451035 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.356465101 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.356498003 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.356982946 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.357028961 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.357053995 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.357060909 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.357098103 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.362194061 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.362234116 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.362282038 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.362293959 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.362332106 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.372206926 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.372256994 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.372298956 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.372313976 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.372344017 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.379539013 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.379580975 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.379638910 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.379657984 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.379687071 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.391307116 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.391374111 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.391407013 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.391424894 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.391474962 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.422554970 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.422620058 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.422667027 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.422684908 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.422739029 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.427824974 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.427881002 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.427901030 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.427916050 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.427973986 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.427987099 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.428036928 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.431220055 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.431297064 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.444824934 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.444850922 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.444909096 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.444922924 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.444960117 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.444977045 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.446149111 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.446170092 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.446229935 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.446239948 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.446281910 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.455027103 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.455075979 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.455120087 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.455137014 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.455164909 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.455183029 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.464673042 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.464735985 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.464773893 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.464793921 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.464824915 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.464845896 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.473484993 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.473563910 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.473582029 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.473608017 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.473623991 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.473651886 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.479494095 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.479579926 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.479585886 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.479655027 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.511020899 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.511068106 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.511115074 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.511122942 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.511166096 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.511188030 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.516614914 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.516657114 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.516697884 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.516702890 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.516741037 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.516763926 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.533782005 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.533835888 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.533896923 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.533905029 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.533941031 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.533957005 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.535063982 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.535104990 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.535142899 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.535147905 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.535182953 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.535197973 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.535202026 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.535228968 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.535275936 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.543859005 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.543905020 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.543971062 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.543977976 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.544013977 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.544033051 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.553168058 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.553214073 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.553263903 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.553270102 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.553312063 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.553329945 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.553427935 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.562376976 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.562422037 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.562467098 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.562474012 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.562505007 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.562526941 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.597656965 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.597714901 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.597763062 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.597774982 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.597820044 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.597839117 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.602125883 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.602168083 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.602204084 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.602207899 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.602247953 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.602269888 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.608774900 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.608817101 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.608854055 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.608859062 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.608891010 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.608926058 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.608930111 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.622275114 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.622296095 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.622351885 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.622361898 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.622392893 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.622412920 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.623419046 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.623439074 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.623696089 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.623703003 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.623759985 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.632209063 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.632287979 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.632299900 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.632364988 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.642812967 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.642869949 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.642900944 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.642915964 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.642950058 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.642968893 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.650590897 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.650609016 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.650638103 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.650672913 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.650681019 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.650711060 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.696492910 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.697565079 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.697590113 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.697830915 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.697843075 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.697890043 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.697895050 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.697901011 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.697932959 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.697959900 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.697967052 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.697998047 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.698014021 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.704473019 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.704503059 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.704601049 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.704607010 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.704881907 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.711061001 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.711076975 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.711163998 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.711169958 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.711235046 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.711945057 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.711961985 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.712070942 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.712076902 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.712146997 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.720910072 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.720925093 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.721050024 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.721056938 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.721103907 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.731853008 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.731935024 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.731945992 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.731955051 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.732018948 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.739489079 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.739511967 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.739600897 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.739608049 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.745246887 CEST	443	49725	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:33.745326042 CEST	49725	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:33.747092962 CEST	49725	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:33.747101068 CEST	443	49725	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:33.747356892 CEST	443	49725	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:33.748651028 CEST	49725	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:33.748720884 CEST	49725	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:33.748728037 CEST	443	49725	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:33.786237001 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.786290884 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.786392927 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.786401987 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.786484003 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.786811113 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.786902905 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.786905050 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.786920071 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.786967039 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.793047905 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.793153048 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.793160915 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.793174982 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.793216944 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.799540997 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.799601078 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.799668074 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.799674988 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.799716949 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.799757004 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.800434113 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.800477028 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.800510883 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.800517082 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.800549030 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.800570965 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.801062107 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.801125050 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.809873104 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.809963942 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.810026884 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.810034990 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.810067892 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.810101032 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.820029974 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.820128918 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.820148945 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.820158005 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.820209980 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.820229053 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.824409962 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.824620008 CEST	443	49724	18.172.112.34	192.168.2.8
Jul 28, 2024 00:42:33.824623108 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.824685097 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:33.843185902 CEST	49724	443	192.168.2.8	18.172.112.34
Jul 28, 2024 00:42:34.159359932 CEST	443	49726	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:34.159442902 CEST	49726	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:34.177421093 CEST	49726	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:34.177444935 CEST	443	49726	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:34.177722931 CEST	443	49726	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:34.227732897 CEST	49726	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:34.298914909 CEST	443	49725	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:34.299035072 CEST	443	49725	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:34.299186945 CEST	49725	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:34.310452938 CEST	49725	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:34.310476065 CEST	443	49725	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:34.310627937 CEST	49725	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:34.310635090 CEST	443	49725	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:34.336149931 CEST	49726	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:34.336149931 CEST	49726	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:34.336204052 CEST	443	49726	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:34.632042885 CEST	443	49726	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:34.632306099 CEST	443	49726	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:34.632385969 CEST	49726	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:34.653201103 CEST	49726	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:34.653228045 CEST	443	49726	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:34.658912897 CEST	49727	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:34.658947945 CEST	443	49727	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:34.659010887 CEST	49727	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:34.659389973 CEST	49727	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:34.659399986 CEST	443	49727	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:35.018578053 CEST	49728	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:35.018614054 CEST	443	49728	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:35.018691063 CEST	49728	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:35.019058943 CEST	49728	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:35.019077063 CEST	443	49728	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:35.278198957 CEST	443	49727	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:35.292846918 CEST	49727	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:35.292876959 CEST	443	49727	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:35.294137001 CEST	49727	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:35.294142008 CEST	443	49727	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:35.294178009 CEST	49727	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:35.294182062 CEST	443	49727	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:35.527093887 CEST	443	49727	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:35.527228117 CEST	443	49727	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:35.527415991 CEST	49727	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:35.527445078 CEST	49727	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:35.527458906 CEST	443	49727	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:35.765516043 CEST	443	49728	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:35.765598059 CEST	49728	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:35.767332077 CEST	49728	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:35.767345905 CEST	443	49728	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:35.767618895 CEST	443	49728	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:35.768877029 CEST	49728	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:35.768987894 CEST	49728	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:35.768994093 CEST	443	49728	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:36.134677887 CEST	443	49728	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:36.134881973 CEST	443	49728	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:36.134974003 CEST	49728	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:36.135116100 CEST	49728	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:36.135138035 CEST	443	49728	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:36.135152102 CEST	49728	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:36.135158062 CEST	443	49728	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:37.019810915 CEST	49731	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:37.019870996 CEST	443	49731	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:37.020255089 CEST	49731	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:37.038707972 CEST	49731	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:37.038743019 CEST	443	49731	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:37.526417971 CEST	443	49731	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:37.526514053 CEST	49731	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:37.585866928 CEST	49731	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:37.585910082 CEST	443	49731	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:37.586884975 CEST	443	49731	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:37.586956024 CEST	49731	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:37.594502926 CEST	49731	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:37.636527061 CEST	443	49731	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:37.735527992 CEST	443	49731	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:37.735771894 CEST	443	49731	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:37.735842943 CEST	49731	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:37.735842943 CEST	49731	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:37.745253086 CEST	49731	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:37.745294094 CEST	443	49731	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:38.021704912 CEST	49732	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:38.021747112 CEST	443	49732	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:38.021828890 CEST	49732	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:38.028287888 CEST	49732	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:38.028307915 CEST	443	49732	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:38.555694103 CEST	49733	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:38.555785894 CEST	443	49733	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:38.555879116 CEST	49733	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:38.558329105 CEST	49733	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:38.558362961 CEST	443	49733	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:38.670685053 CEST	443	49732	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:38.671708107 CEST	49732	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:38.671726942 CEST	443	49732	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:38.672243118 CEST	49732	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:38.672243118 CEST	49732	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:38.672250986 CEST	443	49732	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:38.672270060 CEST	443	49732	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:38.920703888 CEST	443	49732	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:38.920845985 CEST	443	49732	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:38.923439026 CEST	49732	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:39.028507948 CEST	49732	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:39.028541088 CEST	443	49732	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:39.032567024 CEST	443	49733	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:39.035461903 CEST	49733	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:39.039494991 CEST	49733	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:39.039505959 CEST	443	49733	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:39.039932966 CEST	49733	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:39.039938927 CEST	443	49733	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:39.203437090 CEST	443	49733	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:39.203531981 CEST	443	49733	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:39.203710079 CEST	49733	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:39.205248117 CEST	49733	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:39.205293894 CEST	443	49733	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:40.031085968 CEST	49735	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:40.031131029 CEST	443	49735	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:40.031337976 CEST	49735	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:40.031572104 CEST	49735	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:40.031589985 CEST	443	49735	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:40.077203035 CEST	49737	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:40.077241898 CEST	443	49737	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:40.077307940 CEST	49737	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:40.086118937 CEST	49737	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:40.086136103 CEST	443	49737	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:40.229589939 CEST	49738	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:40.229635000 CEST	443	49738	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:40.229707956 CEST	49738	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:40.230243921 CEST	49738	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:40.230256081 CEST	443	49738	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:40.513444901 CEST	443	49735	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:40.513741970 CEST	49735	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:40.521040916 CEST	49735	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:40.521054029 CEST	443	49735	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:40.521272898 CEST	49735	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:40.521279097 CEST	443	49735	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:40.726707935 CEST	443	49735	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:40.726764917 CEST	49735	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:40.726780891 CEST	443	49735	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:40.726807117 CEST	443	49735	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:40.726824999 CEST	49735	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:40.726859093 CEST	49735	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:40.728895903 CEST	49735	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:40.728914976 CEST	443	49735	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:40.786993980 CEST	443	49737	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:40.787105083 CEST	49737	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:40.825223923 CEST	49737	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:40.825243950 CEST	443	49737	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:40.825546980 CEST	443	49737	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:40.912909985 CEST	443	49738	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:40.913002968 CEST	49738	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:40.914520025 CEST	49738	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:40.914527893 CEST	443	49738	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:40.914761066 CEST	443	49738	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:40.946196079 CEST	49738	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:40.946460962 CEST	49737	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:40.946805000 CEST	49737	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:40.992546082 CEST	443	49737	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:40.992579937 CEST	443	49738	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:41.055953026 CEST	443	49738	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:41.058029890 CEST	443	49737	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:41.080719948 CEST	49738	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:41.080749035 CEST	443	49738	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:41.083367109 CEST	49737	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:41.083383083 CEST	443	49737	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:41.192486048 CEST	443	49738	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:41.192809105 CEST	443	49738	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:41.193166971 CEST	49738	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:41.194493055 CEST	443	49737	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:41.194613934 CEST	443	49737	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:41.194668055 CEST	49737	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:41.210114956 CEST	49737	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:41.210840940 CEST	49738	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:41.211186886 CEST	49739	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:41.211277962 CEST	443	49739	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:41.211391926 CEST	49739	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:41.212816000 CEST	49740	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:41.212843895 CEST	443	49740	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:41.212899923 CEST	49740	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:41.224028111 CEST	49739	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:41.224072933 CEST	443	49739	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:41.224189043 CEST	49740	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:41.224205971 CEST	443	49740	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:41.717732906 CEST	443	49739	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:41.720685959 CEST	443	49740	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:41.735115051 CEST	49740	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:41.735153913 CEST	443	49740	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:41.737523079 CEST	49739	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:41.737545013 CEST	443	49739	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:41.860297918 CEST	443	49740	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:41.860748053 CEST	443	49739	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:41.861152887 CEST	49739	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:41.861182928 CEST	443	49739	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:41.867495060 CEST	49740	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:41.867533922 CEST	443	49740	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:41.971451044 CEST	443	49739	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:41.971585989 CEST	443	49739	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:41.971635103 CEST	49739	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:41.972070932 CEST	49739	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:41.978652000 CEST	443	49740	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:41.979265928 CEST	49740	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:41.979321003 CEST	443	49740	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:41.979377985 CEST	443	49740	3.230.219.225	192.168.2.8
Jul 28, 2024 00:42:41.979392052 CEST	49740	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:41.979425907 CEST	49740	443	192.168.2.8	3.230.219.225
Jul 28, 2024 00:42:42.490202904 CEST	49742	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:42.490252018 CEST	443	49742	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:42.490354061 CEST	49742	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:42.490875006 CEST	49742	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:42.490890026 CEST	443	49742	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:42.977078915 CEST	443	49742	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:42.977773905 CEST	49742	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:42.979811907 CEST	49742	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:42.979820967 CEST	443	49742	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:42.979989052 CEST	49742	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:42.979995012 CEST	443	49742	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:43.163736105 CEST	443	49742	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:43.163822889 CEST	443	49742	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:43.163980007 CEST	49742	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:43.165798903 CEST	49742	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:43.165823936 CEST	443	49742	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:46.083353043 CEST	49747	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:46.083389044 CEST	443	49747	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:46.083684921 CEST	49747	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:46.083960056 CEST	49747	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:46.083971024 CEST	443	49747	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:46.694133043 CEST	443	49747	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:46.696201086 CEST	49747	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:46.696229935 CEST	443	49747	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:46.697849989 CEST	49747	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:46.697858095 CEST	443	49747	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:46.697873116 CEST	49747	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:46.697880030 CEST	443	49747	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:46.947341919 CEST	443	49747	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:46.947442055 CEST	443	49747	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:46.948805094 CEST	49747	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:46.967562914 CEST	49747	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:42:46.967593908 CEST	443	49747	35.162.225.150	192.168.2.8
Jul 28, 2024 00:42:47.012537956 CEST	49748	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:47.012592077 CEST	443	49748	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:47.012868881 CEST	49748	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:47.013889074 CEST	49748	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:47.013904095 CEST	443	49748	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:47.480904102 CEST	443	49748	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:47.480972052 CEST	49748	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:47.494549036 CEST	49748	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:47.494560957 CEST	443	49748	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:47.494738102 CEST	49748	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:47.494744062 CEST	443	49748	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:47.671506882 CEST	443	49748	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:47.671601057 CEST	443	49748	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:47.671775103 CEST	49748	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:47.673255920 CEST	49748	443	192.168.2.8	188.114.96.3
Jul 28, 2024 00:42:47.673275948 CEST	443	49748	188.114.96.3	192.168.2.8
Jul 28, 2024 00:42:52.977544069 CEST	49750	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:52.977581978 CEST	443	49750	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:52.977757931 CEST	49750	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:52.978290081 CEST	49750	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:52.978311062 CEST	443	49750	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:53.743827105 CEST	443	49750	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:53.744025946 CEST	49750	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:53.745327950 CEST	49750	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:53.745347977 CEST	443	49750	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:53.745634079 CEST	443	49750	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:53.747582912 CEST	49750	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:53.747582912 CEST	49750	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:53.747606993 CEST	443	49750	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:54.309119940 CEST	443	49750	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:54.309448004 CEST	443	49750	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:54.309504986 CEST	49750	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:54.309576988 CEST	49750	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:54.309576988 CEST	49750	443	192.168.2.8	18.173.206.112
Jul 28, 2024 00:42:54.309600115 CEST	443	49750	18.173.206.112	192.168.2.8
Jul 28, 2024 00:42:54.309611082 CEST	443	49750	18.173.206.112	192.168.2.8
Jul 28, 2024 00:43:10.206275940 CEST	49761	443	192.168.2.8	104.20.94.94
Jul 28, 2024 00:43:10.206327915 CEST	443	49761	104.20.94.94	192.168.2.8
Jul 28, 2024 00:43:10.206412077 CEST	49761	443	192.168.2.8	104.20.94.94
Jul 28, 2024 00:43:10.225244999 CEST	49761	443	192.168.2.8	104.20.94.94
Jul 28, 2024 00:43:10.225275040 CEST	443	49761	104.20.94.94	192.168.2.8
Jul 28, 2024 00:43:10.722830057 CEST	443	49761	104.20.94.94	192.168.2.8
Jul 28, 2024 00:43:10.722912073 CEST	49761	443	192.168.2.8	104.20.94.94
Jul 28, 2024 00:43:11.806593895 CEST	49761	443	192.168.2.8	104.20.94.94
Jul 28, 2024 00:43:11.806619883 CEST	443	49761	104.20.94.94	192.168.2.8
Jul 28, 2024 00:43:11.807569981 CEST	443	49761	104.20.94.94	192.168.2.8
Jul 28, 2024 00:43:11.807893991 CEST	49761	443	192.168.2.8	104.20.94.94
Jul 28, 2024 00:43:11.810039043 CEST	49761	443	192.168.2.8	104.20.94.94
Jul 28, 2024 00:43:11.852507114 CEST	443	49761	104.20.94.94	192.168.2.8
Jul 28, 2024 00:43:11.986017942 CEST	443	49761	104.20.94.94	192.168.2.8
Jul 28, 2024 00:43:11.986104965 CEST	443	49761	104.20.94.94	192.168.2.8
Jul 28, 2024 00:43:11.986438036 CEST	49761	443	192.168.2.8	104.20.94.94
Jul 28, 2024 00:43:11.991041899 CEST	49761	443	192.168.2.8	104.20.94.94
Jul 28, 2024 00:43:11.991066933 CEST	443	49761	104.20.94.94	192.168.2.8
Jul 28, 2024 00:43:12.138787985 CEST	49763	443	192.168.2.8	104.20.94.94
Jul 28, 2024 00:43:12.138834000 CEST	443	49763	104.20.94.94	192.168.2.8
Jul 28, 2024 00:43:12.138952971 CEST	49763	443	192.168.2.8	104.20.94.94
Jul 28, 2024 00:43:12.173018932 CEST	49763	443	192.168.2.8	104.20.94.94
Jul 28, 2024 00:43:12.173034906 CEST	443	49763	104.20.94.94	192.168.2.8
Jul 28, 2024 00:43:12.701443911 CEST	443	49763	104.20.94.94	192.168.2.8
Jul 28, 2024 00:43:12.701625109 CEST	49763	443	192.168.2.8	104.20.94.94
Jul 28, 2024 00:43:12.703696966 CEST	49763	443	192.168.2.8	104.20.94.94
Jul 28, 2024 00:43:12.703715086 CEST	443	49763	104.20.94.94	192.168.2.8
Jul 28, 2024 00:43:12.703907013 CEST	49763	443	192.168.2.8	104.20.94.94
Jul 28, 2024 00:43:12.703913927 CEST	443	49763	104.20.94.94	192.168.2.8
Jul 28, 2024 00:43:12.900218010 CEST	443	49763	104.20.94.94	192.168.2.8
Jul 28, 2024 00:43:12.900285959 CEST	49763	443	192.168.2.8	104.20.94.94
Jul 28, 2024 00:43:12.900298119 CEST	443	49763	104.20.94.94	192.168.2.8
Jul 28, 2024 00:43:12.900343895 CEST	49763	443	192.168.2.8	104.20.94.94
Jul 28, 2024 00:43:12.905241966 CEST	49763	443	192.168.2.8	104.20.94.94
Jul 28, 2024 00:43:12.905277967 CEST	443	49763	104.20.94.94	192.168.2.8
Jul 28, 2024 00:43:41.513036013 CEST	49773	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:41.513071060 CEST	443	49773	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:41.513313055 CEST	49773	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:41.513997078 CEST	49773	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:41.514017105 CEST	443	49773	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:42.154689074 CEST	443	49773	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:42.155211926 CEST	49773	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:42.155229092 CEST	443	49773	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:42.165220976 CEST	49773	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:42.165236950 CEST	443	49773	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:42.165251970 CEST	49773	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:42.165258884 CEST	443	49773	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:42.414309978 CEST	443	49773	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:42.414854050 CEST	443	49773	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:42.414855957 CEST	49773	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:42.414931059 CEST	49773	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:43.537625074 CEST	49775	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:43.537673950 CEST	443	49775	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:43.538101912 CEST	49775	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:43.554737091 CEST	49775	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:43.554768085 CEST	443	49775	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:44.173804998 CEST	443	49775	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:44.175368071 CEST	49775	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:44.175421953 CEST	443	49775	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:44.176219940 CEST	49775	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:44.176234961 CEST	443	49775	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:44.176337004 CEST	49775	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:44.176343918 CEST	443	49775	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:44.427402973 CEST	443	49775	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:44.427495956 CEST	443	49775	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:44.427572966 CEST	49775	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:44.437839031 CEST	49775	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:44.437865019 CEST	443	49775	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:44.579658031 CEST	49776	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:44.579711914 CEST	443	49776	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:44.579794884 CEST	49776	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:44.580194950 CEST	49776	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:44.580209017 CEST	443	49776	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:45.189724922 CEST	443	49776	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:45.193027020 CEST	49776	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:45.193042994 CEST	443	49776	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:45.193856001 CEST	49776	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:45.193861008 CEST	443	49776	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:45.193902016 CEST	49776	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:45.193906069 CEST	443	49776	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:45.441847086 CEST	443	49776	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:45.441953897 CEST	443	49776	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:45.442126989 CEST	49776	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:45.499917984 CEST	49776	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:45.499929905 CEST	443	49776	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:45.605525970 CEST	49777	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:45.605560064 CEST	443	49777	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:45.605633020 CEST	49777	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:45.607558966 CEST	49777	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:45.607573986 CEST	443	49777	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:46.223561049 CEST	443	49777	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:46.224351883 CEST	49777	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:46.224376917 CEST	443	49777	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:46.225225925 CEST	49777	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:46.225230932 CEST	443	49777	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:46.225255966 CEST	49777	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:46.225259066 CEST	443	49777	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:46.479551077 CEST	443	49777	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:46.479631901 CEST	443	49777	35.162.225.150	192.168.2.8
Jul 28, 2024 00:43:46.479712963 CEST	49777	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:46.480165005 CEST	49777	443	192.168.2.8	35.162.225.150
Jul 28, 2024 00:43:46.480180979 CEST	443	49777	35.162.225.150	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 28, 2024 00:41:53.855119944 CEST	64789	53	192.168.2.8	1.1.1.1
Jul 28, 2024 00:41:53.867531061 CEST	53	64789	1.1.1.1	192.168.2.8
Jul 28, 2024 00:42:20.343059063 CEST	59999	53	192.168.2.8	1.1.1.1
Jul 28, 2024 00:42:20.361080885 CEST	53	59999	1.1.1.1	192.168.2.8
Jul 28, 2024 00:42:33.273329020 CEST	60729	53	192.168.2.8	1.1.1.1
Jul 28, 2024 00:42:33.280864000 CEST	53	60729	1.1.1.1	192.168.2.8
Jul 28, 2024 00:42:35.560033083 CEST	51103	53	192.168.2.8	1.1.1.1
Jul 28, 2024 00:42:37.006407022 CEST	63469	53	192.168.2.8	1.1.1.1
Jul 28, 2024 00:42:37.013734102 CEST	53	63469	1.1.1.1	192.168.2.8
Jul 28, 2024 00:42:40.053639889 CEST	49960	53	192.168.2.8	1.1.1.1
Jul 28, 2024 00:42:40.064867020 CEST	53	49960	1.1.1.1	192.168.2.8
Jul 28, 2024 00:43:10.191824913 CEST	52797	53	192.168.2.8	1.1.1.1
Jul 28, 2024 00:43:10.202039957 CEST	53	52797	1.1.1.1	192.168.2.8
Jul 28, 2024 00:43:17.458931923 CEST	50678	53	192.168.2.8	1.1.1.1
Jul 28, 2024 00:43:17.468035936 CEST	53	50678	1.1.1.1	192.168.2.8
Jul 28, 2024 00:43:37.941819906 CEST	49547	53	192.168.2.8	1.1.1.1
Jul 28, 2024 00:43:40.266699076 CEST	60567	53	192.168.2.8	1.1.1.1
Jul 28, 2024 00:43:40.276721001 CEST	53	60567	1.1.1.1	192.168.2.8
Jul 28, 2024 00:43:56.459935904 CEST	53205	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 28, 2024 00:41:53.855119944 CEST	192.168.2.8	1.1.1.1	0xb09e	Standard query (0)	d3cored83b0wp2.cloudfront.net	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:42:20.343059063 CEST	192.168.2.8	1.1.1.1	0xf897	Standard query (0)	shield.reasonsecurity.com	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:42:33.273329020 CEST	192.168.2.8	1.1.1.1	0x26a1	Standard query (0)	analytics.apis.mcafee.com	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:42:35.560033083 CEST	192.168.2.8	1.1.1.1	0xd08f	Standard query (0)	sadownload.mcafee.com	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:42:37.006407022 CEST	192.168.2.8	1.1.1.1	0xc602	Standard query (0)	localweatherfree.com	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:42:40.053639889 CEST	192.168.2.8	1.1.1.1	0xe40a	Standard query (0)	track.analytics-data.io	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:43:10.191824913 CEST	192.168.2.8	1.1.1.1	0x8d8	Standard query (0)	cheatengine.org	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:43:17.458931923 CEST	192.168.2.8	1.1.1.1	0x6a5f	Standard query (0)	track.analytics-data.io	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:43:37.941819906 CEST	192.168.2.8	1.1.1.1	0xf606	Standard query (0)	sadownload.mcafee.com	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:43:40.266699076 CEST	192.168.2.8	1.1.1.1	0xd06d	Standard query (0)	analytics.apis.mcafee.com	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:43:56.459935904 CEST	192.168.2.8	1.1.1.1	0xc9de	Standard query (0)	sadownload.mcafee.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 28, 2024 00:41:53.867531061 CEST	1.1.1.1	192.168.2.8	0xb09e	No error (0)	d3cored83b0wp2.cloudfront.net		18.173.206.112	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:41:53.867531061 CEST	1.1.1.1	192.168.2.8	0xb09e	No error (0)	d3cored83b0wp2.cloudfront.net		18.173.206.96	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:41:53.867531061 CEST	1.1.1.1	192.168.2.8	0xb09e	No error (0)	d3cored83b0wp2.cloudfront.net		18.173.206.93	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:41:53.867531061 CEST	1.1.1.1	192.168.2.8	0xb09e	No error (0)	d3cored83b0wp2.cloudfront.net		18.173.206.200	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:42:20.361080885 CEST	1.1.1.1	192.168.2.8	0xf897	No error (0)	shield.reasonsecurity.com	d14mh4uvqj4iiz.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 28, 2024 00:42:20.361080885 CEST	1.1.1.1	192.168.2.8	0xf897	No error (0)	d14mh4uvqj4iiz.cloudfront.net		18.172.112.34	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:42:20.361080885 CEST	1.1.1.1	192.168.2.8	0xf897	No error (0)	d14mh4uvqj4iiz.cloudfront.net		18.172.112.38	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:42:20.361080885 CEST	1.1.1.1	192.168.2.8	0xf897	No error (0)	d14mh4uvqj4iiz.cloudfront.net		18.172.112.11	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:42:20.361080885 CEST	1.1.1.1	192.168.2.8	0xf897	No error (0)	d14mh4uvqj4iiz.cloudfront.net		18.172.112.22	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:42:33.280864000 CEST	1.1.1.1	192.168.2.8	0x26a1	No error (0)	analytics.apis.mcafee.com	mosaic-orio.apis.mcafee.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 28, 2024 00:42:33.280864000 CEST	1.1.1.1	192.168.2.8	0x26a1	No error (0)	mosaic-orio.apis.mcafee.com		35.162.225.150	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:42:33.280864000 CEST	1.1.1.1	192.168.2.8	0x26a1	No error (0)	mosaic-orio.apis.mcafee.com		52.88.32.120	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:42:33.280864000 CEST	1.1.1.1	192.168.2.8	0x26a1	No error (0)	mosaic-orio.apis.mcafee.com		44.237.127.202	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:42:33.280864000 CEST	1.1.1.1	192.168.2.8	0x26a1	No error (0)	mosaic-orio.apis.mcafee.com		35.163.196.185	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:42:33.280864000 CEST	1.1.1.1	192.168.2.8	0x26a1	No error (0)	mosaic-orio.apis.mcafee.com		52.32.251.56	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:42:33.280864000 CEST	1.1.1.1	192.168.2.8	0x26a1	No error (0)	mosaic-orio.apis.mcafee.com		52.36.210.252	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:42:33.280864000 CEST	1.1.1.1	192.168.2.8	0x26a1	No error (0)	mosaic-orio.apis.mcafee.com		52.10.161.213	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:42:33.280864000 CEST	1.1.1.1	192.168.2.8	0x26a1	No error (0)	mosaic-orio.apis.mcafee.com		54.190.82.174	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:42:35.574091911 CEST	1.1.1.1	192.168.2.8	0xd08f	No error (0)	sadownload.mcafee.com	sadownload-r53.awsconsumer.mcafee.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 28, 2024 00:42:35.574091911 CEST	1.1.1.1	192.168.2.8	0xd08f	No error (0)	sadownload-r53.awsconsumer.mcafee.com	sadownload.mcafee.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 28, 2024 00:42:37.013734102 CEST	1.1.1.1	192.168.2.8	0xc602	No error (0)	localweatherfree.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:42:37.013734102 CEST	1.1.1.1	192.168.2.8	0xc602	No error (0)	localweatherfree.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:42:40.064867020 CEST	1.1.1.1	192.168.2.8	0xe40a	No error (0)	track.analytics-data.io	atom-production-collector-cyber-224812358.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 28, 2024 00:42:40.064867020 CEST	1.1.1.1	192.168.2.8	0xe40a	No error (0)	atom-production-collector-cyber-224812358.us-east-1.elb.amazonaws.com		3.230.219.225	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:42:40.064867020 CEST	1.1.1.1	192.168.2.8	0xe40a	No error (0)	atom-production-collector-cyber-224812358.us-east-1.elb.amazonaws.com		44.199.83.23	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:42:40.064867020 CEST	1.1.1.1	192.168.2.8	0xe40a	No error (0)	atom-production-collector-cyber-224812358.us-east-1.elb.amazonaws.com		52.204.15.254	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:43:10.202039957 CEST	1.1.1.1	192.168.2.8	0x8d8	No error (0)	cheatengine.org		104.20.94.94	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:43:10.202039957 CEST	1.1.1.1	192.168.2.8	0x8d8	No error (0)	cheatengine.org		172.67.35.220	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:43:10.202039957 CEST	1.1.1.1	192.168.2.8	0x8d8	No error (0)	cheatengine.org		104.20.95.94	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:43:17.468035936 CEST	1.1.1.1	192.168.2.8	0x6a5f	No error (0)	track.analytics-data.io	atom-production-collector-cyber-224812358.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 28, 2024 00:43:17.468035936 CEST	1.1.1.1	192.168.2.8	0x6a5f	No error (0)	atom-production-collector-cyber-224812358.us-east-1.elb.amazonaws.com		52.204.15.254	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:43:17.468035936 CEST	1.1.1.1	192.168.2.8	0x6a5f	No error (0)	atom-production-collector-cyber-224812358.us-east-1.elb.amazonaws.com		44.199.83.23	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:43:17.468035936 CEST	1.1.1.1	192.168.2.8	0x6a5f	No error (0)	atom-production-collector-cyber-224812358.us-east-1.elb.amazonaws.com		3.230.219.225	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:43:37.949142933 CEST	1.1.1.1	192.168.2.8	0xf606	No error (0)	sadownload.mcafee.com	sadownload-r53.awsconsumer.mcafee.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 28, 2024 00:43:37.949142933 CEST	1.1.1.1	192.168.2.8	0xf606	No error (0)	sadownload-r53.awsconsumer.mcafee.com	sadownload.mcafee.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 28, 2024 00:43:40.276721001 CEST	1.1.1.1	192.168.2.8	0xd06d	No error (0)	analytics.apis.mcafee.com	mosaic-orio.apis.mcafee.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 28, 2024 00:43:40.276721001 CEST	1.1.1.1	192.168.2.8	0xd06d	No error (0)	mosaic-orio.apis.mcafee.com		54.149.154.10	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:43:40.276721001 CEST	1.1.1.1	192.168.2.8	0xd06d	No error (0)	mosaic-orio.apis.mcafee.com		52.36.210.252	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:43:40.276721001 CEST	1.1.1.1	192.168.2.8	0xd06d	No error (0)	mosaic-orio.apis.mcafee.com		52.40.48.56	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:43:40.276721001 CEST	1.1.1.1	192.168.2.8	0xd06d	No error (0)	mosaic-orio.apis.mcafee.com		54.188.207.95	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:43:40.276721001 CEST	1.1.1.1	192.168.2.8	0xd06d	No error (0)	mosaic-orio.apis.mcafee.com		54.190.82.174	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:43:40.276721001 CEST	1.1.1.1	192.168.2.8	0xd06d	No error (0)	mosaic-orio.apis.mcafee.com		35.163.196.185	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:43:40.276721001 CEST	1.1.1.1	192.168.2.8	0xd06d	No error (0)	mosaic-orio.apis.mcafee.com		52.26.181.132	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:43:40.276721001 CEST	1.1.1.1	192.168.2.8	0xd06d	No error (0)	mosaic-orio.apis.mcafee.com		52.88.32.120	A (IP address)	IN (0x0001)	false
Jul 28, 2024 00:43:56.469280005 CEST	1.1.1.1	192.168.2.8	0xc9de	No error (0)	sadownload.mcafee.com	sadownload-r53.awsconsumer.mcafee.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 28, 2024 00:43:56.469280005 CEST	1.1.1.1	192.168.2.8	0xc9de	No error (0)	sadownload-r53.awsconsumer.mcafee.com	sadownload.mcafee.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

d3cored83b0wp2.cloudfront.net

shield.reasonsecurity.com

localweatherfree.com

track.analytics-data.io

cheatengine.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	18.173.206.112	443	7824	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:41:54 UTC	233	OUT	POST /o HTTP/1.1 Connection: Keep-Alive Content-Type: application/json; Charset=UTF-8 Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 125 Host: d3cored83b0wp2.cloudfront.net
2024-07-27 22:41:54 UTC	125	OUT	Data Raw: 7b 22 70 72 76 22 3a 20 22 30 2e 31 22 2c 22 70 6c 76 22 3a 20 22 31 2e 33 34 2e 33 2e 38 33 34 31 22 2c 22 6c 22 3a 20 22 65 6e 22 2c 22 61 22 3a 20 22 63 68 65 61 74 65 6e 67 69 6e 65 22 2c 22 69 22 3a 20 22 63 68 65 61 74 65 6e 67 69 6e 65 22 2c 22 73 22 3a 20 22 63 68 65 61 74 65 6e 67 69 6e 65 22 2c 22 6f 22 3a 20 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 22 7d Data Ascii: {"prv": "0.1","plv": "1.34.3.8341","l": "en","a": "cheatengine","i": "cheatengine","s": "cheatengine","o": "10.0.19045.2006"}
2024-07-27 22:41:55 UTC	490	IN	HTTP/1.1 200 OK Content-Type: application/json Content-Length: 11056 Connection: close Server: awselb/2.0 Date: Sat, 27 Jul 2024 22:41:55 GMT cache-control: no-cache x-true-request-id: 489cebea-a7db-46ad-b1a6-942946f2cdbf x-robots-tag: none expires: Thu, 01 Jan 1970 00:00:00 GMT X-Cache: Miss from cloudfront Via: 1.1 43be4ee3b8e339e1d27addbbdc49a4d4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P12 X-Amz-Cf-Id: Qb58WEA_3Gqs-6jnPQq68j4nvXKK1FUluQ0dM_-v7LktsuI9s1siWg==
2024-07-27 22:41:55 UTC	7895	IN	Data Raw: 7b 22 76 22 3a 22 30 2e 31 22 2c 22 6c 22 3a 22 55 53 22 2c 22 69 22 3a 7b 22 63 75 22 3a 22 22 2c 22 63 74 22 3a 22 22 2c 22 63 70 22 3a 22 22 2c 22 63 74 75 22 3a 22 22 2c 22 63 6c 22 3a 22 22 2c 22 63 68 22 3a 22 22 2c 22 63 61 22 3a 22 76 35 2e 38 33 22 2c 22 63 66 22 3a 22 22 2c 22 63 70 69 22 3a 22 22 2c 22 63 70 73 22 3a 22 22 2c 22 63 64 22 3a 22 22 2c 22 63 70 72 22 3a 22 22 2c 22 63 70 70 22 3a 22 22 2c 22 63 66 6c 22 3a 22 22 2c 22 63 6a 22 3a 22 2b 31 22 2c 22 63 62 22 3a 22 22 2c 22 63 6f 64 22 3a 22 22 2c 22 63 74 70 22 3a 22 22 2c 22 63 65 70 22 3a 22 22 7d 2c 22 66 22 3a 7b 22 6d 22 3a 33 2c 22 78 22 3a 22 32 30 32 35 2d 30 33 2d 31 33 54 32 32 3a 34 31 3a 35 35 2e 32 33 37 5a 22 2c 22 61 22 3a 22 63 64 63 32 22 2c 22 64 22 3a 22 38 39 22 Data Ascii: {"v":"0.1","l":"US","i":{"cu":"","ct":"","cp":"","ctu":"","cl":"","ch":"","ca":"v5.83","cf":"","cpi":"","cps":"","cd":"","cpr":"","cpp":"","cfl":"","cj":"+1","cb":"","cod":"","ctp":"","cep":""},"f":{"m":3,"x":"2025-03-13T22:41:55.237Z","a":"cdc2","d":"89"
2024-07-27 22:41:55 UTC	3161	IN	Data Raw: 6f 22 3a 22 41 56 41 53 54 22 7d 2c 22 70 73 22 3a 7b 22 69 22 3a 22 41 56 41 53 54 2f 69 6d 61 67 65 73 2f 44 4f 54 50 53 2d 31 35 31 31 2f 35 34 37 58 32 38 30 2f 45 4e 2e 70 6e 67 22 2c 22 64 6e 22 3a 22 41 76 61 73 74 20 41 6e 74 69 76 69 72 75 73 22 2c 22 75 22 3a 22 41 56 41 53 54 2f 66 69 6c 65 73 2f 63 6f 6f 6b 69 65 5f 6d 6d 6d 5f 69 72 73 5f 70 70 69 5f 30 30 35 5f 38 38 38 5f 61 2e 7a 69 70 22 2c 22 70 22 3a 22 2f 73 69 6c 65 6e 74 20 2f 77 73 20 2f 70 73 68 3a 7b 70 78 6c 7d 22 2c 22 72 76 64 22 3a 5b 22 48 4b 4c 4d 5c 5c 53 59 53 54 45 4d 5c 5c 43 75 72 72 65 6e 74 43 6f 6e 74 72 6f 6c 53 65 74 5c 5c 43 6f 6e 74 72 6f 6c 5c 5c 53 65 73 73 69 6f 6e 20 4d 61 6e 61 67 65 72 5c 5c 45 6e 76 69 72 6f 6e 6d 65 6e 74 5c 5c 50 52 4f 43 45 53 53 4f 52 Data Ascii: o":"AVAST"},"ps":{"i":"AVAST/images/DOTPS-1511/547X280/EN.png","dn":"Avast Antivirus","u":"AVAST/files/cookie_mmm_irs_ppi_005_888_a.zip","p":"/silent /ws /psh:{pxl}","rvd":["HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment\\PROCESSOR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49707	18.173.206.112	443	7824	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:41:56 UTC	326	OUT	POST /zbd HTTP/1.1 Connection: Keep-Alive Content-Type: application/json; Charset=UTF-8 Accept: / Authorization: Signature=e09076fb7be72413458f55a70553fc9fe7a788e10f08e18ca857b7883846325f User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 276 Host: d3cored83b0wp2.cloudfront.net
2024-07-27 22:41:56 UTC	276	OUT	Data Raw: 7b 22 74 61 62 6c 65 22 3a 22 7a 62 5f 61 6e 61 6c 79 74 69 63 73 22 2c 22 64 61 74 61 22 3a 22 7b 5c 22 30 5c 22 3a 5c 22 5c 22 2c 5c 22 31 5c 22 3a 5c 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5c 22 2c 5c 22 32 5c 22 3a 5c 22 32 30 32 34 30 37 32 37 31 38 34 31 35 34 5c 22 2c 5c 22 33 5c 22 3a 5c 22 63 68 65 61 74 65 6e 67 69 6e 65 5c 22 2c 5c 22 34 5c 22 3a 5c 22 63 68 65 61 74 65 6e 67 69 6e 65 5c 22 2c 5c 22 35 5c 22 3a 5c 22 5c 22 2c 5c 22 31 38 5c 22 3a 5c 22 5c 22 2c 5c 22 31 39 5c 22 3a 5c 22 5c 22 2c 5c 22 32 31 5c 22 3a 5c 22 31 33 33 5c 22 2c 5c 22 36 5c 22 3a 5c 22 31 5c 22 2c 5c 22 37 5c 22 3a 5c 22 31 2e 33 34 2e 33 2e 38 33 34 31 5c 22 2c 5c 22 31 35 5c 22 3a 30 2c 5c 22 Data Ascii: {"table":"zb_analytics","data":"{\"0\":\"\",\"1\":\"9e146be9-c76a-4720-bcdb-53011b87bd06\",\"2\":\"20240727184154\",\"3\":\"cheatengine\",\"4\":\"cheatengine\",\"5\":\"\",\"18\":\"\",\"19\":\"\",\"21\":\"133\",\"6\":\"1\",\"7\":\"1.34.3.8341\",\"15\":0,\"
2024-07-27 22:41:56 UTC	428	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 15 Connection: close Date: Sat, 27 Jul 2024 22:41:56 GMT Access-Control-Allow-Methods: GET,HEAD,PUT,POST,DELETE Access-Control-Allow-Origin: * X-Cache: Miss from cloudfront Via: 1.1 ba01631fe255b1896a9e6bfd4c86a06a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P12 X-Amz-Cf-Id: H8RG2toid98Cyh6kW9jXESMyFFlCo207lwdnz37BevfAkXNOJoQJ9w==
2024-07-27 22:41:56 UTC	15	IN	Data Raw: 7b 22 53 74 61 74 75 73 22 3a 22 4f 4b 22 7d Data Ascii: {"Status":"OK"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49708	18.173.206.112	443	7824	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:41:57 UTC	149	OUT	GET /f/RAV_Triple_NCB/images/DOTPS-855/EN.png HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.1.2 Host: d3cored83b0wp2.cloudfront.net
2024-07-27 22:41:57 UTC	571	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 75974 Connection: close Last-Modified: Sun, 11 Sep 2022 12:56:32 GMT x-amz-meta-cb-modifiedtime: Sun, 11 Sep 2022 10:58:27 GMT x-amz-version-id: mCoh4hrlqpNiFIHFPwsLWmtCICuCsWOt Accept-Ranges: bytes Server: AmazonS3 Date: Sat, 27 Jul 2024 04:21:35 GMT ETag: "cd09f361286d1ad2622ba8a57b7613bd" X-Cache: Hit from cloudfront Via: 1.1 f41688bac877227b82b3347b2428d266.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P12 X-Amz-Cf-Id: Gzz3PGmFvlD9Ap82U3N6dPf-XRzwYuMbO3HmhfDnfZwqon8jOM1TiQ== Age: 70789
2024-07-27 22:41:57 UTC	15813	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 bc 00 00 01 68 08 06 00 00 00 b5 fd 28 e7 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 01 28 5b 49 44 41 54 78 01 ec bd 0b 9c 1d 55 95 2f fc 3f dd 9d a4 11 30 27 f2 48 00 25 95 41 24 0a 4e 9f cc e0 10 74 a0 2b d7 ab 20 dc 31 8d 8e 02 de ab 5d ed 38 c2 c0 38 dd 11 d4 71 be 19 fa 44 9d 4f 51 98 74 3e 47 c0 b9 a3 7d 5a ee 88 78 d5 74 0b 28 e0 9d db d5 e0 23 11 86 9c f0 d0 c4 0c 93 0a 02 76 46 30 27 3c 3b 21 dd e7 3b ab 6b af ec 5d fb 54 d5 a9 f3 ea ee 74 f6 ff f7 ab 5f 55 ed e7 da 6b af bd f6 da 8f da 05 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 18 Data Ascii: PNGIHDRh(pHYssRGBgAMAa([IDATxU/?0'H%A$Nt+ 1]88qDOQt>G}Zxt(#vF0'<;!;k]Tt_Uk
2024-07-27 22:41:58 UTC	12969	IN	Data Raw: e6 06 cc c3 3f 15 36 c3 e0 a5 46 ec 25 08 57 2f 33 a3 e2 a7 63 fc 2b 8d aa 1b 51 c1 0e 1a 83 b4 76 d7 fd 88 d6 dd 9a 3b 8d ce f2 68 cc 12 44 a1 c2 7b ad f0 d0 18 70 19 c3 78 e0 a1 3a a8 c6 22 dd 69 66 9f 46 be ea 47 5a 16 7c 65 44 1d 9b a3 c4 a5 fc 6d 04 47 ed 3c cb 4b ef dd 48 fe b1 e2 08 64 87 d4 87 e8 6d 10 03 55 a4 49 a0 f2 ad 17 34 55 3b 48 71 c5 5d 55 8a 3a 3a 50 df 07 99 b1 68 5b b8 a8 bd b5 a5 e5 ca 63 16 1f b7 8c 36 dc 1e 93 3e 2e 20 8b a5 f7 fc 09 2b 4e 0f 3d d9 e0 de af 5d bf 9a 3e 50 a3 3d bb f4 4e c6 6f e9 ca db 97 5f 9d bf b9 ef 92 2b d4 19 d4 57 1d 9b 2e e8 69 bf 66 e9 6b c7 8f 4e 1f 3f f1 ca c4 cb 33 fe c3 8a 37 bd ed 9d 5e c9 e0 c5 d6 1f 7d 77 7a ef 2d 19 f6 e7 fc b7 ca 1f b9 f1 f6 0b 9a 91 5e 6a bd 61 fb 71 27 59 7b 4e 3a ed 4d bb 1f bc Data Ascii: ?6F%W/3c+Qv;hD{px:"ifFGZ\|eDmG<KHdmUI4U;Hq]U::Ph[c6>. +N=]>P=No_+W.ifkN?37^}wz-^jaq'Y{N:M
2024-07-27 22:41:58 UTC	16384	IN	Data Raw: d5 f7 a2 a3 5f 5d d8 ff e2 73 69 eb cd 7f b4 d9 be f4 ea 7c dc 71 66 ff e5 43 7d 85 fc ff f9 1e f3 41 95 fd b0 bd d4 1e 64 9f c3 5b 1b d8 48 72 51 19 ae c8 67 2b 7c 3e 86 c9 12 b9 11 cf f3 8a 1b d1 93 41 63 b6 52 64 21 3f b0 f5 e0 b7 7b aa 8b 9c f0 d7 fb 27 02 b7 0b 8a 4b 6d 86 65 88 2e 96 11 bb 4e fa 46 44 1a 7a 1f ce ed 50 a7 27 27 9e e9 ce df 2b 10 c6 50 fd c0 40 d5 07 8e e6 46 c8 42 f6 61 3c 68 19 46 75 fb ed c3 e0 41 0e a2 59 a7 e6 84 9f 0b bf 5f da 20 2e 0f e5 1f 4f 73 bf dd 05 bf df 56 eb 8e c2 5b a8 be 6f a3 b0 7a 1d 33 1d 24 37 f9 84 69 a8 7d 3e 97 67 5e 22 05 83 24 60 21 f7 34 77 07 be 12 25 03 da 12 6e 5e 44 1a 95 fc ab a5 87 50 cf 88 b5 52 fa dc b1 16 22 fc f5 fc 2d 71 f7 50 7d 9a 95 ca 53 89 9e d9 40 1c 0f 6a a1 b3 96 32 5a e2 ee 55 e9 97 24 Data Ascii: _]si\|qfC}Ad[HrQg+\|>AcRd!?{'Kme.NFDzP''+P@FBa<hFuAY_ .OsV[oz3$7i}>g^"$`!4w%n^DPR"-qP}S@j2ZU$
2024-07-27 22:41:58 UTC	16384	IN	Data Raw: 6b c7 bc e6 84 71 3a 7b f7 5d 57 fc 4d e4 36 b8 a9 54 aa 30 d0 b3 26 89 71 18 46 7b a5 ce 9e 8d 20 5d df f0 92 3c f1 3f 07 c9 f7 2c e4 76 09 d6 77 2e a2 eb 29 87 ea 75 a5 8e 4b 20 8f 9c f3 44 7a c4 af be 84 f1 55 f9 70 34 37 42 16 c1 13 11 74 79 8d 4a d3 45 70 8f 2f eb 9b 46 19 8f 1e fc 36 a6 b6 77 08 37 2f 22 8e 5a 9f 14 46 af 0f 5d 7f 30 1f a2 d2 ab 16 49 ec 16 bd 3e d3 28 ff e0 90 64 25 83 e4 75 cc 70 51 7d 5f 35 ef 90 c2 e1 0d 4b dc 3d 34 16 56 85 74 d9 9f 47 66 71 70 e0 0b 59 12 e3 26 0d b9 bc 54 8b 22 67 58 55 a6 61 89 7b 58 9c 5a 69 b2 c4 dd 4b 10 96 14 2a 9f 08 51 09 4c 4f 54 da 56 8c 5f a3 41 8a a7 a0 e5 95 85 df f1 ad 8a 89 c7 65 f0 50 1d 2c 71 f7 d0 5c a4 df ff d7 1b fb 16 9f 78 72 fb e2 e3 96 85 ce c6 3d fd f8 a3 e9 a3 d3 c7 4f 44 f9 57 85 29 Data Ascii: kq:{]WM6T0&qF{ ]<?,vw.)uK DzUp47BtyJEp/F6w7/"ZF]0I>(d%upQ}_5K=4VtGfqpY&T"gXUa{XZiK*QLOTV_AeP,q\xr=ODW)
2024-07-27 22:41:58 UTC	14424	IN	Data Raw: eb 54 d7 14 79 45 47 2b 1f 53 58 5a 19 fc 34 77 75 99 26 f5 d9 76 1b 87 27 aa 99 bf ff c3 57 51 7d fa cc b3 2e 3b 8c 65 80 56 4c 6f f9 a7 eb fa af 7c c5 eb 0f f0 9b 0d 68 85 96 fe 0e 25 fb 0d ad c6 2e 6c 59 98 37 b6 df 3d bc e3 35 0f dc 7f 5f 6d 83 79 da e1 c7 5c 60 ee 7e c6 f3 7f fe d0 a7 9a ef 18 2c 4a 9b f6 06 3f f2 ec 73 5b 67 d7 1e 93 91 a1 47 6f 78 e2 91 c7 5e f8 e4 ca ca 9f ca 75 d6 bc 91 3b 3d 75 d3 a6 6f 4f 1f 36 e7 3f f1 29 29 fb 5d 78 f1 b3 d3 db 6f 9e d8 4a 7b 85 79 e5 97 dc 1f f8 e1 f7 cf a4 95 6e 3f ef f9 f3 a9 73 1e bb e1 44 de fe c5 c0 a3 37 3e a9 63 b9 e8 fd ba 0f 3d f4 e3 0f 8d 0e 6e 0b 8d 8d c4 fe c6 70 13 74 13 9d 59 ac 3e 24 39 e1 2d 73 34 11 5f 63 f3 25 59 8a 90 2d d3 72 61 d0 79 fe 48 e0 56 c5 a6 6c 9c 71 e1 1f 1a 43 72 45 b3 0a 65 Data Ascii: TyEG+SXZ4wu&v'WQ}.;eVLo\|h%.lY7=5_my\`~,J?s[gGox^u;=uoO6?))]xoJ{yn?sD7>c=nptY>$9-s4_c%Y-rayHVlqCrEe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49709	18.173.206.112	443	7824	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:41:58 UTC	139	OUT	GET /f/WebAdvisor/images/943/EN.png HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.1.2 Host: d3cored83b0wp2.cloudfront.net
2024-07-27 22:41:59 UTC	512	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 48743 Connection: close Last-Modified: Wed, 23 Nov 2022 15:50:00 GMT x-amz-version-id: RW9gnZViDqHn6sjOaRWUaFg5F2z0vnXM Accept-Ranges: bytes Server: AmazonS3 Date: Sat, 27 Jul 2024 04:17:52 GMT ETag: "4cfff8dc30d353cd3d215fd3a5dbac24" X-Cache: Hit from cloudfront Via: 1.1 b44afb2a44376871c20edb8c123ed47c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P12 X-Amz-Cf-Id: 67dOHuS6KbGqcqz7tgtQRP74j8YoIKFmYGh4mRhHvw6hwsLQO-sWlA== Age: 70790
2024-07-27 22:41:59 UTC	16384	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 bc 00 00 01 68 08 06 00 00 00 b5 fd 28 e7 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 bd fc 49 44 41 54 78 01 ec bd bf b3 65 49 75 e7 bb ab 1b 01 c6 28 d4 0a 59 33 31 11 7d 71 c0 19 05 8d 60 14 a1 e7 74 e1 cf 04 8d 5a 83 c4 38 74 3b 78 33 c0 5f 40 e1 8c 33 06 30 de 7b 0e 45 84 22 80 26 1a 35 a1 67 8d 43 e1 bc 89 90 40 0d 92 25 9c 3e 72 84 35 a1 ea d0 18 42 02 ea ed 4f d5 fe dc 5e b5 2a f7 af 73 f6 b9 f7 dc 7b d6 37 e2 dc 7b ce fe 91 b9 72 e5 ca 95 2b 57 ae cc ec ba 42 a1 50 28 14 0a 85 42 a1 50 28 14 0a 85 42 a1 50 28 14 0a 85 42 a1 50 28 14 0a 85 42 a1 50 28 14 0a 85 42 a1 50 28 14 0a 85 Data Ascii: PNGIHDRh(pHYssRGBgAMAaIDATxeIu(Y31}q`tZ8t;x3_@30{E"&5gC@%>r5BO^*s{7{r+WBP(BP(BP(BP(BP(BP(
2024-07-27 22:41:59 UTC	16384	IN	Data Raw: 1a d0 99 67 8f c1 12 4f 58 f6 be 39 68 58 0b 63 f9 e0 27 65 a0 2c d4 c9 b1 3a 2b 68 cc 86 4a 5e 70 17 81 82 86 3f f2 d8 f0 93 35 de 42 43 2a 90 95 58 b7 f0 f0 10 c3 61 97 62 47 a5 a9 15 43 b9 1b 16 6f ea 09 33 56 3a 7a 4a 33 62 a7 e5 54 2e 1f d2 d1 20 3b 14 ce 0c 44 be f0 c9 5e fe 16 6d c8 08 1f bd 44 a6 97 eb 57 2f 53 34 26 5a 7c 1b 83 ed db b8 58 3a e8 8b 34 dd 1e d3 3b 74 5b 3f a1 c1 ab 71 eb ec 91 53 ca fb b4 b7 16 5a 3a c0 f6 1d eb 20 ea 96 31 9d 74 4c 64 9e 5a 0f c8 3b 3c 71 6a 3d eb 42 64 c9 36 a1 17 50 e4 c5 81 fb 22 4e d9 8b 39 4f ac 6d 88 fc e3 2c c5 58 7a d6 c9 98 51 bc af 2e c9 7c b5 ad 8c b5 bf 18 22 16 d3 88 7d 80 b3 30 71 cb c6 56 5f e9 7a 0d f5 3f f5 13 3d df 6b 60 de b1 fd ef 42 dc fb 6d 47 19 bc 85 49 d0 a0 6d b8 ae e0 9d f2 da d8 70 a3 Data Ascii: gOX9hXc'e,:+hJ^p?5BC*XabGCo3V:zJ3bT. ;D^mDW/S4&Z\|X:4;t[?qSZ: 1tLdZ;<qj=Bd6P"N9Om,XzQ.\|"}0qV_z?=k`BmGImp
2024-07-27 22:41:59 UTC	15975	IN	Data Raw: 82 48 e3 75 e8 3d 3c bb 1e 45 1e 77 77 f0 70 06 ee b1 8d 58 36 6e 6f 7a 3b 41 de 3c 88 e6 aa 8e ca 8e a8 be a0 30 85 f2 f0 9e 11 f2 34 8d e7 cd 3b 0d c5 27 4f 41 31 ad cc a8 d9 53 89 e2 7d 94 0b 1e 8c 38 5d 17 a7 a1 9d d2 32 7d 3c 00 ad 6b 00 3a 3c 89 86 ff f9 74 27 68 8e 74 7a 5c 22 ef 79 ac 68 6b fa 8a e7 72 5a 4e f3 8e 29 47 9e b7 4c 9e 30 93 a7 c9 a0 db 67 f8 1d cb 4d ba 91 d6 a5 47 f9 52 96 98 66 9c 4e 6b f1 7a ec 88 52 ca 47 fe 31 bd 58 06 00 fd f2 9b 67 48 7b 8c 1f f2 6b 2a bd 4c 5f e6 49 9c aa 35 bd 31 1e 22 1f 7c a7 7c ad 29 4f 4f dd ca e5 8f a1 2c 4e af 46 7e 45 7e b6 a6 83 a7 a6 88 f7 69 3b 11 96 23 e7 01 2f 6c 5f 99 67 f2 2d f2 28 4f 87 47 c8 57 e4 cd 3a ca 21 0d 71 da 59 9a 2d 4b e6 65 ab ae 0d 45 60 3b ba b1 a9 f7 39 f9 8f 21 0d f2 55 9a e5 Data Ascii: Hu=<EwwpX6noz;A<04;'OA1S}8]2}<k:<t'htz\"yhkrZN)GL0gMGRfNkzRG1XgH{k*L_I51"\|\|)OO,NF~E~i;#/l_g-(OGW:!qY-KeE`;9!U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49710	18.173.206.112	443	7824	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:42:00 UTC	326	OUT	POST /zbd HTTP/1.1 Connection: Keep-Alive Content-Type: application/json; Charset=UTF-8 Accept: / Authorization: Signature=e09076fb7be72413458f55a70553fc9fe7a788e10f08e18ca857b7883846325f User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 352 Host: d3cored83b0wp2.cloudfront.net
2024-07-27 22:42:00 UTC	352	OUT	Data Raw: 7b 22 74 61 62 6c 65 22 3a 22 7a 62 5f 61 6e 61 6c 79 74 69 63 73 22 2c 22 64 61 74 61 22 3a 22 7b 5c 22 30 5c 22 3a 5c 22 5c 22 2c 5c 22 31 5c 22 3a 5c 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5c 22 2c 5c 22 32 5c 22 3a 5c 22 32 30 32 34 30 37 32 37 31 38 34 31 35 34 5c 22 2c 5c 22 33 5c 22 3a 5c 22 63 68 65 61 74 65 6e 67 69 6e 65 5c 22 2c 5c 22 34 5c 22 3a 5c 22 63 68 65 61 74 65 6e 67 69 6e 65 5c 22 2c 5c 22 35 5c 22 3a 5c 22 57 65 62 63 6f 6d 70 61 6e 69 6f 6e 32 30 31 36 46 46 5c 22 2c 5c 22 31 38 5c 22 3a 5c 22 5a 42 5f 57 65 62 63 6f 6d 70 61 6e 69 6f 6e 46 46 5f 6e 65 77 5c 22 2c 5c 22 31 39 5c 22 3a 5c 22 5c 22 2c 5c 22 32 31 5c 22 3a 5c 22 31 33 33 5c 22 2c 5c 22 36 5c 22 3a Data Ascii: {"table":"zb_analytics","data":"{\"0\":\"\",\"1\":\"9e146be9-c76a-4720-bcdb-53011b87bd06\",\"2\":\"20240727184154\",\"3\":\"cheatengine\",\"4\":\"cheatengine\",\"5\":\"Webcompanion2016FF\",\"18\":\"ZB_WebcompanionFF_new\",\"19\":\"\",\"21\":\"133\",\"6\":
2024-07-27 22:42:00 UTC	428	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 15 Connection: close Date: Sat, 27 Jul 2024 22:42:00 GMT Access-Control-Allow-Methods: GET,HEAD,PUT,POST,DELETE Access-Control-Allow-Origin: * X-Cache: Miss from cloudfront Via: 1.1 e23d0cd26e88be416569e15d7299b25c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P12 X-Amz-Cf-Id: 0XAtDpK4JOgr5MhGq5MA081uJXlrJSd7qfC-dTAt0L-eSiqABFVpzw==
2024-07-27 22:42:00 UTC	15	IN	Data Raw: 7b 22 53 74 61 74 75 73 22 3a 22 4f 4b 22 7d Data Ascii: {"Status":"OK"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49711	18.173.206.112	443	7824	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:42:01 UTC	326	OUT	POST /zbd HTTP/1.1 Connection: Keep-Alive Content-Type: application/json; Charset=UTF-8 Accept: / Authorization: Signature=e09076fb7be72413458f55a70553fc9fe7a788e10f08e18ca857b7883846325f User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 339 Host: d3cored83b0wp2.cloudfront.net
2024-07-27 22:42:01 UTC	339	OUT	Data Raw: 7b 22 74 61 62 6c 65 22 3a 22 7a 62 5f 61 6e 61 6c 79 74 69 63 73 22 2c 22 64 61 74 61 22 3a 22 7b 5c 22 30 5c 22 3a 5c 22 5c 22 2c 5c 22 31 5c 22 3a 5c 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5c 22 2c 5c 22 32 5c 22 3a 5c 22 32 30 32 34 30 37 32 37 31 38 34 31 35 34 5c 22 2c 5c 22 33 5c 22 3a 5c 22 63 68 65 61 74 65 6e 67 69 6e 65 5c 22 2c 5c 22 34 5c 22 3a 5c 22 63 68 65 61 74 65 6e 67 69 6e 65 5c 22 2c 5c 22 35 5c 22 3a 5c 22 41 56 47 5f 41 56 5c 22 2c 5c 22 31 38 5c 22 3a 5c 22 5a 42 5f 41 56 47 5f 41 56 5f 54 72 75 73 74 50 69 6c 6f 74 5c 22 2c 5c 22 31 39 5c 22 3a 5c 22 5c 22 2c 5c 22 32 31 5c 22 3a 5c 22 31 33 33 5c 22 2c 5c 22 36 5c 22 3a 5c 22 32 5c 22 2c 5c 22 37 5c 22 3a 5c Data Ascii: {"table":"zb_analytics","data":"{\"0\":\"\",\"1\":\"9e146be9-c76a-4720-bcdb-53011b87bd06\",\"2\":\"20240727184154\",\"3\":\"cheatengine\",\"4\":\"cheatengine\",\"5\":\"AVG_AV\",\"18\":\"ZB_AVG_AV_TrustPilot\",\"19\":\"\",\"21\":\"133\",\"6\":\"2\",\"7\":\
2024-07-27 22:42:02 UTC	428	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 15 Connection: close Date: Sat, 27 Jul 2024 22:42:01 GMT Access-Control-Allow-Methods: GET,HEAD,PUT,POST,DELETE Access-Control-Allow-Origin: * X-Cache: Miss from cloudfront Via: 1.1 ba01631fe255b1896a9e6bfd4c86a06a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P12 X-Amz-Cf-Id: K4OWs_7FjiWPOoCp1YDyDFGKJkSZjXt1mqsuFS7xBCM01rNScmrSHQ==
2024-07-27 22:42:02 UTC	15	IN	Data Raw: 7b 22 53 74 61 74 75 73 22 3a 22 4f 4b 22 7d Data Ascii: {"Status":"OK"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49712	18.173.206.112	443	7824	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:42:03 UTC	326	OUT	POST /zbd HTTP/1.1 Connection: Keep-Alive Content-Type: application/json; Charset=UTF-8 Accept: / Authorization: Signature=e09076fb7be72413458f55a70553fc9fe7a788e10f08e18ca857b7883846325f User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 344 Host: d3cored83b0wp2.cloudfront.net
2024-07-27 22:42:03 UTC	344	OUT	Data Raw: 7b 22 74 61 62 6c 65 22 3a 22 7a 62 5f 61 6e 61 6c 79 74 69 63 73 22 2c 22 64 61 74 61 22 3a 22 7b 5c 22 30 5c 22 3a 5c 22 5c 22 2c 5c 22 31 5c 22 3a 5c 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5c 22 2c 5c 22 32 5c 22 3a 5c 22 32 30 32 34 30 37 32 37 31 38 34 31 35 34 5c 22 2c 5c 22 33 5c 22 3a 5c 22 63 68 65 61 74 65 6e 67 69 6e 65 5c 22 2c 5c 22 34 5c 22 3a 5c 22 63 68 65 61 74 65 6e 67 69 6e 65 5c 22 2c 5c 22 35 5c 22 3a 5c 22 57 65 62 43 6f 6d 70 61 6e 69 6f 6e 43 48 4f 5c 22 2c 5c 22 31 38 5c 22 3a 5c 22 5a 42 5f 57 43 43 48 4f 5f 6e 65 77 5f 49 53 56 5c 22 2c 5c 22 31 39 5c 22 3a 5c 22 5c 22 2c 5c 22 32 31 5c 22 3a 5c 22 31 33 33 5c 22 2c 5c 22 36 5c 22 3a 5c 22 32 5c 22 2c 5c 22 Data Ascii: {"table":"zb_analytics","data":"{\"0\":\"\",\"1\":\"9e146be9-c76a-4720-bcdb-53011b87bd06\",\"2\":\"20240727184154\",\"3\":\"cheatengine\",\"4\":\"cheatengine\",\"5\":\"WebCompanionCHO\",\"18\":\"ZB_WCCHO_new_ISV\",\"19\":\"\",\"21\":\"133\",\"6\":\"2\",\"
2024-07-27 22:42:03 UTC	428	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 15 Connection: close Date: Sat, 27 Jul 2024 22:42:03 GMT Access-Control-Allow-Methods: GET,HEAD,PUT,POST,DELETE Access-Control-Allow-Origin: * X-Cache: Miss from cloudfront Via: 1.1 e23d0cd26e88be416569e15d7299b25c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P12 X-Amz-Cf-Id: htWkTYozJ6bj1kd0MsIElv5WKkwVIapoo6VaRMRNSf6nWka8JGYSCg==
2024-07-27 22:42:03 UTC	15	IN	Data Raw: 7b 22 53 74 61 74 75 73 22 3a 22 4f 4b 22 7d Data Ascii: {"Status":"OK"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49713	18.173.206.112	443	7824	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:42:04 UTC	326	OUT	POST /zbd HTTP/1.1 Connection: Keep-Alive Content-Type: application/json; Charset=UTF-8 Accept: / Authorization: Signature=e09076fb7be72413458f55a70553fc9fe7a788e10f08e18ca857b7883846325f User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 334 Host: d3cored83b0wp2.cloudfront.net
2024-07-27 22:42:04 UTC	334	OUT	Data Raw: 7b 22 74 61 62 6c 65 22 3a 22 7a 62 5f 61 6e 61 6c 79 74 69 63 73 22 2c 22 64 61 74 61 22 3a 22 7b 5c 22 30 5c 22 3a 5c 22 5c 22 2c 5c 22 31 5c 22 3a 5c 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5c 22 2c 5c 22 32 5c 22 3a 5c 22 32 30 32 34 30 37 32 37 31 38 34 31 35 34 5c 22 2c 5c 22 33 5c 22 3a 5c 22 63 68 65 61 74 65 6e 67 69 6e 65 5c 22 2c 5c 22 34 5c 22 3a 5c 22 63 68 65 61 74 65 6e 67 69 6e 65 5c 22 2c 5c 22 35 5c 22 3a 5c 22 41 76 61 73 74 5f 4e 43 48 5c 22 2c 5c 22 31 38 5c 22 3a 5c 22 5a 42 5f 41 76 61 73 74 5f 4e 43 48 5c 22 2c 5c 22 31 39 5c 22 3a 5c 22 5c 22 2c 5c 22 32 31 5c 22 3a 5c 22 31 33 33 5c 22 2c 5c 22 36 5c 22 3a 5c 22 32 5c 22 2c 5c 22 37 5c 22 3a 5c 22 31 2e 33 34 Data Ascii: {"table":"zb_analytics","data":"{\"0\":\"\",\"1\":\"9e146be9-c76a-4720-bcdb-53011b87bd06\",\"2\":\"20240727184154\",\"3\":\"cheatengine\",\"4\":\"cheatengine\",\"5\":\"Avast_NCH\",\"18\":\"ZB_Avast_NCH\",\"19\":\"\",\"21\":\"133\",\"6\":\"2\",\"7\":\"1.34
2024-07-27 22:42:05 UTC	428	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 15 Connection: close Date: Sat, 27 Jul 2024 22:42:04 GMT Access-Control-Allow-Methods: GET,HEAD,PUT,POST,DELETE Access-Control-Allow-Origin: * X-Cache: Miss from cloudfront Via: 1.1 ba01631fe255b1896a9e6bfd4c86a06a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P12 X-Amz-Cf-Id: r3Wuwmo4AI7yo8LezXF0pWU06IdifpkmtjUm4xzM34fW9bv1vqO6PA==
2024-07-27 22:42:05 UTC	15	IN	Data Raw: 7b 22 53 74 61 74 75 73 22 3a 22 4f 4b 22 7d Data Ascii: {"Status":"OK"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49714	18.173.206.112	443	7824	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:42:05 UTC	140	OUT	GET /f/WeatherZero/images/969/EN.png HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.1.2 Host: d3cored83b0wp2.cloudfront.net
2024-07-27 22:42:06 UTC	512	IN	HTTP/1.1 200 OK Content-Type: image/png Content-Length: 30586 Connection: close Last-Modified: Thu, 08 Dec 2022 12:37:43 GMT x-amz-version-id: MVrTExmvEQAJj6fAGLSH_gwH63ab4qxc Accept-Ranges: bytes Server: AmazonS3 Date: Sat, 27 Jul 2024 22:24:40 GMT ETag: "9ac6287111cb2b272561781786c46cdd" X-Cache: Hit from cloudfront Via: 1.1 b44afb2a44376871c20edb8c123ed47c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P12 X-Amz-Cf-Id: M5whfYqV0I98vY4hZ8wDFEQS0phjaXBrbvYJxEEiDdF_YySegXPzjQ== Age: 32717
2024-07-27 22:42:06 UTC	16384	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 02 bc 00 00 01 68 08 06 00 00 00 b5 fd 28 e7 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 77 0f 49 44 41 54 78 01 ed bd 09 9c 5d 57 75 e6 bb 35 db 12 e0 12 24 a4 b1 8d 55 02 e7 e1 e9 21 89 04 92 74 9a 48 22 84 90 a1 23 39 09 79 49 27 d8 12 83 33 30 48 02 cc 0c 92 18 02 06 82 24 27 61 36 1a 92 ce 44 82 a4 4e 77 42 9a 04 c9 34 09 74 42 9e 24 9e b1 8d 27 95 07 08 84 07 92 30 c8 b2 64 bb 7a 7d 57 f7 2b 2f 2d ed 33 dc aa 5b 75 ef 3d f5 fd 7f bf 53 f7 0c 7b 58 7b ed 69 9d 7d f6 de 95 92 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 21 84 10 42 08 Data Ascii: PNGIHDRh(pHYssRGBgAMAawIDATx]Wu5$U!tH"#9yI'30H$'a6DNwB4tB$'0dz}W+/-3[u=S{X{i}B!B!B!B!B!B!B!B
2024-07-27 22:42:06 UTC	14202	IN	Data Raw: a8 0a af 4c 87 55 3a f0 e1 73 2a 0d 75 58 54 d7 72 e1 45 99 58 ce bd df 32 19 73 94 e5 75 ce 6d 2c c7 b9 34 4e a4 1c e5 ee 8d a7 7e 7a ff b9 f4 c4 76 aa ca 7d 8e b2 f4 d6 4d 1f 46 cd 30 1a 76 b8 c6 3f 8b 89 d3 a9 62 9d 8f e9 88 71 95 95 e9 a8 87 f1 a4 b9 6e 5d a7 ee 59 86 ea e8 bb ac cf 61 18 55 7d 56 a7 65 88 f3 52 73 ff b4 a4 4e bd a9 7b 8f f2 e5 d2 97 cb 47 52 96 77 45 6d 45 a4 93 36 8e e1 e4 ea 0d d3 e0 75 1c db 39 9e 4f 37 76 ed da 85 be 7b ca ed 4f 19 bc a2 ef 18 69 2f 80 19 c9 ec a6 40 68 f0 c6 b9 68 42 88 c1 84 06 00 16 82 e1 53 b8 16 f9 f4 0f c8 1b 7c fe c7 d4 01 bc 88 d4 79 11 10 a2 88 5e 19 bc 9a c3 2b 84 10 a2 e7 60 54 97 3b 7f c8 d8 ed 2f 30 c0 00 63 17 03 0c 32 76 c5 a0 a2 5d 1a 44 df 81 06 75 74 b4 7c 8a 4f 9d cf 9d 42 88 c1 01 9f c9 61 e8 Data Ascii: LU:s*uXTrEX2sum,4N~zv}MF0v?bqn]YaU}VeRsN{GRwEmE6u9O7v{Oi/@hhBS\|y^+`T;/0c2v]Dut\|OBa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49720	18.172.112.34	443	7824	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:42:21 UTC	124	OUT	GET /rsStubActivator.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.1.2 Host: shield.reasonsecurity.com
2024-07-27 22:42:21 UTC	1137	IN	HTTP/1.1 200 OK Content-Type: application/x-msdownload Content-Length: 33432 Connection: close Date: Sat, 27 Jul 2024 22:42:21 GMT ETag: W/"8298-amrWAj+eGria7Eoxd9BYFabjos0" Access-Control-Allow-Origin: * Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Referrer-Policy: no-referrer Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-DNS-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 content-disposition: attachment; filename=rsStubActivator.exe X-Cache: Miss from cloudfront Via: 1.1 24c73aa8cdc4e254694e2ac7073f8aea.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P8 X-Amz-Cf-Id: eJidjZZguskbh3FbhijMbPAB-2fz_Pz4XAhY96_jIw-r-R-n8AKqVA==
2024-07-27 22:42:21 UTC	1928	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a9 ef 9a d4 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 12 00 00 00 16 00 00 00 00 00 00 4e 31 00 00 00 20 00 00 00 40 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 00 00 00 02 00 00 88 4f 01 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL"0N1 @@ O`
2024-07-27 22:42:21 UTC	8192	IN	Data Raw: 59 04 e3 00 03 00 ec 20 00 00 00 00 96 00 d2 02 eb 00 06 00 18 23 00 00 00 00 91 00 ba 04 f1 00 07 00 a8 23 00 00 00 00 86 18 98 03 f7 00 08 00 00 00 01 00 99 02 00 00 02 00 7b 00 00 00 01 00 41 03 00 00 02 00 f1 04 00 00 03 00 22 02 00 00 01 00 11 04 00 00 01 00 3d 04 00 00 01 00 ad 02 00 00 02 00 c9 00 00 00 03 00 20 04 09 00 98 03 01 00 11 00 98 03 06 00 19 00 98 03 0a 00 29 00 98 03 10 00 31 00 98 03 10 00 39 00 98 03 10 00 41 00 98 03 10 00 49 00 98 03 10 00 51 00 98 03 06 00 59 00 98 03 15 00 61 00 98 03 10 00 b9 00 35 05 1a 00 b9 00 89 00 1d 00 71 00 f5 04 23 00 b9 00 86 02 27 00 b9 00 70 02 2b 00 b9 00 74 04 30 00 71 00 ff 04 10 00 c1 00 5f 02 3c 00 79 00 b9 02 42 00 79 00 c2 02 47 00 69 00 56 02 23 00 b9 00 74 04 69 00 71 00 98 03 10 00 c9 00 7a Data Ascii: Y ##{A"= )19AIQYa5q#'p+t0q_<yByGiV#tiqz
2024-07-27 22:42:21 UTC	3392	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 00 0c 00 00 00 50 31 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 0P1
2024-07-27 22:42:21 UTC	3198	IN	Data Raw: 16 04 14 68 37 e0 eb b6 3b f8 5f 11 86 fb fe 61 7b 08 88 65 f4 4e 42 30 1f 06 03 55 1d 23 04 18 30 16 80 14 ec d7 e3 82 d2 71 5d 64 4c df 2e 67 3f e7 ba 98 ae 1c 0f 4f 30 0e 06 03 55 1d 0f 01 01 ff 04 04 03 02 01 86 30 13 06 03 55 1d 25 04 0c 30 0a 06 08 2b 06 01 05 05 07 03 03 30 77 06 08 2b 06 01 05 05 07 01 01 04 6b 30 69 30 24 06 08 2b 06 01 05 05 07 30 01 86 18 68 74 74 70 3a 2f 2f 6f 63 73 70 2e 64 69 67 69 63 65 72 74 2e 63 6f 6d 30 41 06 08 2b 06 01 05 05 07 30 02 86 35 68 74 74 70 3a 2f 2f 63 61 63 65 72 74 73 2e 64 69 67 69 63 65 72 74 2e 63 6f 6d 2f 44 69 67 69 43 65 72 74 54 72 75 73 74 65 64 52 6f 6f 74 47 34 2e 63 72 74 30 43 06 03 55 1d 1f 04 3c 30 3a 30 38 a0 36 a0 34 86 32 68 74 74 70 3a 2f 2f 63 72 6c 33 2e 64 69 67 69 63 65 72 74 2e 63 Data Ascii: h7;_a{eNB0U#0q]dL.g?O0U0U%0+0w+k0i0$+0http://ocsp.digicert.com0A+05http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0CU<0:08642http://crl3.digicert.c
2024-07-27 22:42:21 UTC	9594	IN	Data Raw: e2 9a 40 0e 8e 1e ba 19 0b 99 29 48 aa 28 d8 58 62 29 13 a0 bf 12 58 66 20 fa 41 70 d6 1d a7 88 83 d0 5f 61 ee f0 b1 82 e2 bc f2 2c 01 f6 8c 98 fc d6 8f 51 b3 a4 e4 7d 46 8a 91 b9 16 52 5d bf 71 2e 8b 2d 08 68 10 77 bd 6b cf e8 08 07 ca 98 17 18 92 6d 5a 37 66 54 57 d8 65 e2 7a f6 a3 05 65 f6 8a af 36 a3 df 5f 92 f5 d6 19 25 a7 e5 28 7a f6 51 f2 66 1d c6 4e e9 39 01 2a 49 3f 79 f9 15 c3 c4 43 38 ea b3 cb e2 a2 f4 55 fa af 7a 21 24 73 3b 73 7d 8a 7d e3 97 87 92 0e 4c 04 bd 85 5a 48 31 51 a4 5a e1 dd 23 57 5a 8a 4f ad 79 1d 58 e8 21 c7 03 29 aa c4 b6 ec 76 a4 42 05 71 8e d3 dd 21 48 54 80 c6 c1 7d ae 5e c2 77 40 0f ab 52 17 5d 4b 36 8c 98 08 70 8a 59 a6 b5 63 2f ae e0 5d 9d 2a aa f4 b9 15 19 b3 75 ab 6d 85 08 55 ae 3a b5 11 79 69 66 7a 52 df ea 5f 40 83 59 Data Ascii: @)H(Xb)Xf Ap_a,Q}FR]q.-hwkmZ7fTWeze6_%(zQfN9I?yC8Uz!$s;s}}LZH1QZ#WZOyX!)vBq!HT}^w@R]K6pYc/]umU:yifzR_@Y
2024-07-27 22:42:21 UTC	6396	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-07-27 22:42:21 UTC	732	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49721	18.173.206.112	443	7824	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:42:22 UTC	142	OUT	GET /f/WebAdvisor/files/1489/saBSI.zip HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.1.2 Host: d3cored83b0wp2.cloudfront.net
2024-07-27 22:42:23 UTC	629	IN	HTTP/1.1 200 OK Content-Type: application/x-zip-compressed Content-Length: 527389 Connection: close Last-Modified: Tue, 26 Mar 2024 13:11:30 GMT x-amz-server-side-encryption: AES256 x-amz-meta-cb-modifiedtime: Tue, 26 Mar 2024 13:10:42 GMT x-amz-version-id: 7sn0EuMWH3aYiKrbA4lOPgyoNDAU9iIf Accept-Ranges: bytes Server: AmazonS3 Date: Sat, 27 Jul 2024 12:06:07 GMT ETag: "f68008b70822bd28c82d13a289deb418" X-Cache: Hit from cloudfront Via: 1.1 43be4ee3b8e339e1d27addbbdc49a4d4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P12 X-Amz-Cf-Id: lNShVom6fAPM3LjDRVe49HwTYFYzolcnt6v_kx5JLaz38crPY4q9pA== Age: 39397
2024-07-27 22:42:23 UTC	16384	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 9b 5c 7a 58 1c 99 c3 c5 a9 0b 08 00 80 11 12 00 09 00 00 00 73 61 42 53 49 2e 65 78 65 e4 5a 7f 70 54 d7 75 be 2b 69 a5 d5 8f 65 57 20 63 d9 c8 f1 da 26 8e 9a c1 92 6c a1 09 13 8b c9 82 59 5b 06 01 8b 2d 40 60 01 c2 08 f1 90 65 90 b1 b0 e5 16 3b 72 05 54 ab 95 1c 4d 4a 33 b4 61 dc 5d ad dc 68 3a 9a 56 46 3f d8 75 15 b3 c4 54 12 1d 1c 2b ad 9a 28 29 d3 ca 89 3b f3 1c d4 76 93 12 5b 76 15 d4 f3 9d fb f6 bd dd d5 92 e0 bf b3 03 f7 5d 9d f7 9d ef 9e 73 ee bd e7 fe d8 dd bc bb 5b a4 0a 21 d2 e8 ff c2 82 10 41 21 3f 4e f1 fb 3f 25 26 21 96 dc fb ce 12 31 94 f9 fe 7d 41 53 e5 fb f7 55 29 87 5f 74 34 1d 3b 7a e8 d8 fe e7 1d 07 f6 1f 39 72 b4 d9 f1 ec 41 c7 b1 e3 47 1c 87 8f 38 36 6c 7d da f1 fc d1 ba 83 45 56 6b d6 4a 8d e3 11 db 87 Data Ascii: PK\zXsaBSI.exeZpTu+ieW c&lY[-@`e;rTMJ3a]h:VF?uT+();v[v]s[!A!?N?%&!1}ASU)_t4;z9rAG86l}EVkJ
2024-07-27 22:42:23 UTC	16384	IN	Data Raw: d4 86 29 b5 21 4a 6d 20 dd dc 3f cd bc a4 c3 4c 4d cb 4b 26 b6 e9 52 33 78 49 ff 71 23 35 c9 4b 06 78 6a cd 94 5a 13 a5 16 48 b7 3c 4c 33 2f 59 bc 4d a6 a6 e5 25 67 68 53 33 78 c9 3b 8f 19 a9 49 5e 32 cc 53 eb a5 d4 7a 28 b5 70 ba 15 64 9a 79 c9 eb 7b 65 6a 7b 1c 9a d4 ca 7a 75 a9 19 bc e4 da 01 23 b5 f4 bc e4 90 e4 25 87 38 2f 39 2c 79 c9 84 e0 25 4f 1d 4b cf 4b 36 6e c5 1b 5b 2c 42 ff b2 35 cd 22 f4 e7 37 31 8d fb 3f 9f 99 81 97 cc f1 08 5e 32 b6 d1 d8 1d 66 67 3a 73 d9 8f e4 a7 5b 52 79 49 57 a7 b1 1d 8c ab bc b8 ea 95 2d 13 f3 92 0b 3d 82 97 6c 31 6c 7d b0 bd 1e b6 2b b6 68 f7 63 06 b7 f2 e5 8c 78 c9 80 47 f0 92 8d 78 12 e0 3d 9d c2 4b 26 3a b1 e3 0b c9 79 5b d0 20 b6 fd 12 85 97 f4 75 19 54 83 07 fb 25 4d 30 b9 62 8b 6d bf 64 11 f9 27 5e 32 2c 9f e7 Data Ascii: )!Jm ?LMK&R3xIq#5KxjZH<L3/YM%ghS3x;I^2Sz(pdy{ej{zu#%8/9,y%OKK6n[,B5"71?^2fg:s[RyIW-=l1l}+hcxGx=K&:y[ uT%M0bmd'^2,
2024-07-27 22:42:23 UTC	2410	IN	Data Raw: be cb 8f ff db b1 fd 37 c7 f5 ff ed c1 e3 9f fc 7f 35 fe cd 38 fe df bf cc f8 ef 55 c7 ff 6d 65 fc c7 c5 8f 7f 91 9a 74 6a 6e 34 36 6b 16 71 58 31 9b 20 e8 85 96 62 57 65 0d aa 33 c0 78 40 4c cd 72 d1 94 71 c0 23 e1 a7 cd 15 12 13 3d 21 d1 1c 12 8d 85 c5 54 07 fa 22 79 c6 86 7e 02 ff de 34 d2 0c 7c 2f bd 8d ea 27 28 4e e9 c4 18 7a cb a8 9f 8e d8 fe d3 24 4c 57 d5 80 db f8 ab 2c 92 63 37 62 fa 08 a8 67 a0 3f b1 2d ed f8 e3 42 3d 4a 88 64 b5 65 62 8f bd 47 34 60 82 d0 d6 a0 9e e4 25 92 02 ab c7 ed 42 cb d6 1f 31 ae 0b 24 e3 56 c9 b9 77 c3 25 2e 09 04 ca d9 67 4c 66 a7 d5 94 dc 68 9a 9f b0 b5 17 f3 44 df 95 50 0d df ab d2 64 47 1b 2c 5f 67 4c 63 8c 36 ba a4 1e 40 73 b4 bd b5 f5 29 0d f7 0b dc 5b d4 f4 97 f6 94 a6 ff 68 f8 b9 c8 71 18 1f e9 dc ab 03 e9 d6 df Data Ascii: 758Umetjn46kqX1 bWe3x@Lrq#=!T"y~4\|/'(Nz$LW,c7bg?-B=JdebG4`%B1$Vw%.gLfhDPdG,_gLc6@s)[hq
2024-07-27 22:42:23 UTC	16384	IN	Data Raw: 17 2f 67 bd 94 4e bf 80 27 bd fc 02 ba 65 2c 46 ac 67 d4 ff 37 36 fc fa 58 83 9a 6a c8 8e a9 86 ee f1 0a b4 ce 68 18 90 6a e8 a9 37 d5 54 43 66 b5 31 b8 0e e8 d3 a0 7a e9 5e fa 9c 5a 6d 36 ab 76 49 fd 5f b0 da 4d 58 ed 09 da f7 7b 5c ae 1b 64 c7 66 17 cd 7c 2b 81 f3 8e 82 25 51 2a dd 2d 57 ed fd ea 25 e8 ec 13 02 60 55 7a 02 58 f0 66 e8 a0 8b 26 c2 33 98 1e 8f 25 75 22 62 43 49 89 a8 23 b9 40 4f 9b dd c5 2e da 48 43 21 29 87 25 a4 2a ae 6c 07 51 81 62 f0 af 94 63 56 ee 1c c1 3b ef 32 45 c7 26 e5 58 b0 1e 9f 8d 15 79 ef a4 3f 60 6a 5e 8e 51 f9 9d 4a 4b d9 73 a0 22 34 04 cd 24 37 ad 82 b0 52 92 3b d5 b4 13 af ae a2 4f 5d cd 72 47 a2 63 d9 54 9b 70 3e 14 6a 56 dc 88 61 37 66 1c 19 2a 7e c4 f0 5f 7a 43 13 3f 28 6b 18 71 98 d3 f7 bb 30 69 98 e4 ec 53 72 86 29 Data Ascii: /gN'e,Fg76Xjhj7TCf1z^Zm6vI_MX{\df\|+%Q-W%`UzXf&3%u"bCI#@O.HC!)%lQbcV;2E&Xy?`j^QJKs"4$7R;O]rGcTp>jVa7f*~_zC?(kq0iSr)
2024-07-27 22:42:23 UTC	16384	IN	Data Raw: 6b 84 09 70 37 c8 8a c4 5a b6 e3 1a 54 2d 6a 53 8b fc ec 4b 39 c9 55 c5 3c 55 6a 51 b3 ea e9 e8 5a c4 ba d1 73 3d 2f e7 82 43 a8 a7 c3 dd aa 1f 96 f4 d9 f0 b0 e4 e8 95 a6 ac 79 e1 0b cc 53 36 bd d2 eb b0 9e 92 9b 5f bd 12 f3 df 5a c9 31 55 5d 1d 5d fd d2 cf 40 df 98 22 eb a9 82 b5 52 7b 31 ff e5 5b 7a 8b 44 d6 a2 e6 89 17 c1 e2 ac 59 89 58 f8 09 fc d7 45 b5 54 be 80 d6 c8 98 ad f5 20 6a e3 4e e7 0e ef 39 eb bc 51 5a a6 15 0c ba ea f2 7f f4 93 11 b8 79 5a 25 67 d5 95 a9 0e 4b 5d b6 c5 0a 2b 47 3f 5b 54 cb 5c 30 a2 b6 ce 9b cd 55 2d de 29 2f 41 30 05 b8 1b d6 47 b0 38 dc 27 3f 13 14 8b 5b e1 97 a7 e2 74 05 d4 12 37 b8 da 33 9a 8d 5f 06 30 57 3b 4c 5d e4 b4 7f a6 3b ed 3b cf 1e b8 aa 59 df 5f 4d d3 c6 dd 04 fe dc b2 c7 e2 50 1b 07 aa a6 03 26 2f 2d a5 27 ea Data Ascii: kp7ZT-jSK9U<UjQZs=/CyS6_Z1U]]@"R{1[zDYXET jN9QZyZ%gK]+G?[T\0U-)/A0G8'?[t73_0W;L];;Y_MP&/-'
2024-07-27 22:42:23 UTC	16384	IN	Data Raw: 0f b9 58 8d dd ad 2a 87 d5 1a ae 7a d7 f0 65 9b 43 ab bc 3e 33 ad f2 32 7d 90 5f c0 1f 1c 25 f8 77 46 1f e4 bf 1a 81 fc 3b 1a 50 8e 0a fe 9d a1 71 bb 0d fb 04 1f b3 2a 34 c8 e3 63 fe 8b 55 21 0b 2b 69 5c 30 9c 85 d6 14 99 85 76 d6 ef a8 f2 66 e5 6b a9 e3 f3 38 3c b0 92 e8 60 85 8e 80 b2 56 90 72 a3 f8 d9 44 f8 2b 5d 0b e2 d9 cd 80 f6 eb 68 c6 fa 7a 1c 0b 2f 94 1d 09 aa b2 b1 41 a6 d7 07 e5 e1 ca 5a 55 d9 c4 f0 6f 7b e7 22 63 a9 4b 2e 04 bb e5 60 ee 8d ba 6d 5b 34 36 a7 45 5e f6 3c d4 56 cc 8f 05 8d 24 f2 f5 bf 8e 8b 0e c6 d7 e8 19 ea e2 07 c4 7b 3d 18 9f d2 95 ab d6 b4 bb 30 bc 4f cd da 32 3e 29 19 67 82 5d 74 02 64 23 e1 c4 30 65 f8 26 56 83 a7 e1 e3 f4 0c e3 fa 71 9e 50 cb f6 44 b5 e5 70 b8 19 78 7e 9d ac fc e1 4a 03 ab 69 d0 93 1a 74 3e 14 d5 0c de a7 Data Ascii: XzeC>32}_%wF;Pq4cU!+i\0vfk8<`VrD+]hz/AZUo{"cK.`m[46E^<V${=0O2>)g]td#0e&VqPDpx~Jit>
2024-07-27 22:42:23 UTC	16384	IN	Data Raw: 62 64 1a 0a 5f aa 69 68 5c 7b f8 39 74 39 9b 27 b3 f0 64 f0 85 e5 43 b2 c1 3c 19 dd 37 12 e3 64 49 c0 ce e8 91 d5 73 26 81 23 77 2f f6 3f b9 62 45 22 98 55 52 5a 8e a7 4d 5d 93 57 3b b9 7b c4 b1 c1 11 f9 ff a1 9b e4 6a fe 17 b0 e2 59 6e 4f 12 dc 97 93 81 03 a6 09 8e 28 50 63 eb 21 d6 7b b2 72 64 03 4c cc aa d1 cf 8b 5c 60 8f 4f 3b c4 0e 2c 46 f2 4c 78 c5 8a 0e ae d2 bd 41 f7 3b e4 7d bf dc c4 b6 10 0b e1 98 66 f1 0b 9b cf 16 09 74 a4 e4 8e 78 c9 81 fe c2 47 c8 c6 9e ee c2 65 88 68 ae bc d1 f5 fc c7 45 42 f9 cd ae 13 f0 70 d9 3e 29 c2 8b 70 4f 37 e1 82 79 7c c3 90 c8 ca 0b 42 95 57 26 ca 87 e5 59 09 c9 07 33 bf c2 bb 34 26 49 8e c4 ce f4 a5 13 64 47 52 f2 2b 99 dd 4b ad c5 a5 4a 61 02 ab 1b 29 08 9d 57 ca fe 64 1f e0 25 c9 6d 03 5c 94 b0 3d 1b 89 97 8d 6e Data Ascii: bd_ih\{9t9'dC<7dIs&#w/?bE"URZM]W;{jYnO(Pc!{rdL\`O;,FLxA;}ftxGehEBp>)pO7y\|BW&Y34&IdGR+KJa)Wd%m\=n
2024-07-27 22:42:23 UTC	16384	IN	Data Raw: 04 ff e0 da b1 eb f1 6c 10 95 0f 93 52 3b a4 34 60 cf 92 94 e5 9a e0 0f 72 06 83 49 af 22 33 0d b5 64 42 2d f7 7e 2e 9a 9c 19 62 56 ab 78 57 d2 96 41 bc e4 70 63 52 3d 7c af 2e c4 a8 aa 20 6b 7c 2e 8e 33 5a e9 bf 7e 82 a7 9d fb 80 8c 3c fb cf ee 9c 36 5b db 43 9d bf 90 04 a1 59 7e 71 c8 7c aa 8f 38 7b 5b cf a4 81 f8 e6 dc d5 4a a7 ea da 48 59 8f 6e 00 7a e0 eb 98 21 4b fb ec 9f d7 4e f2 9d 36 c9 52 8f e2 e8 c2 0b 3f 78 f7 bd ef 3e 64 89 2e 90 56 db 19 8c 4a 5e 6b 85 6c 28 a4 48 50 42 ea 2a d7 7d 8e e1 c8 b3 99 81 87 b1 43 7f bb d0 97 0d e5 f9 7e d8 66 0f 88 4f e2 75 0a df 7e 91 df f5 5f 9d f2 2a 7e 05 ad a4 f5 20 95 1d bb 79 39 c7 6e bc 85 c6 73 c6 12 c7 6e 8c 7c 2c ce 1d c8 d9 23 4b bb 7d 1d ea e1 e0 7e 55 19 7d 9d aa c0 79 42 83 96 27 ff c3 16 11 d3 c9 Data Ascii: lR;4`rI"3dB-~.bVxWApcR=\|. k\|.3Z~<6[CY~q\|8{[JHYnz!KN6R?x>d.VJ^kl(HPB}C~fOu~_~ y9nsn\|,#K}~U}yB'
2024-07-27 22:42:23 UTC	16384	IN	Data Raw: 7a 50 53 b7 a7 ca 60 f1 8e 4d 99 d0 c4 fc bf 80 bd e3 af d6 17 f5 d6 ff c8 25 89 80 b5 a8 f3 b4 58 5d 80 12 03 4f 25 1b 9e 3e b0 b6 6f 44 8f 02 06 df 0f b1 bb 94 f0 5e b9 45 1b 26 b1 51 13 0f b8 cf 2d cf 32 e4 db ba 26 ac 98 c8 66 2a 30 53 f7 ae 18 61 68 c3 d8 41 6f 35 bf b8 d7 34 bb 00 a9 05 c0 83 e6 72 99 7f d4 4b a6 9a 3e 13 8f 34 af 76 92 cc b2 6a b9 05 77 99 fb 79 37 e2 e0 e9 05 dd 6d 09 e8 6e 8b d7 97 b9 ac 8d ec 4b 16 df d4 14 b7 a7 5d f0 df 94 78 fe 1b b0 76 93 e3 2b 62 44 6c 14 6d 15 fd a6 38 6c 5d ee b2 9a 48 15 fb d1 f7 75 f0 4d f2 7d b1 23 5e 4e 0a a8 a7 7b 43 7b ca 8e 8c c7 55 e1 71 48 7b f2 a5 f8 87 b6 99 dc 38 77 93 57 ea 44 f7 a4 39 0e 93 be 4a 6f a0 e0 f5 f9 12 ff 30 37 53 fa d6 bd a0 2a df 8d 05 f0 b0 97 39 0e 93 8d 5e 7c 7e 93 9e 31 69 Data Ascii: zPS`M%X]O%>oD^E&Q-2&f0SahAo54rK>4vjwy7mnK]xv+bDlm8l]HuM}#^N{C{UqH{8wWD9Jo07S9^\|~1i
2024-07-27 22:42:23 UTC	16384	IN	Data Raw: 37 d4 ef c9 6a 3a c9 72 6c 4a 76 a9 e2 d9 fe 64 3c e6 a7 d9 ee bd 6c 92 37 77 e2 31 01 e9 7e 7b 8f fc 6c 2b fe b4 64 2a 8e 9d ea cc 42 56 8d 29 08 24 b4 cb dc 63 57 7b 67 e7 ba 65 ef 25 93 3b c9 5b 65 5e 8c 97 9e 0b ec 6f ec 32 86 a7 bc 31 0c d7 86 e4 c3 b9 f0 fa fb 68 db 97 2f 82 6a d9 6b 9e bc 19 be fa 3f 3a 2a 30 2d cc 38 ef 55 93 fb 3a 96 51 11 96 12 e6 4b e6 d8 09 88 6d db 26 16 6d 6f f0 2b 45 3b a9 e2 0f 52 fa d3 fd ac fa b8 e3 4d 09 da 85 0b 19 50 67 2b 66 24 71 94 b2 ec 7d aa 65 ae e2 28 53 ef c8 d4 fd d7 b4 ca 9e 14 95 bd 7b 86 5e d9 e3 58 d9 bb 67 40 65 cf b0 ef 4a ba dc f7 cb 07 47 1e 9e 41 d2 b3 9d aa ea 9b 45 49 1b 6f 53 3c 7a 55 27 30 e0 0c 10 4f 90 0f 3a cd 8b 91 4d 3e 33 54 1c 2b 8d 35 3e cb 1c 65 00 db f6 dc 44 cf ae 86 ab 78 1e 84 c5 de Data Ascii: 7j:rlJvd<l7w1~{l+dBV)$cW{ge%;[e^o21h/jk?:0-8U:QKm&mo+E;RMPg+f$q}e(S{^Xg@eJGAEIoS<zU'0O:M>3T+5>eDx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49722	18.173.206.112	443	7824	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:42:24 UTC	144	OUT	GET /f/WeatherZero/files/969/WZSetup.zip HTTP/1.1 Connection: Keep-Alive User-Agent: Inno Setup 6.1.2 Host: d3cored83b0wp2.cloudfront.net
2024-07-27 22:42:24 UTC	520	IN	HTTP/1.1 200 OK Content-Type: application/zip Content-Length: 6227973 Connection: close Last-Modified: Thu, 08 Dec 2022 09:14:29 GMT x-amz-version-id: s20fxiZKNPOZhn5cscxnL4vQWeKpCNmb Accept-Ranges: bytes Server: AmazonS3 Date: Sat, 27 Jul 2024 07:21:07 GMT ETag: "7cc0288a2a8bbe014f9e344f3068c8f1" X-Cache: Hit from cloudfront Via: 1.1 e23d0cd26e88be416569e15d7299b25c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P12 X-Amz-Cf-Id: l8Iu3GfciP-lE411Qqy0RO2R9HACkJYB0zbq7R9M7XaHqBjzAy9b1A== Age: 55278
2024-07-27 22:42:24 UTC	15864	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 76 86 87 55 c9 02 ed f5 8d 07 5f 00 10 8b 5f 00 0b 00 00 00 57 5a 53 65 74 75 70 2e 65 78 65 ec bd 7d 78 54 d5 b9 37 bc e7 2b 19 92 09 7b 02 89 46 f9 0a 12 14 0d 52 34 60 89 43 74 02 d9 21 58 06 26 0c 99 81 0a 08 42 70 18 23 a1 c9 de 88 96 e8 84 9d d1 6c 36 63 39 ad 7a 6c 6b 2d 88 3d b5 2d e7 d4 9e 5a a5 ad 8d 19 b0 49 50 d4 f0 51 88 42 6b d4 54 f7 38 51 a3 a4 61 80 98 fd fc ee b5 67 00 cf 79 ce 7b 9e eb b9 de f7 ba de 3f 4e 70 cd 5e 9f f7 5a eb 5e f7 e7 5a 6b 6f 3d df de c5 59 38 8e b3 22 e8 3a c7 ed e7 8c 3f 37 f7 df ff 75 21 8c 9e f4 87 d1 dc 8b a3 de 9c bc df b4 e8 cd c9 cb 82 1b 1b 0b 37 37 d4 df d3 b0 f6 be c2 75 6b 37 6d aa 17 0b ef ae 2d 6c 90 36 15 6e dc 54 58 b1 c4 57 78 5f fd fa da 19 39 39 59 45 29 18 ff 7a d3 f5 Data Ascii: PKvU__WZSetup.exe}xT7+{FR4`Ct!X&Bp#l6c9zlk-=-ZIPQBkT8Qagy{?Np^Z^Zko=Y8":?7u!77uk7m-l6nTXWx_99YE)z
2024-07-27 22:42:24 UTC	16384	IN	Data Raw: 31 e2 72 2b 5d 29 f2 74 79 15 fc 76 2b 6c 32 da 6e 1a 4c 5a 51 74 66 64 a3 75 3c 77 14 89 bc e7 c1 8d 10 4c bb 49 14 d5 26 b9 fd d3 8e ce e3 ca d6 1f 9f c7 fd c6 fe 50 5e d9 b4 13 f3 b8 26 eb 48 2c 31 aa ac 95 a2 e6 df 64 f2 6d 87 14 bb dc 6e 2d 7b 1e 19 db 8e 47 85 e4 ab d4 c6 1b 9c 76 0a fe f3 f4 e7 e8 f2 38 d2 c1 95 2d 88 8d a7 1f 7a 5d 38 68 bc 92 10 a6 8f bf 4c 5c 11 b2 2d 3f f3 2b f6 81 22 d6 68 26 35 2a a4 46 3d 54 ff e9 16 76 63 68 62 90 e0 6a 1e 34 19 b1 d1 30 77 13 f0 d6 4a e7 ee 99 ec 99 bb 87 fa 51 2a f3 f6 14 b2 67 81 7c 2d 17 9f 0b 85 a1 be d1 99 41 9b ee 40 e6 b1 fb da 8b df 89 5f 67 e7 52 8b 42 9f 5c f9 af 16 a5 90 2d 4a c9 29 e3 f3 3e ab da 5d 07 95 4a 2b df 12 27 23 32 6b 39 7b b7 df 00 a2 91 37 2c 1c 27 8f 92 ae c9 aa 8f 11 15 a8 35 dd Data Ascii: 1r+])tyv+l2nLZQtfdu<wLI&P^&H,1dmn-{Gv8-z]8hL\-?+"h&5F=Tvchbj40wJQg\|-A@_gRB\-J)>]J+'#2k9{7,'5
2024-07-27 22:42:24 UTC	16384	IN	Data Raw: 0e f6 4b 9c d4 5c e7 2f 71 9d 63 3f c7 7e 9e fb ec 77 5a 9e a5 3b 7d f6 22 96 8f 9a 8e eb d2 79 2c 2d 07 17 f5 45 ee 33 5c d4 ec 67 ce 9d 3b 75 e6 0c 1d cf a5 b3 64 69 69 bf 1a 35 ed 57 6a 21 b0 cb 8b 06 fe 17 fe 0f 86 91 e4 a0 e6 65 cb 47 18 be ac 67 b8 92 ef 3d d4 6d 05 d5 a1 03 42 a2 8d 77 26 99 f4 2d b2 0f bb 59 3e 2d b7 dc 61 16 2d bc a3 71 c2 69 e8 9c de ba 72 26 41 9f d8 23 d2 b9 71 5e 9a fb af 25 bf 69 a0 92 f1 09 f0 34 e8 b8 d1 f6 7a d5 4f 3c 1f 8e b7 70 dd d7 89 3e c7 fc 9a 21 3f 07 54 ee af df ec d9 15 11 79 ed c7 d5 9b e6 d5 d4 f2 98 5d 53 37 6d 52 9b f2 7c e7 12 58 11 2c 74 b4 ad e2 7e b3 53 a4 48 cb f0 5c 73 4c 79 de 21 0a d5 c7 9b 3f 6c 50 1a 80 e9 43 1b 87 80 5e 76 bc b2 6a db 81 9d 72 30 b8 ea 82 d1 8d 76 b5 77 fb e7 a6 67 18 77 18 ff 68 Data Ascii: K\/qc?~wZ;}"y,-E3\g;udii5Wj!eGg=mBw&-Y>-a-qir&A#q^%i4zO<p>!?Ty]S7mR\|X,t~SH\sLy!?lPC^vjr0vwgwh
2024-07-27 22:42:25 UTC	16384	IN	Data Raw: 75 6d cd 07 77 fd 7f 5a da 35 9f 1c d8 5e 34 4e 8d 4a 2c 36 14 4f db d5 71 db aa 1b 34 dc c2 a7 14 e6 7d fd 8e 0f fd d0 e7 02 92 a4 6d 3a 17 7e 32 22 e2 ab 1b da f4 da 53 43 d9 5a f2 5b 1c f5 43 c6 db 42 ff 28 b8 27 42 93 94 c6 2e 16 6f c8 c4 5c cd 9e 71 86 2b b7 43 cb 4d 6f ea 40 c9 39 15 f1 c0 2b 16 8e ad b0 d7 8e 38 e8 98 37 74 de 21 59 54 0f f2 6e b3 8d 2d d8 89 05 b7 51 5b 5c 9b 23 b8 fe f0 8c 8b ff e6 f7 45 6d 7c a5 e1 1f 1a 8c f0 ce 77 66 38 4c 07 54 6a 4b 80 73 75 9e 60 70 25 7a c1 56 ea cb e3 2f cd 1f b8 7e 09 fd 6e c7 e6 fa 85 f7 36 04 3d 31 15 fd 0d fa fe c6 7c 7d 87 eb 43 b6 1c 27 34 f4 ae fa 2d 6f 00 bc 89 1b d3 87 9b 10 ef c1 7b 93 ae dc e6 a2 c4 20 b1 44 69 a2 99 ab 43 06 00 10 f5 c1 22 6e 4a df 97 9f 10 a7 40 59 cb 9d 38 68 fa 38 c7 5b 68 Data Ascii: umwZ5^4NJ,6Oq4}m:~2"SCZ[CB('B.o\q+CMo@9+87t!YTn-Q[\#Em\|wf8LTjKsu`p%zV/~n6=1\|}C'4-o{ DiC"nJ@Y8h8[h
2024-07-27 22:42:25 UTC	16384	IN	Data Raw: 63 01 24 1a a7 ee 08 d2 40 18 f9 00 4c 7c cc 2e cc 74 68 e5 d2 f2 15 b4 31 9a fc 16 ce e7 f6 25 c9 32 73 0d e3 3c 7e 33 77 a9 4b 9a 44 e4 b0 0a b4 21 f5 19 b2 b4 e8 54 ad 78 9a e7 2a 86 ca 3c 8e d7 29 55 08 99 d1 09 60 f3 d8 66 05 99 d2 71 9a 01 fd 34 fb 27 ac 42 eb 98 04 95 32 a6 df 86 3d b5 bc a4 85 89 54 8e 5f 8e 79 36 e7 bb af 69 9a a7 bf 2d 5e 75 c3 f5 df 11 5f f8 e5 2d 9e 1b 6c c8 c9 df bd 18 b4 07 8e 6c a2 6a 64 14 fa 5d 3b 2d 8d d6 bf 4b d3 5b 7c a2 5f b5 bb de f9 89 79 27 4c 1c 1a 67 46 18 c4 6c df d8 e2 bd 6f 04 18 bf e5 98 8c 40 a9 7c 99 1e ff 10 00 f3 21 3a e6 47 aa af f2 a1 44 70 54 79 da 20 29 a2 cf 09 a0 8f f0 cf 28 88 03 52 c4 dd f0 de 5c 18 73 48 72 b1 79 7f f3 bc 95 81 9d ad 9f fa c0 b4 23 6b 8f dd 23 7d f1 f9 20 4d ef 19 bc 38 bb 55 6d Data Ascii: c$@L\|.th1%2s<~3wKD!Tx*<)U`fq4'B2=T_y6i-^u_-lljd];-K[\|_y'LgFlo@\|!:GDpTy )(R\sHry#k#} M8Um
2024-07-27 22:42:25 UTC	16384	IN	Data Raw: 03 93 f2 c6 9d 54 23 5e 70 13 8c bc 29 b1 a9 f2 7a 94 2b 68 c9 99 c2 81 df dc 74 a6 ee d2 f3 e4 6f 1f 6d ce 06 e6 f3 57 9c 77 cf cf ae 74 e1 84 f4 05 67 47 2b ba a8 71 5f fe 52 aa 16 5e 56 de 2d 56 1f 5d 03 37 d2 10 ac 04 1d 9b 9d 02 6a 6c ef 79 35 1b f1 b5 a5 96 97 1b 66 65 b0 6a 96 44 08 97 06 4e a2 1e 93 99 d5 fd 94 5c 50 47 eb db 06 93 01 42 63 ca 64 d6 9d a4 e7 00 16 d5 46 4f 7e ab 4b 0f 95 01 1c 42 5b 8d a8 c6 c0 1f ba 8d 29 a3 7f 3f d3 27 8d 07 b8 a8 4e 88 bb 34 8f 65 3b 3f 13 a4 de 79 7a 52 a5 69 42 74 cd 74 5e 7b fa c6 ea 0b 3d 1d ee 4b 9f 93 ae 4c bc 32 ee b6 a7 3c 60 d5 99 19 8e fa 22 6f 21 bd 5e bc e8 0f 71 d1 17 c8 12 0e 7b c2 91 9d 74 a0 14 51 19 c6 60 a4 2d 1b 85 e9 e2 78 5d 75 06 08 f9 e3 3d 08 78 90 48 cd f8 72 c5 72 da 14 ab de 95 23 08 Data Ascii: T#^p)z+htomWwtgG+q_R^V-V]7jly5fejDN\PGBcdFO~KB[)?'N4e;?yzRiBtt^{=KL2<`"o!^q{tQ`-x]u=xHrr#
2024-07-27 22:42:25 UTC	16384	IN	Data Raw: c4 d4 0c 8f e1 44 36 71 e9 da 81 0d 74 2a 88 69 ba 76 26 5c 61 93 46 c6 c9 15 05 3d ea 65 55 d6 5c 84 b6 8a 1a 0a 45 31 0b 93 05 cc 80 c4 e9 88 1e 3a 15 42 c4 58 5e 2c da 9b 7f 08 37 5d a8 6d 7d f2 04 1b fd 31 bc ff a0 58 4a e1 14 fb 5c 61 e1 6f e1 d1 c4 b6 0b 18 1f 91 57 cb e9 6e 0c eb b8 a7 ba 55 73 7c aa b8 45 b1 d2 b3 f8 2d 6c 91 07 90 be 7f 55 7a 7f 1e 05 e1 2c af a2 39 83 17 d1 2b b3 fd c5 b1 c0 ab 8e 54 2a b2 31 7c 26 9b ac 15 f4 59 e3 28 ba d9 9d 7f 6e 34 d6 a5 7f 00 c3 bf 5b 9e a0 47 31 96 f7 73 66 19 32 1c 89 89 fd c0 b4 4e 19 5a 77 17 31 8b 69 32 53 ff f5 12 9c 41 0e d6 05 a0 ba fb dd fb a5 be af 3d 63 51 52 b7 37 6f 92 f4 ac ed 1e e3 1e 1d 86 dc 4c 68 46 80 59 30 9a 7b 91 3c 81 bb 56 64 2f cd 1f 4b 96 f1 02 3b 7c fa 40 14 d1 d5 d8 70 ce f3 1e Data Ascii: D6qtiv&\aF=eU\E1:BX^,7]m}1XJ\aoWnUs\|E-lUz,9+T1\|&Y(n4[G1sf2NZw1i2SA=cQR7oLhFY0{<Vd/K;\|@p
2024-07-27 22:42:25 UTC	16384	IN	Data Raw: 72 ba 19 d2 2a 48 53 26 34 fe bc 8e 1c 82 b5 70 95 d0 55 5c 3d 27 5f f1 c4 37 ad 84 28 f1 24 60 26 3f fa da d7 37 19 22 78 82 af ff fa d4 06 db 8c 2d 12 d2 a3 87 9e 98 42 70 dc 17 88 03 b6 11 db aa fb 40 ce fb 11 79 3d 51 b5 47 f3 eb 2c 80 87 a4 b1 b5 9e 1d 2b b3 a2 1f e4 c9 a6 2c ea 8c 83 ed 38 37 74 dd 2e 5c 6b 3d b4 a8 93 77 7f 11 59 3c f5 a7 ca ff 4b ab e1 f9 86 9b 51 02 62 b9 c7 0d 69 00 69 93 ef 93 75 03 7c 5d c2 78 7e 82 01 33 b8 9f f8 2f f7 06 a6 cd 43 ac 1e 4b f1 05 1d be 64 4e c7 98 c7 10 05 64 ca af 5f 6d bc 8e 41 f9 57 dd 59 5f 75 ef cb fc 83 a7 14 fa d1 69 23 ec 96 aa 07 29 7f 1a 2e df 44 7d 84 d1 54 ff e6 9d d2 db 32 6c 5d 73 1b 66 45 00 6c 3e 42 ac 04 9f de e1 9f 69 3c b6 cb 00 ab ba 40 d8 fb 4b 7c c9 8f 6d fa a5 49 c6 39 4b 59 5c 0e 1c 16 Data Ascii: r*HS&4pU\='_7($`&?7"x-Bp@y=QG,+,87t.\k=wY<KQbiiu\|]x~3/CKdNd_mAWY_ui#).D}T2l]sfEl>Bi<@K\|mI9KY\
2024-07-27 22:42:25 UTC	16384	IN	Data Raw: 5d f5 e3 70 76 9e 83 bc 7f a2 a0 36 a8 a4 f8 a7 02 ef e1 52 56 7b 70 6c 75 aa a7 be 13 9f ff 16 f6 74 32 d8 2b 92 c1 b3 e7 80 d2 5d 30 e4 a0 18 b8 73 40 31 63 97 ba 94 a7 5e c8 97 c8 08 f2 f9 c7 51 ef 79 99 cc b3 25 f6 59 92 35 f7 c7 12 23 8d fe d5 14 2a 01 81 fa 15 5a 9d 31 ba 13 0d 4f ea 38 4f e2 38 ba 64 17 f2 c1 1c f2 9f a3 92 48 fc 4b 2c c4 1e 84 1e d8 23 c7 ea 16 70 53 11 b8 e1 85 f2 25 99 5b 4c 6b 0f 15 95 32 2e 15 7e 93 b5 fc 26 f9 f7 2c ad 6d dc a3 34 08 15 75 ed 25 75 25 9b bf 50 dc ad 5a 02 94 7d b8 1a e5 25 6f be 73 eb b6 af 1b 83 ff 2a 32 fa 09 4e ad ed da dc 59 95 15 30 06 45 a9 a0 54 24 a9 e3 9b 54 d7 57 88 c9 33 81 5a 93 72 fe 6b 12 03 44 39 92 2f fe e4 ff 32 36 1d 76 ed d4 55 cd ad 5a 1e 26 f4 d5 ec e6 68 0b 9c f4 d0 f2 5d 09 a7 0b 5c 16 Data Ascii: ]pv6RV{plut2+]0s@1c^Qy%Y5#Z1O8O8dHK,#pS%[Lk2.~&,m4u%u%PZ}%os2NY0ET$TW3ZrkD9/26vUZ&h]\
2024-07-27 22:42:25 UTC	16384	IN	Data Raw: 6d 6a a4 70 b3 a4 89 e1 9e a6 2e fc 1f 95 c1 29 72 66 03 ae 94 bb c1 79 4b 44 6a ce 95 e5 89 23 56 e0 49 2a f6 23 b8 22 09 eb 1b 45 6b 2b 34 eb a2 07 2b 40 67 94 cc ca e4 9a 39 48 d3 2b 2f c8 92 e5 5f f0 63 6d 04 40 1c 21 cf 78 39 53 72 57 0c 93 5c 76 11 74 0f 6e 0e e6 c8 0a c9 68 94 da 45 9a 1a 18 19 7d 6e 3f d0 13 0a 4e 39 fa 71 65 e7 5e 50 08 54 f9 f0 bc 84 23 6a 69 a3 51 20 82 59 56 d6 50 3e 72 1f 31 2e f9 10 02 34 5c 8c 28 17 cf e7 e6 6b 14 75 d3 90 be fe 1b 67 4e 42 a5 71 82 4a 1d 91 40 35 6a 4d e8 2f 2b d8 f8 e2 48 aa e4 25 8d e7 cf f1 b6 51 1c 83 df 0f df d0 47 fc ff cc 3c 29 ec dc b5 53 f2 9b 4e 65 25 84 26 17 cb bf b0 d8 f1 9c 05 ae 18 9a 90 9b 7e a7 04 53 58 62 7d 05 95 d0 fe 28 9a c7 12 b5 c2 f8 80 e6 c1 ca cc 14 03 f4 8b 01 ac 07 67 24 06 f4 Data Ascii: mjp.)rfyKDj#VI*#"Ek+4+@g9H+/_cm@!x9SrW\vtnhE}n?N9qe^PT#jiQ YVP>r1.4\(kugNBqJ@5jM/+H%QG<)SNe%&~SXb}(g$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49723	18.173.206.112	443	7824	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:42:30 UTC	326	OUT	POST /zbd HTTP/1.1 Connection: Keep-Alive Content-Type: application/json; Charset=UTF-8 Accept: / Authorization: Signature=e09076fb7be72413458f55a70553fc9fe7a788e10f08e18ca857b7883846325f User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 353 Host: d3cored83b0wp2.cloudfront.net
2024-07-27 22:42:30 UTC	353	OUT	Data Raw: 7b 22 74 61 62 6c 65 22 3a 22 7a 62 5f 61 6e 61 6c 79 74 69 63 73 22 2c 22 64 61 74 61 22 3a 22 7b 5c 22 30 5c 22 3a 5c 22 5c 22 2c 5c 22 31 5c 22 3a 5c 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5c 22 2c 5c 22 32 5c 22 3a 5c 22 32 30 32 34 30 37 32 37 31 38 34 31 35 34 5c 22 2c 5c 22 33 5c 22 3a 5c 22 63 68 65 61 74 65 6e 67 69 6e 65 5c 22 2c 5c 22 34 5c 22 3a 5c 22 63 68 65 61 74 65 6e 67 69 6e 65 5c 22 2c 5c 22 35 5c 22 3a 5c 22 52 41 56 5f 43 72 6f 73 73 5c 22 2c 5c 22 31 38 5c 22 3a 5c 22 5a 42 5f 52 41 56 5f 43 72 6f 73 73 5f 54 72 69 5f 4e 43 42 5c 22 2c 5c 22 31 39 5c 22 3a 5c 22 5c 22 2c 5c 22 32 31 5c 22 3a 5c 22 31 33 33 5c 22 2c 5c 22 36 5c 22 3a 5c 22 33 5c 22 2c 5c 22 37 5c Data Ascii: {"table":"zb_analytics","data":"{\"0\":\"\",\"1\":\"9e146be9-c76a-4720-bcdb-53011b87bd06\",\"2\":\"20240727184154\",\"3\":\"cheatengine\",\"4\":\"cheatengine\",\"5\":\"RAV_Cross\",\"18\":\"ZB_RAV_Cross_Tri_NCB\",\"19\":\"\",\"21\":\"133\",\"6\":\"3\",\"7\
2024-07-27 22:42:31 UTC	428	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 15 Connection: close Date: Sat, 27 Jul 2024 22:42:31 GMT Access-Control-Allow-Methods: GET,HEAD,PUT,POST,DELETE Access-Control-Allow-Origin: * X-Cache: Miss from cloudfront Via: 1.1 392cb865edfd76152c5ac655614b2f60.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P12 X-Amz-Cf-Id: XUFWCqZjoL94Mu8R__GfxGDS6PgN4Y2RJnXADGFni3vH6KPY2fhjKA==
2024-07-27 22:42:31 UTC	15	IN	Data Raw: 7b 22 53 74 61 74 75 73 22 3a 22 4f 4b 22 7d Data Ascii: {"Status":"OK"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49724	18.172.112.34	443	7188	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:42:31 UTC	273	OUT	GET /ReasonLabs-Setup-Wizard.exe?dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240727184154&is_silent=true&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100&b=&se=true&oip=26&ptl=7&dta=true&pds=%5bepp%2cvpn%2cdns%5d HTTP/1.1 Host: shield.reasonsecurity.com Connection: Keep-Alive
2024-07-27 22:42:31 UTC	1149	IN	HTTP/1.1 200 OK Content-Type: application/x-msdownload Content-Length: 2366456 Connection: close Date: Sat, 27 Jul 2024 22:42:31 GMT ETag: W/"241bf8-/G0m9QH1fC47W3GlBUr4R8fDaPw" Access-Control-Allow-Origin: * Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin Origin-Agent-Cluster: ?1 Referrer-Policy: no-referrer Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-DNS-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 content-disposition: attachment; filename=ReasonLabs-Setup-Wizard.exe X-Cache: Miss from cloudfront Via: 1.1 10f6ed997c15c1439b3ae1db258c7d16.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA60-P8 X-Amz-Cf-Id: oqj_kxSfctIL30d_iEy0skwJhqtM59-YXX--tpeMjlIVBpLvBy_muA==
2024-07-27 22:42:31 UTC	6260	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a9 4b 61 00 ed 2a 0f 53 ed 2a 0f 53 ed 2a 0f 53 82 35 04 53 ee 2a 0f 53 6e 36 01 53 e5 2a 0f 53 82 35 05 53 e6 2a 0f 53 82 35 0b 53 ef 2a 0f 53 63 22 50 53 ec 2a 0f 53 ed 2a 0e 53 64 2a 0f 53 6e 22 52 53 e4 2a 0f 53 db 0c 04 53 ae 2a 0f 53 fb 55 0b 52 ec 2a 0f 53 db 0c 05 53 ef 2a 0f 53 f6 b7 a5 53 e1 2a 0f 53 75 58 0c 52 ec 2a 0f 53 2a 2c 09 53 ec 2a 0f 53 52 69 63 68 ed 2a 0f Data Ascii: MZ@!L!This program cannot be run in DOS mode.$KaSSS5SSn6SS5SS5SSc"PSSSdSn"RSSSSURSSSSSuXRS,SSRich*
2024-07-27 22:42:32 UTC	7240	IN	Data Raw: 38 5e 34 74 0b 8b 56 44 8b 4e 28 e8 15 22 00 00 33 c0 5e 5b c2 08 00 56 8b f1 57 8b 46 04 8b 0e 8b 7c 81 fc 85 ff 74 0f ff 37 e8 40 0d 00 00 57 e8 3a 0d 00 00 59 59 ff 4e 04 5f 5e c3 b8 91 9f 41 00 e8 15 73 01 00 81 ec a4 00 00 00 8b 45 10 53 56 8b f1 57 33 db 8b fa 8d 8d 50 ff ff ff 88 18 e8 13 05 00 00 57 8d 8d 54 ff ff ff 89 5d fc 89 b5 50 ff ff ff e8 83 13 00 00 8d 8d 60 ff ff ff ff 75 08 e8 75 13 00 00 68 f8 00 00 00 e8 a8 0c 00 00 59 8b c8 89 4d 08 3b cb c6 45 fc 01 74 07 e8 9b 06 00 00 eb 02 33 c0 50 8d 8d 70 ff ff ff 88 5d fc 89 85 6c ff ff ff e8 8c 68 00 00 38 5d 0c 0f 84 8c 00 00 00 8b 85 6c ff ff ff c7 80 e0 00 00 00 01 00 00 00 89 5d 0c 8d 85 50 ff ff ff ba 4b 29 40 00 50 8d 4d 0c c6 45 fc 02 e8 99 6e 01 00 3b c3 74 1b 7e 0a 25 ff ff 00 00 0d Data Ascii: 8^4tVDN("3^[VWF\|t7@W:YYN_^AsESVW3PWT]P`uuhYM;Et3Pp]lh8]l]PK)@PMEn;t~%
2024-07-27 22:42:32 UTC	4344	IN	Data Raw: c8 ff 5f 5e 5b c3 8b c7 eb f8 55 8b ec 51 83 65 fc 00 56 57 8b f2 8b 55 08 8b f9 8b ce e8 b7 ff ff ff 85 c0 7d 09 8b cf e8 44 f6 ff ff eb 10 8b 0e 8b 04 81 8b cf 83 c0 0c 50 e8 e5 f6 ff ff 8b c7 5f 5e c9 c2 04 00 56 57 8b f9 8b 77 04 85 f6 74 1e 53 8b 07 4e 8b 1c b0 85 db 74 0e 8b cb e8 79 dc ff ff 53 e8 bd f0 ff ff 59 85 f6 75 e4 5b 83 67 04 00 5f 5e c3 b8 7a a2 41 00 e8 93 56 01 00 51 56 57 8b f1 6a 18 e8 66 f0 ff ff 8b f8 59 89 7d f0 83 65 fc 00 85 ff 74 1f 53 8b 5d 08 53 8b cf e8 7d f6 ff ff 83 c3 0c 8d 4f 0c 53 c6 45 fc 01 e8 6d f6 ff ff 5b eb 02 33 ff 8b 46 04 8d 48 01 89 4e 04 8b 0e 89 3c 81 8b 4d f4 5f 5e 64 89 0d 00 00 00 00 c9 c2 04 00 55 8b ec 53 56 8b 75 08 57 ff 75 0c 8b f9 8b 0e 33 c0 8d 1c 17 89 46 04 66 89 01 53 57 8d 55 08 33 c9 89 45 08 Data Ascii: _^[UQeVWU}DP_^VWwtSNtySYu[g_^zAVQVWjfY}etS]S}OSEm[3FHN<M_^dUSVuWu3FfSWU3E
2024-07-27 22:42:32 UTC	8192	IN	Data Raw: 4e 28 33 ff 83 fb 02 89 79 04 66 89 38 75 20 8d 45 e0 50 e8 a6 e6 ff ff eb 15 ff 75 0c 8b ce 50 e8 27 ff ff ff 84 c0 0f 84 e4 00 00 00 33 ff 66 81 66 20 ef fb 83 4d c4 ff 89 3e 89 7e 04 8d 45 e0 8d 4d c8 50 c6 45 fc 02 e8 de e5 ff ff 8d 4d ac c6 45 fc 03 e8 1f e5 ff ff 8d 45 0f 8d 4d c4 50 8d 45 ac 50 c6 45 fc 04 e8 8f fe ff ff 84 c0 74 34 80 7d 0f 00 74 26 8b 55 d4 8b 4d ac e8 b8 df ff ff 84 c0 75 23 ff 75 ac c6 45 fc 03 e8 9c df ff ff 59 8d 4d ac e8 dd e4 ff ff eb bc 6a 02 ff 15 80 b0 41 00 32 db eb 36 8b 4d b0 83 f9 07 76 11 8d 41 fa 3b c1 73 0a 8b 4d ac 89 45 b0 66 89 3c 41 8d 45 ac 8d 4e 28 50 e8 c1 e7 ff ff 8b 45 bc c6 46 24 01 89 06 8b 45 c0 89 46 04 b3 01 ff 75 ac e8 47 df ff ff ff 75 c8 e8 3f df ff ff 59 59 8d 4d c4 e8 f3 fb ff ff ff 75 e0 e8 2d Data Ascii: N(3yf8u EPuP'3ff M>~EMPEMEEMPEPEt4}t&UMu#uEYMjA26MvA;sMEf<AEN(PEF$EFuGu?YYMu-
2024-07-27 22:42:32 UTC	3392	IN	Data Raw: ff 15 44 c3 41 00 8b 54 24 0c 8b cf ff 15 40 c3 41 00 89 06 5f 5e c2 04 00 8b 44 24 04 8b 4c 24 0c 89 48 14 33 c0 c2 0c 00 8b 44 24 04 8b 4c 24 0c 89 48 18 33 c0 c2 0c 00 53 56 8b f1 57 8b 46 38 8b 5e 34 3b d8 72 02 8b d8 66 81 e3 00 f0 b8 00 10 00 00 3b d8 73 02 8b d8 83 7e 2c 00 8d 7e 2c 74 05 39 5e 30 74 17 53 8b cf e8 83 ff ff ff 83 3f 00 75 07 b8 0e 00 07 80 eb 05 89 5e 30 33 c0 5f 5e 5b c3 56 8b f1 8b 46 68 50 8b 08 ff 51 0c 85 c0 75 07 8b ce e8 9d ff ff ff 5e c3 8b c1 ba 00 00 20 00 33 c9 c7 40 04 64 bb 41 00 c7 40 08 54 bb 41 00 c7 40 0c 40 bb 41 00 c7 40 10 30 bb 41 00 c7 40 14 1c bb 41 00 c7 40 18 0c bb 41 00 c7 40 1c fc ba 41 00 c7 40 20 e8 ba 41 00 c7 40 24 d8 ba 41 00 89 48 28 89 48 2c 89 50 34 89 50 38 8a 54 24 04 89 48 40 89 48 48 89 48 30 Data Ascii: DAT$@A_^D$L$H3D$L$H3SVWF8^4;rf;s~,~,t9^0tS?u^03_^[VFhPQu^ 3@dA@TA@@A@0A@A@A@A@ A@$AH(H,P4P8T$H@HHH0
2024-07-27 22:42:32 UTC	13032	IN	Data Raw: 00 51 ff 50 0c c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 8b 48 08 ff 74 24 10 e8 4b 01 00 00 c2 10 00 ff 74 24 10 8b 44 24 08 ff 74 24 10 8b 48 08 ff 74 24 10 e8 b3 01 00 00 c2 10 00 53 56 8b f1 e8 2a 00 00 00 33 db 3b c3 75 21 6a 03 33 d2 8d 4e 04 e8 a5 15 01 00 89 5e 18 88 5e 08 c6 46 09 01 89 5e 0c 89 5e 10 89 5e 1c 33 c0 5e 5b c3 e8 0f 00 00 00 85 c0 7e 0a 25 ff ff 00 00 0d 00 00 07 80 c3 83 39 00 74 05 e9 df 14 01 00 e9 3a 15 01 00 56 8b f1 6a 0c e8 1f b2 ff ff 85 c0 59 74 0f 83 60 04 00 89 70 08 c7 00 00 bc 41 00 eb 02 33 c0 8b 4c 24 08 50 e8 0f 0e 00 00 6a 0c e8 f8 b1 ff ff 85 c0 59 74 0f 83 60 04 00 89 70 08 c7 00 f0 bb 41 00 eb 02 33 c0 8b 4c 24 0c 50 e8 e8 0d 00 00 5e c2 08 00 8b 4c 24 04 ff 49 04 8b 41 04 75 0d 85 c9 74 07 6a 01 e8 05 00 00 00 33 Data Ascii: QPt$D$t$Ht$Kt$D$t$Ht$SV*3;u!j3N^^F^^^3^[~%9t:VjYt`pA3L$PjYt`pA3L$P^L$IAutj3
2024-07-27 22:42:32 UTC	2896	IN	Data Raw: c6 45 fc 03 e8 48 85 ff ff 8d 7e 60 c6 45 fc 04 8b cf e8 56 9c ff ff 8d 4f 28 e8 32 85 ff ff 8d 8e 98 00 00 00 c6 45 fc 05 e8 f3 d4 ff ff 8b 4d f4 c7 06 d0 bc 41 00 c7 46 04 bc bc 41 00 c7 46 08 ac bc 41 00 c7 46 0c 98 bc 41 00 8b c6 5f 5e 64 89 0d 00 00 00 00 c9 c3 55 8b ec 56 8b 75 10 57 8b 7d 0c 83 26 00 6a 10 68 cc c3 41 00 57 e8 a0 e5 00 00 83 c4 0c 85 c0 75 07 8b 45 08 89 06 eb 56 6a 10 68 30 b4 41 00 57 e8 85 e5 00 00 83 c4 0c 85 c0 74 e5 6a 10 68 60 b4 41 00 57 e8 71 e5 00 00 83 c4 0c 85 c0 75 0a 8b 45 08 8b c8 8d 50 04 eb 1c 6a 10 68 80 b4 41 00 57 e8 53 e5 00 00 83 c4 0c 85 c0 75 17 8b 45 08 8b c8 8d 50 08 f7 d9 1b c9 23 ca 89 0e ff 40 10 33 c0 eb 05 b8 02 40 00 80 5f 5e 5d c2 0c 00 8b 44 24 04 ff 40 10 8b 40 10 c2 04 00 56 8b 74 24 08 ff 4e 10 Data Ascii: EH~`EVO(2EMAFAFAFA_^dUVuW}&jhAWuEVjh0AWtjh`AWquEPjhAWSuEP#@3@_^]D$@@Vt$N
2024-07-27 22:42:32 UTC	12792	IN	Data Raw: 16 03 c2 80 38 00 75 79 83 65 f8 00 c6 00 01 8b 46 0c 83 3f 00 8b 40 28 8b 0c 08 76 5b 89 4d fc ff 75 fc 8b 4e 0c e8 5f 00 00 00 84 c0 75 3c 8b 46 0c 83 65 08 00 8b 48 10 85 c9 76 15 8b 50 0c 8b 1a 3b 5d fc 74 35 ff 45 08 83 c2 08 39 4d 08 72 ee 83 c9 ff 85 c9 7c 28 8b 40 0c ff 74 c8 04 8b ce e8 76 ff ff ff 84 c0 74 16 ff 45 f8 ff 45 fc 8b 45 f8 3b 07 72 a8 b0 01 eb 07 8b 4d 08 eb d4 32 c0 5f 5e 5b c9 c2 04 00 8b 41 1c 33 d2 85 c0 56 76 13 8b 49 18 8b 31 3b 74 24 08 74 0b 42 83 c1 04 3b d0 72 f0 83 ca ff 33 c0 5e 85 d2 0f 9d c0 c2 04 00 56 8b f1 8b 46 0c 8b 50 04 e8 5c 49 00 00 8b 46 0c 8b ce ff 70 24 e8 0d ff ff ff 84 c0 74 1a 8b 4e 04 33 c0 85 c9 76 0d 8b 36 80 3c 06 00 74 09 40 3b c1 72 f5 b0 01 5e c3 32 c0 5e c3 83 61 2c 00 83 61 38 00 c3 b8 80 aa 41 Data Ascii: 8uyeF?@(v[MuN_u<FeHvP;]t5E9Mr\|(@tvtEEE;rM2_^[A3VvI1;t$tB;r3^VFP\IFp$tN3v6<t@;r^2^a,a8A
2024-07-27 22:42:32 UTC	6396	IN	Data Raw: 8b 01 00 00 75 10 38 88 8c 01 00 00 75 08 38 88 8e 01 00 00 74 67 6a 01 8d 4d f0 e8 cc 72 ff ff eb 5b 8b 45 08 33 d2 38 88 8c 01 00 00 74 03 6a 02 5a 38 88 8d 01 00 00 74 03 80 ce 01 3b d1 74 3c eb 31 8b 45 08 33 d2 38 88 88 01 00 00 75 03 6a 01 5a 38 88 8a 01 00 00 74 03 83 ca 02 38 88 8b 01 00 00 74 03 83 ca 20 38 88 8e 01 00 00 74 03 80 ce 01 52 8d 4d f0 e8 94 72 ff ff 56 8d 4d f0 ff 75 10 e8 95 73 ff ff 8d 4d f0 8b f0 e8 fc 72 ff ff 8b c6 5e c9 c2 0c 00 55 8b ec 83 ec 24 8b 55 08 53 56 83 fa ff 57 0f 84 b5 00 00 00 8b 41 78 8b 49 7c 8b 34 90 8b 44 90 04 83 65 e4 00 03 ce 2b c6 89 4d dc 8d 4d dc 89 45 e0 e8 6a 09 00 00 85 c0 89 45 f4 0f 84 87 00 00 00 8d 4d dc e8 ce 07 00 00 8b 4d e4 88 45 0b 83 e0 0f 6a 00 89 45 f8 8b 45 dc 5f 57 8d 34 01 5b 89 7d fc Data Ascii: u8u8tgjMr[E38tjZ8t;t<1E38ujZ8t8t 8tRMrVMusMr^U$USVWAxI\|4De+MMEjEMMEjEE_W4[}
2024-07-27 22:42:32 UTC	1084	IN	Data Raw: 00 00 00 83 65 08 00 83 7e 04 00 0f 86 d7 00 00 00 8b 45 08 8b 4e 24 c1 e0 02 89 45 0c 8b 04 08 85 c0 0f 84 b1 00 00 00 83 65 e4 00 83 65 e8 00 83 f8 01 76 4e 48 89 45 ec eb 03 8b 5d f0 8b 4b 38 e8 03 f0 ff ff 8b cf 89 45 d4 8b da e8 06 86 ff ff 8b 47 04 8b 17 8d 48 01 89 4f 04 8b 4d d4 01 4d e4 89 0c c2 89 5c c2 04 11 5d e8 39 5d e8 77 0c 72 05 39 4d e4 73 05 e8 eb ee ff ff ff 4d ec 75 b8 8b 56 34 8b 5d 08 8b 4e 2c 8b 46 28 0f b6 14 1a 8b 5d 0c 03 14 0b 8b 0c d0 89 4d cc 8b 5c d0 04 3b 5d e8 77 0c 72 05 3b 4d e4 73 05 e8 b5 ee ff ff 8b cf e8 9d 85 ff ff 8b 47 04 8b 17 8d 48 01 89 4f 04 8b 4d cc 2b 4d e4 1b 5d e8 89 0c c2 89 5c c2 04 8b 5d f0 ff 45 08 8b 45 08 3b 46 04 0f 82 29 ff ff ff 8b 4b 38 e8 59 ef ff ff 89 45 dc 89 55 e0 eb 75 33 db 39 5e 04 89 5d Data Ascii: e~EN$EeevNHE]K8EGHOMM\]9]wr9MsMuV4]N,F(]M\;]wr;MsGHOM+M]\]EE;F)K8YEUu39^]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49725	18.173.206.112	443	7824	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:42:33 UTC	326	OUT	POST /zbd HTTP/1.1 Connection: Keep-Alive Content-Type: application/json; Charset=UTF-8 Accept: / Authorization: Signature=e09076fb7be72413458f55a70553fc9fe7a788e10f08e18ca857b7883846325f User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 355 Host: d3cored83b0wp2.cloudfront.net
2024-07-27 22:42:33 UTC	355	OUT	Data Raw: 7b 22 74 61 62 6c 65 22 3a 22 7a 62 5f 61 6e 61 6c 79 74 69 63 73 22 2c 22 64 61 74 61 22 3a 22 7b 5c 22 30 5c 22 3a 5c 22 5c 22 2c 5c 22 31 5c 22 3a 5c 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5c 22 2c 5c 22 32 5c 22 3a 5c 22 32 30 32 34 30 37 32 37 31 38 34 31 35 34 5c 22 2c 5c 22 33 5c 22 3a 5c 22 63 68 65 61 74 65 6e 67 69 6e 65 5c 22 2c 5c 22 34 5c 22 3a 5c 22 63 68 65 61 74 65 6e 67 69 6e 65 5c 22 2c 5c 22 35 5c 22 3a 5c 22 57 65 62 41 64 76 69 73 6f 72 5c 22 2c 5c 22 31 38 5c 22 3a 5c 22 5a 42 5f 57 65 62 41 64 76 69 73 6f 72 5f 56 33 5c 22 2c 5c 22 31 39 5c 22 3a 5c 22 5c 22 2c 5c 22 32 31 5c 22 3a 5c 22 31 33 33 5c 22 2c 5c 22 36 5c 22 3a 5c 22 33 5c 22 2c 5c 22 37 5c 22 3a 5c Data Ascii: {"table":"zb_analytics","data":"{\"0\":\"\",\"1\":\"9e146be9-c76a-4720-bcdb-53011b87bd06\",\"2\":\"20240727184154\",\"3\":\"cheatengine\",\"4\":\"cheatengine\",\"5\":\"WebAdvisor\",\"18\":\"ZB_WebAdvisor_V3\",\"19\":\"\",\"21\":\"133\",\"6\":\"3\",\"7\":\
2024-07-27 22:42:34 UTC	428	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 15 Connection: close Date: Sat, 27 Jul 2024 22:42:34 GMT Access-Control-Allow-Methods: GET,HEAD,PUT,POST,DELETE Access-Control-Allow-Origin: * X-Cache: Miss from cloudfront Via: 1.1 ed5042a23d5905bfac08effe99f4b1ce.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P12 X-Amz-Cf-Id: xxvlyeYLFZMxw05FdasCI61q6eq8g2XjzPiJW05Z9SlaThhJN5YMSw==
2024-07-27 22:42:34 UTC	15	IN	Data Raw: 7b 22 53 74 61 74 75 73 22 3a 22 4f 4b 22 7d Data Ascii: {"Status":"OK"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49726	35.162.225.150	443	7404	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:42:34 UTC	232	OUT	PUT /mosaic/2.0/product-web/am/v1/record HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: SA X-Api-Key: wtuQtD4DdA8poRbq0pzMh1iysE9YiVlC14kJF9ZI Content-Length: 311 Host: analytics.apis.mcafee.com
2024-07-27 22:42:34 UTC	311	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 7b 22 4d 61 63 68 69 6e 65 5f 49 44 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 4f 53 22 3a 22 57 49 4e 22 2c 22 4f 53 5f 50 6c 61 74 66 6f 72 6d 22 3a 22 36 34 22 2c 22 4f 53 5f 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 31 2e 31 38 38 39 22 2c 22 50 72 6f 64 75 63 74 5f 56 65 72 73 69 6f 6e 22 3a 22 34 2e 31 2e 31 2e 38 36 35 22 2c 22 55 55 49 44 22 3a 22 7b 44 42 30 43 46 36 41 30 2d 44 32 42 39 2d 34 34 42 37 2d 39 37 37 31 2d 34 34 36 30 42 44 35 38 37 31 30 44 7d 22 2c 22 65 61 22 3a 22 50 72 6f 63 65 73 73 22 2c 22 65 63 22 3a 22 42 6f 6f 74 53 74 72 61 70 49 6e 73 74 61 6c 6c 65 72 22 2c 22 65 6c 22 3a 22 53 74 61 72 74 65 64 22 Data Ascii: {"Data":{"Machine_ID":"9e146be9-c76a-4720-bcdb-53011b87bd06","OS":"WIN","OS_Platform":"64","OS_Version":"10.0.19041.1889","Product_Version":"4.1.1.865","UUID":"{DB0CF6A0-D2B9-44B7-9771-4460BD58710D}","ea":"Process","ec":"BootStrapInstaller","el":"Started"
2024-07-27 22:42:34 UTC	303	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 22:42:34 GMT Content-Type: application/x-amz-json-1.1 Content-Length: 16 Connection: close x-amz-id-2: nvLMh8ghQU2wbaZndGwbp++yO4L34716GmW93d5YDD6EJBq92G0eBYjgZXxFqCaIwKOx8bt9Vt2FbjHWVwKR4TnkD3/D9g8C x-amzn-RequestId: c0b0c488-2231-0506-9faf-be9276f00bf2
2024-07-27 22:42:34 UTC	16	IN	Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 22 6f 6b 22 7d Data Ascii: {"message":"ok"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49727	35.162.225.150	443	7404	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:42:35 UTC	232	OUT	PUT /mosaic/2.0/product-web/am/v1/record HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: SA X-Api-Key: wtuQtD4DdA8poRbq0pzMh1iysE9YiVlC14kJF9ZI Content-Length: 311 Host: analytics.apis.mcafee.com
2024-07-27 22:42:35 UTC	311	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 7b 22 4d 61 63 68 69 6e 65 5f 49 44 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 4f 53 22 3a 22 57 49 4e 22 2c 22 4f 53 5f 50 6c 61 74 66 6f 72 6d 22 3a 22 36 34 22 2c 22 4f 53 5f 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 31 2e 31 38 38 39 22 2c 22 50 72 6f 64 75 63 74 5f 56 65 72 73 69 6f 6e 22 3a 22 34 2e 31 2e 31 2e 38 36 35 22 2c 22 55 55 49 44 22 3a 22 7b 44 42 30 43 46 36 41 30 2d 44 32 42 39 2d 34 34 42 37 2d 39 37 37 31 2d 34 34 36 30 42 44 35 38 37 31 30 44 7d 22 2c 22 65 61 22 3a 22 49 6e 73 74 61 6c 6c 22 2c 22 65 63 22 3a 22 42 6f 6f 74 53 74 72 61 70 49 6e 73 74 61 6c 6c 65 72 22 2c 22 65 6c 22 3a 22 53 74 61 72 74 65 64 22 Data Ascii: {"Data":{"Machine_ID":"9e146be9-c76a-4720-bcdb-53011b87bd06","OS":"WIN","OS_Platform":"64","OS_Version":"10.0.19041.1889","Product_Version":"4.1.1.865","UUID":"{DB0CF6A0-D2B9-44B7-9771-4460BD58710D}","ea":"Install","ec":"BootStrapInstaller","el":"Started"
2024-07-27 22:42:35 UTC	315	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 22:42:35 GMT Content-Type: application/x-amz-json-1.1 Content-Length: 16 Connection: close x-amzn-RequestId: cd05de2b-1d5f-6e15-921a-a430b3feb414 x-amz-id-2: NZH27SsCAzlMNps2pbriWoTA3rlswesXJTKwExdo8uq2qW+nZ9thAaURB9FXFRO0vUXb9zCD/5u96XSGG/zLxU+m+usfclutU8LUZkwT7FQ=
2024-07-27 22:42:35 UTC	16	IN	Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 22 6f 6b 22 7d Data Ascii: {"message":"ok"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49728	18.173.206.112	443	7824	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:42:35 UTC	326	OUT	POST /zbd HTTP/1.1 Connection: Keep-Alive Content-Type: application/json; Charset=UTF-8 Accept: / Authorization: Signature=e09076fb7be72413458f55a70553fc9fe7a788e10f08e18ca857b7883846325f User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 343 Host: d3cored83b0wp2.cloudfront.net
2024-07-27 22:42:35 UTC	343	OUT	Data Raw: 7b 22 74 61 62 6c 65 22 3a 22 7a 62 5f 61 6e 61 6c 79 74 69 63 73 22 2c 22 64 61 74 61 22 3a 22 7b 5c 22 30 5c 22 3a 5c 22 5c 22 2c 5c 22 31 5c 22 3a 5c 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5c 22 2c 5c 22 32 5c 22 3a 5c 22 32 30 32 34 30 37 32 37 31 38 34 31 35 34 5c 22 2c 5c 22 33 5c 22 3a 5c 22 63 68 65 61 74 65 6e 67 69 6e 65 5c 22 2c 5c 22 34 5c 22 3a 5c 22 63 68 65 61 74 65 6e 67 69 6e 65 5c 22 2c 5c 22 35 5c 22 3a 5c 22 57 65 61 74 68 65 72 5a 65 72 6f 5c 22 2c 5c 22 31 38 5c 22 3a 5c 22 5a 42 5f 57 5a 5f 56 31 5c 22 2c 5c 22 31 39 5c 22 3a 5c 22 5c 22 2c 5c 22 32 31 5c 22 3a 5c 22 31 33 33 5c 22 2c 5c 22 36 5c 22 3a 5c 22 33 5c 22 2c 5c 22 37 5c 22 3a 5c 22 31 2e 33 34 2e 33 Data Ascii: {"table":"zb_analytics","data":"{\"0\":\"\",\"1\":\"9e146be9-c76a-4720-bcdb-53011b87bd06\",\"2\":\"20240727184154\",\"3\":\"cheatengine\",\"4\":\"cheatengine\",\"5\":\"WeatherZero\",\"18\":\"ZB_WZ_V1\",\"19\":\"\",\"21\":\"133\",\"6\":\"3\",\"7\":\"1.34.3
2024-07-27 22:42:36 UTC	428	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 15 Connection: close Date: Sat, 27 Jul 2024 22:42:35 GMT Access-Control-Allow-Methods: GET,HEAD,PUT,POST,DELETE Access-Control-Allow-Origin: * X-Cache: Miss from cloudfront Via: 1.1 20ce720be9c31a6a95223700ba5f8724.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P12 X-Amz-Cf-Id: 6GxDCgJt-4D7X7Lpm8CBem3eUcrnB_litsGeK44Hnj30yC-plnOCkw==
2024-07-27 22:42:36 UTC	15	IN	Data Raw: 7b 22 53 74 61 74 75 73 22 3a 22 4f 4b 22 7d Data Ascii: {"Status":"OK"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49731	188.114.96.3	443	7584	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:42:37 UTC	208	OUT	POST /forecast HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: NSIS_Inetc (Mozilla) Host: localweatherfree.com Content-Length: 285 Connection: Keep-Alive Cache-Control: no-cache
2024-07-27 22:42:37 UTC	285	OUT	Data Raw: 6c 6f 63 61 74 69 6f 6e 3d 50 75 57 47 31 4f 6d 4e 65 44 25 32 42 25 32 46 25 32 42 64 30 35 4a 4a 53 32 6d 4d 67 6e 58 49 72 4e 38 4d 68 7a 4a 39 68 59 62 52 36 68 6e 61 38 6e 4f 35 68 46 77 53 58 65 79 25 32 46 4e 55 6c 6a 38 52 59 61 62 6e 55 69 6f 4a 4a 70 25 32 42 47 36 37 39 4d 49 67 41 32 33 68 57 5a 65 6c 72 39 4c 25 32 42 6d 57 73 46 5a 56 42 50 78 67 78 57 73 6b 49 4e 75 4d 57 4d 44 6a 75 66 4e 78 69 65 53 36 35 58 58 49 37 4f 4b 25 32 46 76 33 62 52 54 74 6f 44 36 36 5a 7a 68 75 44 43 51 69 42 76 56 38 66 56 6a 70 67 6f 61 70 4b 6a 47 61 70 4a 64 65 44 6f 38 58 4c 25 32 46 6a 54 75 4a 6d 5a 30 61 68 63 53 76 57 25 32 42 25 32 42 75 56 66 4a 45 42 41 4d 75 4d 49 49 6b 47 77 66 35 69 37 62 55 64 35 38 43 55 47 25 32 42 6b 42 69 6c 68 57 62 51 79 Data Ascii: location=PuWG1OmNeD%2B%2F%2Bd05JJS2mMgnXIrN8MhzJ9hYbR6hna8nO5hFwSXey%2FNUlj8RYabnUioJJp%2BG679MIgA23hWZelr9L%2BmWsFZVBPxgxWskINuMWMDjufNxieS65XXI7OK%2Fv3bRTtoD66ZzhuDCQiBvV8fVjpgoapKjGapJdeDo8XL%2FjTuJmZ0ahcSvW%2B%2BuVfJEBAMuMIIkGwf5i7bUd58CUG%2BkBilhWbQy
2024-07-27 22:42:37 UTC	590	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 22:42:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uRphgSNSe4D11CbtTOMZNOiq8TFReV6KkhTvEIqL4u%2FtORWZG%2Fo2WobzsckzKLOTH8Gop%2FX%2FGlXrFbf7aYbnzreaL7nryMnxyEqI3CMNKo9x%2Foj9zLIksRZuFBhkCHz%2FWQUNjjwyRw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8aa024c9482e43a7-EWR alt-svc: h3=":443"; ma=86400
2024-07-27 22:42:37 UTC	70	IN	Data Raw: 34 30 0d 0a 4b 2f 6c 4a 79 50 2f 44 6b 74 48 37 48 44 6d 49 62 58 77 67 68 39 43 6b 46 5a 2f 64 45 61 37 48 55 4d 51 42 55 74 53 2b 57 56 36 48 4d 4f 35 41 61 30 38 79 53 56 4e 35 5a 53 2b 77 6e 58 4f 55 0d 0a Data Ascii: 40K/lJyP/DktH7HDmIbXwgh9CkFZ/dEa7HUMQBUtS+WV6HMO5Aa08ySVN5ZS+wnXOU
2024-07-27 22:42:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49732	35.162.225.150	443	7404	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:42:38 UTC	232	OUT	PUT /mosaic/2.0/product-web/am/v1/record HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: SA X-Api-Key: wtuQtD4DdA8poRbq0pzMh1iysE9YiVlC14kJF9ZI Content-Length: 336 Host: analytics.apis.mcafee.com
2024-07-27 22:42:38 UTC	336	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 7b 22 4d 61 63 68 69 6e 65 5f 49 44 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 4f 53 22 3a 22 57 49 4e 22 2c 22 4f 53 5f 50 6c 61 74 66 6f 72 6d 22 3a 22 36 34 22 2c 22 4f 53 5f 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 31 2e 31 38 38 39 22 2c 22 50 72 6f 64 75 63 74 5f 56 65 72 73 69 6f 6e 22 3a 22 34 2e 31 2e 31 2e 38 36 35 22 2c 22 55 55 49 44 22 3a 22 7b 44 42 30 43 46 36 41 30 2d 44 32 42 39 2d 34 34 42 37 2d 39 37 37 31 2d 34 34 36 30 42 44 35 38 37 31 30 44 7d 22 2c 22 65 61 22 3a 22 50 61 69 64 44 69 73 74 72 69 62 75 74 69 6f 6e 3d 74 72 75 65 22 2c 22 65 63 22 3a 22 49 6e 70 75 74 50 61 72 61 6d 65 74 65 72 73 22 2c 22 65 6c Data Ascii: {"Data":{"Machine_ID":"9e146be9-c76a-4720-bcdb-53011b87bd06","OS":"WIN","OS_Platform":"64","OS_Version":"10.0.19041.1889","Product_Version":"4.1.1.865","UUID":"{DB0CF6A0-D2B9-44B7-9771-4460BD58710D}","ea":"PaidDistribution=true","ec":"InputParameters","el
2024-07-27 22:42:38 UTC	303	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 22:42:38 GMT Content-Type: application/x-amz-json-1.1 Content-Length: 16 Connection: close x-amzn-RequestId: dd87794e-922f-a18e-8298-0350656b351f x-amz-id-2: hG5BiYUiPlfzFVPoBQQPzinu4zihUNtiqnYkjRymO93+3KvEURycg6jjGZceZ8tcveSj+VlGDWRyTEogK0jMUmUiNbhAPF+9
2024-07-27 22:42:38 UTC	16	IN	Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 22 6f 6b 22 7d Data Ascii: {"message":"ok"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49733	188.114.96.3	443	7584	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:42:39 UTC	208	OUT	POST /forecast HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: NSIS_Inetc (Mozilla) Host: localweatherfree.com Content-Length: 271 Connection: Keep-Alive Cache-Control: no-cache
2024-07-27 22:42:39 UTC	271	OUT	Data Raw: 6c 6f 63 61 74 69 6f 6e 3d 31 71 50 42 61 79 70 49 58 6e 66 41 35 4e 71 61 45 58 4a 6a 57 66 65 75 31 35 70 7a 78 61 25 32 46 30 77 71 52 70 4e 59 71 77 53 33 52 63 25 32 46 30 6f 37 4f 5a 37 56 33 67 4f 45 78 5a 7a 31 34 33 64 36 71 73 64 68 6f 75 49 41 57 78 4e 51 36 4b 4a 4d 48 25 32 46 74 77 6d 4a 34 7a 53 64 31 69 6a 73 4d 78 33 39 68 47 64 78 66 4e 41 46 70 76 31 75 31 79 71 6f 35 67 6b 46 37 50 49 56 6f 30 7a 54 66 75 39 56 6c 6e 7a 55 6b 62 76 4c 46 72 79 51 31 6a 54 6c 5a 74 4f 52 4b 51 36 34 53 42 5a 5a 5a 71 43 33 32 67 50 32 73 35 46 4d 4d 4a 51 31 37 71 6b 51 72 47 46 42 68 43 35 48 78 75 6a 66 63 4b 75 25 32 42 62 36 44 64 34 78 6c 50 57 48 4c 4c 49 37 57 78 25 32 42 73 4a 6b 38 64 6d 53 37 65 55 79 77 30 65 71 63 68 36 65 44 74 73 48 47 4e Data Ascii: location=1qPBaypIXnfA5NqaEXJjWfeu15pzxa%2F0wqRpNYqwS3Rc%2F0o7OZ7V3gOExZz143d6qsdhouIAWxNQ6KJMH%2FtwmJ4zSd1ijsMx39hGdxfNAFpv1u1yqo5gkF7PIVo0zTfu9VlnzUkbvLFryQ1jTlZtORKQ64SBZZZqC32gP2s5FMMJQ17qkQrGFBhC5HxujfcKu%2Bb6Dd4xlPWHLLI7Wx%2BsJk8dmS7eUyw0eqch6eDtsHGN
2024-07-27 22:42:39 UTC	580	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 22:42:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ab73FptqSq8FRlJn6ExJG8b5wsQdQpZqEnHyiZxESoZFFH6lGfeReSTKL5zvk8VSbBihbP%2FSjedAQJlYT34WKGwR4UvqTPxr612lbGr0NWFLZG80RYCFcwhi14E9WMCIso2lELe5VA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8aa024d26d2d1912-EWR alt-svc: h3=":443"; ma=86400
2024-07-27 22:42:39 UTC	70	IN	Data Raw: 34 30 0d 0a 6f 43 70 57 35 4a 2b 48 36 6d 37 42 68 33 4d 39 46 4a 2f 30 62 71 4d 62 49 44 42 62 2b 44 65 69 4c 78 2b 50 4e 4e 36 62 39 35 4a 4b 72 4f 6f 2b 4d 6d 56 67 50 74 7a 47 62 7a 71 55 4c 6b 58 32 0d 0a Data Ascii: 40oCpW5J+H6m7Bh3M9FJ/0bqMbIDBb+DeiLx+PNN6b95JKrOo+MmVgPtzGbzqULkX2
2024-07-27 22:42:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49735	188.114.96.3	443	7584	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:42:40 UTC	208	OUT	POST /forecast HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: NSIS_Inetc (Mozilla) Host: localweatherfree.com Content-Length: 277 Connection: Keep-Alive Cache-Control: no-cache
2024-07-27 22:42:40 UTC	277	OUT	Data Raw: 6c 6f 63 61 74 69 6f 6e 3d 31 47 52 5a 76 4c 35 65 59 48 38 6f 63 6c 74 4f 65 47 44 65 31 45 52 78 44 41 70 79 67 56 62 4d 56 7a 35 54 69 7a 41 57 78 56 61 67 74 4d 73 76 6b 39 46 62 79 58 59 4d 41 31 76 31 5a 4b 77 72 25 32 46 65 41 57 31 72 38 41 6e 39 65 4d 77 73 32 75 46 39 6f 79 65 46 67 58 72 72 45 77 32 63 57 37 66 6a 25 32 46 46 72 4a 61 6a 47 79 6d 6a 51 6f 64 41 71 74 6f 36 6a 36 51 56 6a 68 48 58 43 6e 36 62 43 32 77 62 44 6e 71 31 4a 38 48 30 42 47 41 49 5a 36 56 58 78 37 64 6d 6a 34 49 56 53 42 62 25 32 42 6d 59 65 25 32 46 41 36 5a 7a 30 77 51 72 77 75 49 25 32 42 38 41 70 7a 50 44 73 4e 7a 75 59 37 55 4a 43 39 53 57 43 41 38 25 32 42 53 6a 72 6c 44 25 32 46 57 76 6b 58 30 37 7a 33 4d 70 66 39 44 67 6d 56 55 78 25 32 42 52 6e 44 4a 55 54 64 Data Ascii: location=1GRZvL5eYH8ocltOeGDe1ERxDApygVbMVz5TizAWxVagtMsvk9FbyXYMA1v1ZKwr%2FeAW1r8An9eMws2uF9oyeFgXrrEw2cW7fj%2FFrJajGymjQodAqto6j6QVjhHXCn6bC2wbDnq1J8H0BGAIZ6VXx7dmj4IVSBb%2BmYe%2FA6Zz0wQrwuI%2B8ApzPDsNzuY7UJC9SWCA8%2BSjrlD%2FWvkX07z3Mpf9DgmVUx%2BRnDJUTd
2024-07-27 22:42:40 UTC	586	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 22:42:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=84PSmy8nQNv77yfkUQ%2B4PBcshFC2nzKXs2NH%2Bv86J3S02mX3EaB8S%2FecYW8CGdTXCdecl7Uf5203mNJwx0ayQF1MJ7Vtucy4sOFLQCVCfjwaHO%2FvS42E44cLu8rAAvC6GcJIj70teA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8aa024dbca2f0f7f-EWR alt-svc: h3=":443"; ma=86400
2024-07-27 22:42:40 UTC	70	IN	Data Raw: 34 30 0d 0a 49 58 6f 59 2f 6e 30 79 4a 4d 48 6c 6b 54 41 31 39 56 61 62 44 45 65 58 76 72 54 6a 65 6b 30 5a 6a 4a 50 50 6d 65 34 30 43 55 57 49 5a 71 4b 2f 74 66 44 4a 50 54 68 6c 79 79 78 59 32 6c 41 58 0d 0a Data Ascii: 40IXoY/n0yJMHlkTA19VabDEeXvrTjek0ZjJPPme40CUWIZqK/tfDJPThlyyxY2lAX
2024-07-27 22:42:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49738	3.230.219.225	443	7656	C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:42:40 UTC	186	OUT	POST / HTTP/1.1 Accept: application/json Content-Type: application/json; charset=utf-8 Host: track.analytics-data.io Content-Length: 1932 Expect: 100-continue Connection: Close
2024-07-27 22:42:41 UTC	25	IN	HTTP/1.1 100 Continue
2024-07-27 22:42:41 UTC	1932	OUT	Data Raw: 7b 22 73 74 72 65 61 6d 22 3a 22 64 69 67 69 74 61 6c 5f 73 6f 6c 75 74 69 6f 6e 73 5f 63 79 62 65 72 5f 72 61 76 5f 63 6c 69 65 6e 74 5f 69 6e 73 74 61 6c 6c 73 22 2c 22 64 61 74 61 22 3a 22 33 70 69 33 52 63 2b 6c 7a 4a 41 5c 2f 37 4b 6f 34 51 56 69 31 73 33 74 69 72 6f 57 6a 55 2b 5a 75 2b 70 54 75 4c 41 44 35 6b 65 44 6e 38 49 6d 77 4e 79 4d 2b 4d 77 75 35 51 52 65 54 43 56 6b 38 68 50 35 5c 2f 56 6a 6a 31 65 35 4c 79 2b 46 31 68 43 4b 54 76 74 76 70 47 6b 75 65 48 58 50 57 68 79 30 6e 2b 38 4f 4f 71 55 31 54 55 45 58 69 4e 6c 75 6b 73 79 73 66 31 78 37 69 7a 4c 45 4c 53 77 57 38 6c 38 37 48 46 67 4c 5c 2f 36 57 31 4b 41 6c 4c 38 52 77 4d 62 64 35 5a 46 4d 72 30 4c 4d 51 30 5a 67 52 30 6d 4e 52 67 7a 6a 67 78 64 33 49 36 77 5a 73 31 46 2b 51 62 31 38 Data Ascii: {"stream":"digital_solutions_cyber_rav_client_installs","data":"3pi3Rc+lzJA\/7Ko4QVi1s3tiroWjU+Zu+pTuLAD5keDn8ImwNyM+Mwu5QReTCVk8hP5\/Vjj1e5Ly+F1hCKTvtvpGkueHXPWhy0n+8OOqU1TUEXiNluksysf1x7izLELSwW8l87HFgL\/6W1KAlL8RwMbd5ZFMr0LMQ0ZgR0mNRgzjgxd3I6wZs1F+Qb18
2024-07-27 22:42:41 UTC	245	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 22:42:41 GMT Content-Type: application/json; charset=utf-8 Content-Length: 15 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,HEAD,PUT,POST,DELETE {"Status":"OK"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49737	3.230.219.225	443	7656	C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:42:40 UTC	186	OUT	POST / HTTP/1.1 Accept: application/json Content-Type: application/json; charset=utf-8 Host: track.analytics-data.io Content-Length: 1907 Expect: 100-continue Connection: Close
2024-07-27 22:42:41 UTC	25	IN	HTTP/1.1 100 Continue
2024-07-27 22:42:41 UTC	1907	OUT	Data Raw: 7b 22 73 74 72 65 61 6d 22 3a 22 64 69 67 69 74 61 6c 5f 73 6f 6c 75 74 69 6f 6e 73 5f 63 79 62 65 72 5f 72 61 76 5f 63 6c 69 65 6e 74 5f 69 6e 73 74 61 6c 6c 73 22 2c 22 64 61 74 61 22 3a 22 52 4a 39 54 53 6b 69 54 61 38 49 2b 68 53 6c 55 2b 43 37 6c 66 5c 2f 6a 56 4d 64 54 39 78 6d 4f 57 39 4b 49 72 52 36 48 47 42 75 55 55 5a 76 68 4b 48 4a 32 36 61 4d 7a 31 6b 4f 37 6a 48 42 31 78 6e 30 63 35 65 76 6e 58 4c 69 2b 58 31 48 68 73 59 52 4f 43 78 36 77 55 32 56 6f 7a 63 71 45 65 44 50 76 67 65 64 6a 41 31 58 72 48 76 72 41 77 72 30 44 65 50 6a 49 67 6a 35 4a 6d 36 62 6f 50 75 44 74 4b 65 78 5a 6a 75 61 46 37 4f 35 45 6e 42 52 39 57 6a 47 50 33 55 55 53 35 79 50 45 68 52 4d 62 39 37 53 57 4f 72 37 64 48 79 55 42 4c 62 56 70 33 74 76 58 61 45 61 69 50 59 58 Data Ascii: {"stream":"digital_solutions_cyber_rav_client_installs","data":"RJ9TSkiTa8I+hSlU+C7lf\/jVMdT9xmOW9KIrR6HGBuUUZvhKHJ26aMz1kO7jHB1xn0c5evnXLi+X1HhsYROCx6wU2VozcqEeDPvgedjA1XrHvrAwr0DePjIgj5Jm6boPuDtKexZjuaF7O5EnBR9WjGP3UUS5yPEhRMb97SWOr7dHyUBLbVp3tvXaEaiPYX
2024-07-27 22:42:41 UTC	245	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 22:42:41 GMT Content-Type: application/json; charset=utf-8 Content-Length: 15 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,HEAD,PUT,POST,DELETE {"Status":"OK"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	49740	3.230.219.225	443	7656	C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:42:41 UTC	186	OUT	POST / HTTP/1.1 Accept: application/json Content-Type: application/json; charset=utf-8 Host: track.analytics-data.io Content-Length: 1951 Expect: 100-continue Connection: Close
2024-07-27 22:42:41 UTC	25	IN	HTTP/1.1 100 Continue
2024-07-27 22:42:41 UTC	1951	OUT	Data Raw: 7b 22 73 74 72 65 61 6d 22 3a 22 64 69 67 69 74 61 6c 5f 73 6f 6c 75 74 69 6f 6e 73 5f 63 79 62 65 72 5f 72 61 76 5f 63 6c 69 65 6e 74 5f 69 6e 73 74 61 6c 6c 73 22 2c 22 64 61 74 61 22 3a 22 76 57 44 71 52 2b 62 55 66 43 79 30 54 67 43 6c 66 5a 37 70 34 56 66 4a 57 63 59 68 6c 53 6f 5c 2f 4b 55 59 52 49 68 35 30 67 47 39 7a 38 32 61 35 68 36 6c 48 38 33 73 77 4b 77 6c 65 30 71 53 63 33 47 68 37 4d 35 46 71 4e 4c 47 7a 4e 48 61 78 63 4f 79 6a 59 38 64 49 55 33 65 71 50 5c 2f 6c 4d 64 48 71 6a 47 46 56 64 41 54 4b 75 6f 76 50 70 70 4f 65 6a 4b 38 71 77 69 36 47 51 2b 4f 30 6a 57 6c 35 71 51 32 66 50 65 6a 6c 5a 58 77 68 47 31 47 79 61 62 57 4a 6b 72 42 79 79 34 7a 79 4d 4d 66 6d 34 2b 69 57 4d 63 51 61 43 61 6f 51 44 53 42 79 47 4d 32 33 59 62 32 52 54 33 Data Ascii: {"stream":"digital_solutions_cyber_rav_client_installs","data":"vWDqR+bUfCy0TgClfZ7p4VfJWcYhlSo\/KUYRIh50gG9z82a5h6lH83swKwle0qSc3Gh7M5FqNLGzNHaxcOyjY8dIU3eqP\/lMdHqjGFVdATKuovPppOejK8qwi6GQ+O0jWl5qQ2fPejlZXwhG1GyabWJkrByy4zyMMfm4+iWMcQaCaoQDSByGM23Yb2RT3
2024-07-27 22:42:41 UTC	245	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 22:42:41 GMT Content-Type: application/json; charset=utf-8 Content-Length: 15 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,HEAD,PUT,POST,DELETE {"Status":"OK"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	49739	3.230.219.225	443	7656	C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:42:41 UTC	186	OUT	POST / HTTP/1.1 Accept: application/json Content-Type: application/json; charset=utf-8 Host: track.analytics-data.io Content-Length: 1932 Expect: 100-continue Connection: Close
2024-07-27 22:42:41 UTC	25	IN	HTTP/1.1 100 Continue
2024-07-27 22:42:41 UTC	1932	OUT	Data Raw: 7b 22 73 74 72 65 61 6d 22 3a 22 64 69 67 69 74 61 6c 5f 73 6f 6c 75 74 69 6f 6e 73 5f 63 79 62 65 72 5f 72 61 76 5f 63 6c 69 65 6e 74 5f 69 6e 73 74 61 6c 6c 73 22 2c 22 64 61 74 61 22 3a 22 79 7a 61 66 4a 43 76 52 32 73 57 75 65 4d 5c 2f 38 42 6c 78 46 73 7a 41 55 58 50 4e 39 6d 46 37 44 71 5a 42 74 56 31 74 42 57 50 70 6f 47 2b 71 56 39 30 46 53 54 41 4e 73 4b 66 74 7a 6f 65 52 76 74 4e 67 65 52 51 7a 77 57 39 79 2b 58 2b 39 63 65 43 68 61 75 36 32 2b 4d 61 63 57 45 68 7a 67 38 63 54 61 69 36 45 75 61 62 59 4c 35 37 57 68 31 34 79 36 30 69 39 49 47 49 6d 36 77 6d 41 4a 75 45 72 79 73 4d 77 67 76 38 5a 4b 32 38 56 47 53 53 7a 39 46 6c 34 4c 42 55 76 35 37 46 69 41 46 70 5c 2f 61 45 48 66 35 51 4e 31 54 54 47 2b 65 52 64 36 7a 4d 32 68 67 6e 51 6d 6e 61 Data Ascii: {"stream":"digital_solutions_cyber_rav_client_installs","data":"yzafJCvR2sWueM\/8BlxFszAUXPN9mF7DqZBtV1tBWPpoG+qV90FSTANsKftzoeRvtNgeRQzwW9y+X+9ceChau62+MacWEhzg8cTai6EuabYL57Wh14y60i9IGIm6wmAJuErysMwgv8ZK28VGSSz9Fl4LBUv57FiAFp\/aEHf5QN1TTG+eRd6zM2hgnQmna
2024-07-27 22:42:41 UTC	245	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 22:42:41 GMT Content-Type: application/json; charset=utf-8 Content-Length: 15 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,HEAD,PUT,POST,DELETE {"Status":"OK"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	49742	188.114.96.3	443	7584	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:42:42 UTC	208	OUT	POST /forecast HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: NSIS_Inetc (Mozilla) Host: localweatherfree.com Content-Length: 281 Connection: Keep-Alive Cache-Control: no-cache
2024-07-27 22:42:42 UTC	281	OUT	Data Raw: 6c 6f 63 61 74 69 6f 6e 3d 74 44 71 6b 49 79 54 79 62 64 31 6a 6b 30 57 30 54 63 4d 35 46 57 5a 77 6b 34 50 72 5a 66 72 6e 37 6f 66 4e 78 43 4c 6e 43 5a 79 4a 49 54 33 56 49 48 4f 6a 67 6c 77 68 7a 4e 6f 73 47 78 25 32 46 39 56 31 4f 78 6d 57 70 4c 51 4f 45 59 58 44 46 4f 4b 56 50 6f 38 30 57 31 33 37 55 57 7a 79 7a 58 5a 6f 44 25 32 46 47 57 37 67 4f 35 47 31 78 6f 74 4e 6f 6c 4a 53 69 75 73 37 68 68 5a 43 4f 25 32 42 5a 79 7a 58 36 6b 78 53 50 42 6c 48 47 64 6a 33 62 25 32 42 67 72 42 4c 25 32 42 45 68 45 6f 42 6f 47 4a 31 72 54 54 25 32 42 70 75 36 53 64 65 59 32 62 39 66 4b 6a 41 30 66 48 6e 44 25 32 46 25 32 42 4a 78 71 61 53 56 49 71 4d 6a 55 74 61 53 69 6c 74 50 6a 5a 77 55 65 4d 54 78 6f 31 57 66 4e 77 25 32 42 75 51 34 63 46 6f 32 64 6f 49 54 6c Data Ascii: location=tDqkIyTybd1jk0W0TcM5FWZwk4PrZfrn7ofNxCLnCZyJIT3VIHOjglwhzNosGx%2F9V1OxmWpLQOEYXDFOKVPo80W137UWzyzXZoD%2FGW7gO5G1xotNolJSius7hhZCO%2BZyzX6kxSPBlHGdj3b%2BgrBL%2BEhEoBoGJ1rTT%2Bpu6SdeY2b9fKjA0fHnD%2F%2BJxqaSVIqMjUtaSiltPjZwUeMTxo1WfNw%2BuQ4cFo2doITl
2024-07-27 22:42:43 UTC	584	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 22:42:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G7WFatA6zc0ywJjdDd%2Fc86UEItTRhBqEk%2Fkn4xGI5buVBNaP4GoOLiBPSo32nN3zoIp3F9ZunMBjeoYuazzaR%2FQNIhqUZsvzW0S0mzihdJYo2M7LhVuBY4swlNAbI7pbsPqxTNUI2Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8aa024eb1d9f2369-EWR alt-svc: h3=":443"; ma=86400
2024-07-27 22:42:43 UTC	70	IN	Data Raw: 34 30 0d 0a 47 69 57 79 4a 54 6d 43 67 72 63 45 4f 49 6d 36 49 76 71 6b 4e 33 57 66 41 59 31 50 72 44 71 42 74 65 70 64 6c 76 63 75 51 2f 66 36 71 57 6b 75 42 6a 61 4d 58 6b 33 52 61 61 58 31 73 67 32 6e 0d 0a Data Ascii: 40GiWyJTmCgrcEOIm6IvqkN3WfAY1PrDqBtepdlvcuQ/f6qWkuBjaMXk3RaaX1sg2n
2024-07-27 22:42:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	49747	35.162.225.150	443	7404	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:42:46 UTC	232	OUT	PUT /mosaic/2.0/product-web/am/v1/record HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: SA X-Api-Key: wtuQtD4DdA8poRbq0pzMh1iysE9YiVlC14kJF9ZI Content-Length: 507 Host: analytics.apis.mcafee.com
2024-07-27 22:42:46 UTC	507	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 7b 22 41 66 66 69 64 22 3a 22 39 31 30 38 38 22 2c 22 43 6f 75 6e 74 72 79 5f 43 6f 64 65 22 3a 22 55 53 22 2c 22 44 69 73 74 72 69 62 75 74 69 6f 6e 5f 53 75 62 49 44 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 49 6e 73 74 61 6c 6c 5f 49 44 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 49 6e 73 74 61 6c 6c 5f 4c 6f 75 64 6e 65 73 73 22 3a 22 53 69 6c 65 6e 74 22 2c 22 49 6e 73 74 61 6c 6c 5f 53 6f 75 72 63 65 22 3a 22 50 61 69 64 44 69 73 74 72 69 62 75 74 69 6f 6e 22 2c 22 49 72 6f 6e 73 6f 75 72 63 65 5f 50 69 78 65 6c 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 4d 61 63 68 69 6e 65 5f 49 44 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 4f 53 22 3a Data Ascii: {"Data":{"Affid":"91088","Country_Code":"US","Distribution_SubID":"UNDEFINED","Install_ID":"UNDEFINED","Install_Loudness":"Silent","Install_Source":"PaidDistribution","Ironsource_Pixel":"UNDEFINED","Machine_ID":"9e146be9-c76a-4720-bcdb-53011b87bd06","OS":
2024-07-27 22:42:46 UTC	303	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 22:42:46 GMT Content-Type: application/x-amz-json-1.1 Content-Length: 16 Connection: close x-amz-id-2: d57QjyzstefIHSFuo22PMHM/ZApWpKjXrD5W7dgjNNcmnIF1g3KDHPE9kL5Alw1Lpbm2RZweqE42ctLJslvubgN3R+tAV9jl x-amzn-RequestId: e09a7d9e-0e62-c1b8-bf85-07b8e3089674
2024-07-27 22:42:46 UTC	16	IN	Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 22 6f 6b 22 7d Data Ascii: {"message":"ok"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	49748	188.114.96.3	443	7584	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:42:47 UTC	208	OUT	POST /forecast HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: NSIS_Inetc (Mozilla) Host: localweatherfree.com Content-Length: 281 Connection: Keep-Alive Cache-Control: no-cache
2024-07-27 22:42:47 UTC	281	OUT	Data Raw: 6c 6f 63 61 74 69 6f 6e 3d 35 4f 68 56 6b 79 25 32 42 34 56 30 58 50 6b 4a 36 72 6a 55 75 42 30 52 34 45 4c 65 78 74 68 53 25 32 42 41 32 25 32 46 37 4a 44 6d 64 25 32 42 44 4a 73 74 46 49 63 4b 69 25 32 42 77 78 36 30 41 45 25 32 42 56 65 37 31 4d 50 38 6a 72 65 72 46 53 4f 6d 76 78 79 53 63 67 4f 35 6e 75 61 72 47 6f 6e 39 39 76 68 5a 46 57 4d 63 69 31 79 25 32 42 4d 6d 74 44 71 37 53 56 71 4c 43 45 51 42 45 63 42 70 52 54 4a 68 6f 77 63 48 4f 6e 4e 38 25 32 42 55 6e 54 68 5a 6e 31 41 64 35 34 69 7a 32 30 4a 73 64 67 70 7a 4b 36 6f 50 33 41 50 55 36 47 34 32 45 39 66 64 69 46 66 79 4d 56 42 77 79 47 6e 54 36 51 50 4b 4a 4d 6e 6e 64 53 41 34 79 53 49 56 4d 25 32 46 37 53 66 50 42 32 31 33 6c 6f 51 62 6f 7a 39 66 68 6e 6f 54 4e 45 78 64 67 74 30 39 6e 65 Data Ascii: location=5OhVky%2B4V0XPkJ6rjUuB0R4ELexthS%2BA2%2F7JDmd%2BDJstFIcKi%2Bwx60AE%2BVe71MP8jrerFSOmvxyScgO5nuarGon99vhZFWMci1y%2BMmtDq7SVqLCEQBEcBpRTJhowcHOnN8%2BUnThZn1Ad54iz20JsdgpzK6oP3APU6G42E9fdiFfyMVBwyGnT6QPKJMnndSA4ySIVM%2F7SfPB213loQboz9fhnoTNExdgt09ne
2024-07-27 22:42:47 UTC	592	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 22:42:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wD6%2FRY4718sRI%2Fc9sQ3Ij6yq4nsXIfIruTcJWb4EMgFsFcOAy0%2FgdIl4d%2FnhCOQlasoY%2F%2BkWISmUfSQHBZ0bbVqGj4wqaB2c9zFcKZnWT0K15QAn795d%2F5zabKh59BS09Z4k4ayc4w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8aa025073dc2423d-EWR alt-svc: h3=":443"; ma=86400
2024-07-27 22:42:47 UTC	70	IN	Data Raw: 34 30 0d 0a 56 68 4a 43 35 58 37 2f 69 69 71 63 67 6c 73 4b 67 64 63 78 41 69 72 2f 73 33 72 63 63 35 6c 4a 79 6e 69 2f 49 45 69 66 30 4f 6a 6c 62 5a 39 34 30 64 30 65 31 2f 4c 50 50 48 4e 6a 30 73 34 69 0d 0a Data Ascii: 40VhJC5X7/iiqcglsKgdcxAir/s3rcc5lJyni/IEif0OjlbZ940d0e1/LPPHNj0s4i
2024-07-27 22:42:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.8	49750	18.173.206.112	443	7824	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:42:53 UTC	326	OUT	POST /zbd HTTP/1.1 Connection: Keep-Alive Content-Type: application/json; Charset=UTF-8 Accept: / Authorization: Signature=e09076fb7be72413458f55a70553fc9fe7a788e10f08e18ca857b7883846325f User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Content-Length: 298 Host: d3cored83b0wp2.cloudfront.net
2024-07-27 22:42:53 UTC	298	OUT	Data Raw: 7b 22 74 61 62 6c 65 22 3a 22 7a 62 5f 61 6e 61 6c 79 74 69 63 73 22 2c 22 64 61 74 61 22 3a 22 7b 5c 22 30 5c 22 3a 5c 22 5c 22 2c 5c 22 31 5c 22 3a 5c 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 5c 22 2c 5c 22 32 5c 22 3a 5c 22 32 30 32 34 30 37 32 37 31 38 34 31 35 34 5c 22 2c 5c 22 33 5c 22 3a 5c 22 63 68 65 61 74 65 6e 67 69 6e 65 5c 22 2c 5c 22 34 5c 22 3a 5c 22 63 68 65 61 74 65 6e 67 69 6e 65 5c 22 2c 5c 22 35 5c 22 3a 5c 22 43 68 65 61 74 45 6e 67 69 6e 65 5c 22 2c 5c 22 31 38 5c 22 3a 5c 22 5c 22 2c 5c 22 31 39 5c 22 3a 5c 22 5c 22 2c 5c 22 32 31 5c 22 3a 5c 22 31 33 33 5c 22 2c 5c 22 36 5c 22 3a 5c 22 33 5c 22 2c 5c 22 37 5c 22 3a 5c 22 31 2e 33 34 2e 33 2e 38 33 34 31 5c 22 2c Data Ascii: {"table":"zb_analytics","data":"{\"0\":\"\",\"1\":\"9e146be9-c76a-4720-bcdb-53011b87bd06\",\"2\":\"20240727184154\",\"3\":\"cheatengine\",\"4\":\"cheatengine\",\"5\":\"CheatEngine\",\"18\":\"\",\"19\":\"\",\"21\":\"133\",\"6\":\"3\",\"7\":\"1.34.3.8341\",
2024-07-27 22:42:54 UTC	428	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Content-Length: 15 Connection: close Date: Sat, 27 Jul 2024 22:42:54 GMT Access-Control-Allow-Methods: GET,HEAD,PUT,POST,DELETE Access-Control-Allow-Origin: * X-Cache: Miss from cloudfront Via: 1.1 b4c8f37704271e217979234a38712c42.cloudfront.net (CloudFront) X-Amz-Cf-Pop: FRA56-P12 X-Amz-Cf-Id: BZF6lRe7lnlA-ahNtOzwvrwd5j51bKtP6xCoku50RyfxpRWSM1WpqA==
2024-07-27 22:42:54 UTC	15	IN	Data Raw: 7b 22 53 74 61 74 75 73 22 3a 22 4f 4b 22 7d Data Ascii: {"Status":"OK"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.8	49761	104.20.94.94	443	4256	C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:43:11 UTC	106	OUT	GET /cesharelist.txt HTTP/1.1 User-Agent: Cheat Engine 7.5 : luascript-ceshare Host: cheatengine.org
2024-07-27 22:43:11 UTC	286	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 22:43:11 GMT Content-Type: text/plain Content-Length: 310 Connection: close Accept-Ranges: bytes ETag: "3727957928" Last-Modified: Mon, 04 Jul 2022 23:46:20 GMT CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8aa0259f18417cea-EWR
2024-07-27 22:43:11 UTC	310	IN	Data Raw: 23 69 66 20 79 6f 75 20 77 69 73 68 20 74 6f 20 61 64 64 20 79 6f 75 72 20 73 65 72 76 65 72 20 68 65 72 65 20 74 68 65 6e 20 6d 61 69 6c 20 64 61 72 6b 5f 62 79 74 65 40 68 6f 74 6d 61 69 6c 2e 63 6f 6d 20 6f 72 20 70 6d 20 6d 65 20 61 74 20 66 6f 72 75 6d 2e 63 68 65 61 74 65 6e 67 69 6e 65 2e 6f 72 67 20 2c 20 6f 72 20 6d 65 73 73 61 67 65 20 6d 65 20 6f 6e 20 64 69 73 63 6f 72 64 28 44 42 23 32 37 38 30 29 20 0a 68 74 74 70 73 3a 2f 2f 66 65 61 72 6c 65 73 73 72 65 76 6f 6c 75 74 69 6f 6e 2e 63 6f 6d 2f 63 65 73 68 61 72 65 2f 20 23 2d 23 20 46 65 61 72 6c 65 73 73 20 72 65 76 6f 6c 75 74 69 6f 6e 20 28 66 65 61 72 6c 65 73 73 72 65 76 6f 6c 75 74 69 6f 6e 2e 63 6f 6d 29 0a 23 68 74 74 70 73 3a 2f 2f 6c 6f 63 61 6c 68 6f 73 74 2f 63 65 73 68 61 72 65 Data Ascii: #if you wish to add your server here then mail dark_byte@hotmail.com or pm me at forum.cheatengine.org , or message me on discord(DB#2780) https://fearlessrevolution.com/ceshare/ #-# Fearless revolution (fearlessrevolution.com)#https://localhost/ceshare

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.8	49763	104.20.94.94	443	4256	C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:43:12 UTC	115	OUT	GET /latestversion.txt HTTP/1.1 User-Agent: Cheat Engine 7.5 : luascript-CEVersionCheck Host: cheatengine.org
2024-07-27 22:43:12 UTC	284	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 22:43:12 GMT Content-Type: text/plain Content-Length: 25 Connection: close Accept-Ranges: bytes ETag: "865367632" Last-Modified: Tue, 14 Feb 2023 10:07:05 GMT CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8aa025a4dad941a1-EWR
2024-07-27 22:43:12 UTC	25	IN	Data Raw: 31 39 37 30 33 34 36 33 31 31 38 31 38 35 30 33 0a 37 2e 35 0a 37 2e 35 0a Data Ascii: 19703463118185037.57.5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.8	49773	35.162.225.150	443	7404	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:43:42 UTC	232	OUT	PUT /mosaic/2.0/product-web/am/v1/record HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: SA X-Api-Key: wtuQtD4DdA8poRbq0pzMh1iysE9YiVlC14kJF9ZI Content-Length: 501 Host: analytics.apis.mcafee.com
2024-07-27 22:43:42 UTC	501	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 7b 22 41 66 66 69 64 22 3a 22 39 31 30 38 38 22 2c 22 43 6f 75 6e 74 72 79 5f 43 6f 64 65 22 3a 22 55 53 22 2c 22 44 69 73 74 72 69 62 75 74 69 6f 6e 5f 53 75 62 49 44 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 49 6e 73 74 61 6c 6c 5f 49 44 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 49 6e 73 74 61 6c 6c 5f 4c 6f 75 64 6e 65 73 73 22 3a 22 53 69 6c 65 6e 74 22 2c 22 49 6e 73 74 61 6c 6c 5f 53 6f 75 72 63 65 22 3a 22 50 61 69 64 44 69 73 74 72 69 62 75 74 69 6f 6e 22 2c 22 49 72 6f 6e 73 6f 75 72 63 65 5f 50 69 78 65 6c 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 4d 61 63 68 69 6e 65 5f 49 44 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 4f 53 22 3a Data Ascii: {"Data":{"Affid":"91088","Country_Code":"US","Distribution_SubID":"UNDEFINED","Install_ID":"UNDEFINED","Install_Loudness":"Silent","Install_Source":"PaidDistribution","Ironsource_Pixel":"UNDEFINED","Machine_ID":"9e146be9-c76a-4720-bcdb-53011b87bd06","OS":
2024-07-27 22:43:42 UTC	303	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 22:43:42 GMT Content-Type: application/x-amz-json-1.1 Content-Length: 16 Connection: close x-amz-id-2: XXzjXVTao052G4M0lZYXhb+ePVCQNh9vNT2x8tfMHTJmaCm+yuVDPAJ0eRb5dYhKroeoSwu5VNpVXy9TL+lPlGgH14Lmbipw x-amzn-RequestId: ebb9c2b3-98ec-ef61-b4a6-b8ede7fdf31d
2024-07-27 22:43:42 UTC	16	IN	Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 22 6f 6b 22 7d Data Ascii: {"message":"ok"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.8	49775	35.162.225.150	443	7404	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:43:44 UTC	232	OUT	PUT /mosaic/2.0/product-web/am/v1/record HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: SA X-Api-Key: wtuQtD4DdA8poRbq0pzMh1iysE9YiVlC14kJF9ZI Content-Length: 595 Host: analytics.apis.mcafee.com
2024-07-27 22:43:44 UTC	595	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 7b 22 41 66 66 69 64 22 3a 22 39 31 30 38 38 22 2c 22 43 6f 75 6e 74 72 79 5f 43 6f 64 65 22 3a 22 55 53 22 2c 22 44 69 73 74 72 69 62 75 74 69 6f 6e 5f 53 75 62 49 44 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 49 6e 73 74 61 6c 6c 5f 49 44 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 49 6e 73 74 61 6c 6c 5f 4c 6f 75 64 6e 65 73 73 22 3a 22 53 69 6c 65 6e 74 22 2c 22 49 6e 73 74 61 6c 6c 5f 53 6f 75 72 63 65 22 3a 22 50 61 69 64 44 69 73 74 72 69 62 75 74 69 6f 6e 22 2c 22 49 72 6f 6e 73 6f 75 72 63 65 5f 50 69 78 65 6c 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 4d 61 63 68 69 6e 65 5f 49 44 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 4f 53 22 3a Data Ascii: {"Data":{"Affid":"91088","Country_Code":"US","Distribution_SubID":"UNDEFINED","Install_ID":"UNDEFINED","Install_Loudness":"Silent","Install_Source":"PaidDistribution","Ironsource_Pixel":"UNDEFINED","Machine_ID":"9e146be9-c76a-4720-bcdb-53011b87bd06","OS":
2024-07-27 22:43:44 UTC	303	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 22:43:44 GMT Content-Type: application/x-amz-json-1.1 Content-Length: 16 Connection: close x-amzn-RequestId: edaf2252-9f4b-1bf1-b2b0-5832680f8f60 x-amz-id-2: qWRjjawvkkcKFW5v/GUQUgu4ItqgNMIxGojOlYLTX6x6cMndnFVxnTyRKNdZiQC3NeGwfMFPNyaZ//wmdB5dFSr1PFLmcaVy
2024-07-27 22:43:44 UTC	16	IN	Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 22 6f 6b 22 7d Data Ascii: {"message":"ok"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.8	49776	35.162.225.150	443	7404	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:43:45 UTC	232	OUT	PUT /mosaic/2.0/product-web/am/v1/record HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: SA X-Api-Key: wtuQtD4DdA8poRbq0pzMh1iysE9YiVlC14kJF9ZI Content-Length: 505 Host: analytics.apis.mcafee.com
2024-07-27 22:43:45 UTC	505	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 7b 22 41 66 66 69 64 22 3a 22 39 31 30 38 38 22 2c 22 43 6f 75 6e 74 72 79 5f 43 6f 64 65 22 3a 22 55 53 22 2c 22 44 69 73 74 72 69 62 75 74 69 6f 6e 5f 53 75 62 49 44 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 49 6e 73 74 61 6c 6c 5f 49 44 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 49 6e 73 74 61 6c 6c 5f 4c 6f 75 64 6e 65 73 73 22 3a 22 53 69 6c 65 6e 74 22 2c 22 49 6e 73 74 61 6c 6c 5f 53 6f 75 72 63 65 22 3a 22 50 61 69 64 44 69 73 74 72 69 62 75 74 69 6f 6e 22 2c 22 49 72 6f 6e 73 6f 75 72 63 65 5f 50 69 78 65 6c 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 4d 61 63 68 69 6e 65 5f 49 44 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 4f 53 22 3a Data Ascii: {"Data":{"Affid":"91088","Country_Code":"US","Distribution_SubID":"UNDEFINED","Install_ID":"UNDEFINED","Install_Loudness":"Silent","Install_Source":"PaidDistribution","Ironsource_Pixel":"UNDEFINED","Machine_ID":"9e146be9-c76a-4720-bcdb-53011b87bd06","OS":
2024-07-27 22:43:45 UTC	303	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 22:43:45 GMT Content-Type: application/x-amz-json-1.1 Content-Length: 16 Connection: close x-amz-id-2: ARztuq8FaENtCJZeJW9EX7cesq7wf26hboa1up8t8HUPSwIKZHUd7O7KZR+K+eceOWbnoorIdPWwbIdNptdfMta27P+AHPtF x-amzn-RequestId: c16dff39-45d6-0bb2-9e72-8558972f64e6
2024-07-27 22:43:45 UTC	16	IN	Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 22 6f 6b 22 7d Data Ascii: {"message":"ok"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.8	49777	35.162.225.150	443	7404	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-27 22:43:46 UTC	232	OUT	PUT /mosaic/2.0/product-web/am/v1/record HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: SA X-Api-Key: wtuQtD4DdA8poRbq0pzMh1iysE9YiVlC14kJF9ZI Content-Length: 507 Host: analytics.apis.mcafee.com
2024-07-27 22:43:46 UTC	507	OUT	Data Raw: 7b 22 44 61 74 61 22 3a 7b 22 41 66 66 69 64 22 3a 22 39 31 30 38 38 22 2c 22 43 6f 75 6e 74 72 79 5f 43 6f 64 65 22 3a 22 55 53 22 2c 22 44 69 73 74 72 69 62 75 74 69 6f 6e 5f 53 75 62 49 44 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 49 6e 73 74 61 6c 6c 5f 49 44 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 49 6e 73 74 61 6c 6c 5f 4c 6f 75 64 6e 65 73 73 22 3a 22 53 69 6c 65 6e 74 22 2c 22 49 6e 73 74 61 6c 6c 5f 53 6f 75 72 63 65 22 3a 22 50 61 69 64 44 69 73 74 72 69 62 75 74 69 6f 6e 22 2c 22 49 72 6f 6e 73 6f 75 72 63 65 5f 50 69 78 65 6c 22 3a 22 55 4e 44 45 46 49 4e 45 44 22 2c 22 4d 61 63 68 69 6e 65 5f 49 44 22 3a 22 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 22 2c 22 4f 53 22 3a Data Ascii: {"Data":{"Affid":"91088","Country_Code":"US","Distribution_SubID":"UNDEFINED","Install_ID":"UNDEFINED","Install_Loudness":"Silent","Install_Source":"PaidDistribution","Ironsource_Pixel":"UNDEFINED","Machine_ID":"9e146be9-c76a-4720-bcdb-53011b87bd06","OS":
2024-07-27 22:43:46 UTC	303	IN	HTTP/1.1 200 OK Date: Sat, 27 Jul 2024 22:43:46 GMT Content-Type: application/x-amz-json-1.1 Content-Length: 16 Connection: close x-amzn-RequestId: faf36be5-1daf-718e-a5ec-11874ca074b7 x-amz-id-2: Fl+o8e4D92Cp5AUJUiQDJxXxHoljG/Z9mumi7MlU2tEOKfJCI2iXL2JWhCi8FaqkuRzkiLUc26pFZ+y1jBfe8aCwv3RSSpJi
2024-07-27 22:43:46 UTC	16	IN	Data Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 22 6f 6b 22 7d Data Ascii: {"message":"ok"}

Target ID:	0
Start time:	18:41:47
Start date:	27/07/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe"
Imagebase:	0x400000
File size:	29'977'368 bytes
MD5 hash:	28A85BA5396FCFA8A5F794F04DCE35E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	18:41:48
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-QGAR3.tmp\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.tmp" /SL5="$20462,29086952,780800,C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe"
Imagebase:	0x400000
File size:	3'014'144 bytes
MD5 hash:	C47A946F3D41363C77CA4C719516E49B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	18:42:28
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod0.exe" -ip:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240727184154&is_silent=true&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100&b=&se=true" -vp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240727184154&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100&oip=26&ptl=7&dta=true" -dp:"dui=9e146be9-c76a-4720-bcdb-53011b87bd06&dit=20240727184154&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100" -i -v -d -se=true
Imagebase:	0x2a3cf930000
File size:	33'432 bytes
MD5 hash:	36D1B7C42C37FF8217B07851D0C4C39A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	18:42:32
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe" /affid 91088 PaidDistribution=true CountryCode=US
Imagebase:	0xec0000
File size:	1'184'128 bytes
MD5 hash:	143255618462A577DE27286A272584E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	18:42:33
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\3yq4abxg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\3yq4abxg.exe" /silent
Imagebase:	0x400000
File size:	2'366'456 bytes
MD5 hash:	70FD2613E8171383FCB917E2F22B71A2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000006.00000003.1872499187.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	18:42:34
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod2_extract\WZSetup.exe" /S /tpchannelid=1571 /distid=App123
Imagebase:	0x400000
File size:	6'261'520 bytes
MD5 hash:	3C17F28CC001F6652377D3B5DEEC10F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	18:42:35
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\7zS4C6B60DE\UnifiedStub-installer.exe
Wow64 process (32bit):	false
Commandline:	.\UnifiedStub-installer.exe /silent
Imagebase:	0x19b322f0000
File size:	1'120'648 bytes
MD5 hash:	C7FE1EB6A82B9FFAAF8DCA0D86DEF7CA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000B.00000002.3319865235.0000019B4C9D2000.00000002.00000001.01000000.00000031.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000B.00000002.3282773301.0000019B32872000.00000002.00000001.01000000.00000030.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	18:42:35
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\is-H908U.tmp\CheatEngine75.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-H908U.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST
Imagebase:	0x400000
File size:	27'406'384 bytes
MD5 hash:	E0F666FE4FF537FB8587CCD215E41E5F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	18:42:36
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-70Q5G.tmp\CheatEngine75.tmp" /SL5="$901D6,26511452,832512,C:\Users\user\AppData\Local\Temp\is-H908U.tmp\CheatEngine75.exe" /VERYSILENT /ZBDIST
Imagebase:	0x400000
File size:	3'223'968 bytes
MD5 hash:	9AA2ACD4C96F8BA03BB6C3EA806D806F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	18:42:37
Start date:	27/07/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	"net" stop BadlionAntic
Imagebase:	0x7ff64f950000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	18:42:38
Start date:	27/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	18:42:38
Start date:	27/07/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 stop BadlionAntic
Imagebase:	0x7ff74c4a0000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	18:42:38
Start date:	27/07/2024
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	"net" stop BadlionAnticheat
Imagebase:	0x7ff64f950000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	18:42:38
Start date:	27/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	18:42:38
Start date:	27/07/2024
Path:	C:\Windows\System32\net1.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\net1 stop BadlionAnticheat
Imagebase:	0x7ff74c4a0000
File size:	183'808 bytes
MD5 hash:	55693DF2BB3CBE2899DFDDF18B4EB8C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	18:42:39
Start date:	27/07/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	"sc" delete BadlionAntic
Imagebase:	0x7ff66b570000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	18:42:39
Start date:	27/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	18:42:39
Start date:	27/07/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	"sc" delete BadlionAnticheat
Imagebase:	0x7ff66b570000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	18:42:39
Start date:	27/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	18:42:39
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\is-UC9I1.tmp\_isetup\_setup64.tmp
Wow64 process (32bit):	false
Commandline:	helper 105 0x44C
Imagebase:	0x140000000
File size:	6'144 bytes
MD5 hash:	E4211D6D009757C078A9FAC7FF4F03D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	18:42:39
Start date:	27/07/2024
Path:	C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:10
Imagebase:	0x7ff7824d0000
File size:	814'440 bytes
MD5 hash:	CC7167823D2D6D25E121FC437AE6A596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	18:42:39
Start date:	27/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	18:42:39
Start date:	27/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	18:42:39
Start date:	27/07/2024
Path:	C:\Windows\System32\icacls.exe
Wow64 process (32bit):	false
Commandline:	"icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)
Imagebase:	0x7ff71d280000
File size:	39'424 bytes
MD5 hash:	48C87E3B3003A2413D6399EA77707F5D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	18:42:39
Start date:	27/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	18:42:39
Start date:	27/07/2024
Path:	C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -bn:ReasonLabs -dt:10
Imagebase:	0x7ff7824d0000
File size:	814'440 bytes
MD5 hash:	CC7167823D2D6D25E121FC437AE6A596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	18:42:40
Start date:	27/07/2024
Path:	C:\Program Files\ReasonLabs\EPP\Uninstall.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\ReasonLabs\EPP\Uninstall.exe" /auto-repair=UnifiedStub
Imagebase:	0x7ff62d7c0000
File size:	332'568 bytes
MD5 hash:	8157D03D4CD74D7DF9F49555A04F4272
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	18:42:41
Start date:	27/07/2024
Path:	C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\ReasonLabs\Common\Stub\v6.0.1\Stub.exe" /products=epp /auto-repair=UnifiedStub
Imagebase:	0x400000
File size:	2'366'456 bytes
MD5 hash:	70FD2613E8171383FCB917E2F22B71A2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000020.00000003.2057681827.0000000002E30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	18:42:42
Start date:	27/07/2024
Path:	C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe" install
Imagebase:	0x1000000
File size:	3'385'616 bytes
MD5 hash:	2B149BA4C21C66D34F19214D5A8D3067
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	18:42:42
Start date:	27/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	18:42:43
Start date:	27/07/2024
Path:	C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe" start silent
Imagebase:	0x7ff666d40000
File size:	3'385'616 bytes
MD5 hash:	2B149BA4C21C66D34F19214D5A8D3067
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	18:42:43
Start date:	27/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	18:42:44
Start date:	27/07/2024
Path:	C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe"
Imagebase:	0x1000000
File size:	3'385'616 bytes
MD5 hash:	2B149BA4C21C66D34F19214D5A8D3067
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	18:42:46
Start date:	27/07/2024
Path:	C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Cheat Engine 7.5\Kernelmoduleunloader.exe" /SETUP
Imagebase:	0x400000
File size:	242'616 bytes
MD5 hash:	9AF96706762298CF72DF2A74213494C9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	18:42:48
Start date:	27/07/2024
Path:	C:\Program Files\Cheat Engine 7.5\windowsrepair.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Cheat Engine 7.5\windowsrepair.exe" /s
Imagebase:	0x400000
File size:	268'704 bytes
MD5 hash:	9A4D1B5154194EA0C42EFEBEB73F318F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	18:42:49
Start date:	27/07/2024
Path:	C:\Windows\System32\icacls.exe
Wow64 process (32bit):	false
Commandline:	"icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)
Imagebase:	0x7ff71d280000
File size:	39'424 bytes
MD5 hash:	48C87E3B3003A2413D6399EA77707F5D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	18:42:49
Start date:	27/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	18:42:53
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\7zS87E99B6F\UnifiedStub-installer.exe
Wow64 process (32bit):	false
Commandline:	.\UnifiedStub-installer.exe /products=epp /auto-repair=UnifiedStub
Imagebase:	0x1fa14fd0000
File size:	1'120'648 bytes
MD5 hash:	C7FE1EB6A82B9FFAAF8DCA0D86DEF7CA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000002D.00000002.2185072195.000001FA16D82000.00000002.00000001.01000000.0000002A.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000002D.00000002.2186104264.000001FA16E9D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	18:42:56
Start date:	27/07/2024
Path:	C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe"
Imagebase:	0x400000
File size:	399'264 bytes
MD5 hash:	F921416197C2AE407D53BA5712C3930A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	18:42:56
Start date:	27/07/2024
Path:	C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Cheat Engine 7.5\cheatengine-x86_64-SSE4-AVX2.exe"
Imagebase:	0x400000
File size:	16'708'024 bytes
MD5 hash:	910DE25BD63B5DA521FC0B598920C4EC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	18:43:00
Start date:	27/07/2024
Path:	C:\Users\user\AppData\Local\Temp\Stub.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Stub.exe" /products=epp /auto-repair=UnifiedStub
Imagebase:	0x400000
File size:	2'366'456 bytes
MD5 hash:	70FD2613E8171383FCB917E2F22B71A2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000031.00000003.2235185447.0000000002E40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFB4B2BA610 Relevance: 9.7, Strings: 6, Instructions: 2224COMMON

Download Yara Rule

Strings

uO_H, xrefs: 00007FFB4B2BAF74
|Z_L, xrefs: 00007FFB4B2BA7D3
rd=K, xrefs: 00007FFB4B2BB790
tZ_L, xrefs: 00007FFB4B2BAFCF
zO_H, xrefs: 00007FFB4B2BAA72
{Z_H, xrefs: 00007FFB4B2BA8D4

Memory Dump Source

Source File: 00000004.00000002.3294188990.00007FFB4B2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b2b0000_prod0.jbxd

Similarity

API ID:
String ID: rd=K$tZ_L$uO_H$zO_H${Z_H$|Z_L
API String ID: 0-399783094
Opcode ID: f9a427b76b652108d06a59307929d53dd74c8a43b87b5cef25aa6f264d0a43b1
Instruction ID: ffe50572489ae1e47e47869f930a482b124c21f50f9a3d3ce96b9ae0b01db89a
Opcode Fuzzy Hash: f9a427b76b652108d06a59307929d53dd74c8a43b87b5cef25aa6f264d0a43b1
Instruction Fuzzy Hash: F5D2F8D2E1CD0A5FE6A8BE7CD59A3783BC1EB99250F4441BED94EC31A3EC186C474291

Function 00007FFB4B2BD4D1 Relevance: 1.0, Instructions: 962COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3294188990.00007FFB4B2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b2b0000_prod0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 901c0db811450fb357e321434201d4f9183896e9813b3553f049efd095fe70b4
Instruction ID: 116e5866caad2ba40c0c2638225950b3989d1fda076d5bd02a2c1fe827f0c1e8
Opcode Fuzzy Hash: 901c0db811450fb357e321434201d4f9183896e9813b3553f049efd095fe70b4
Instruction Fuzzy Hash: 0C62B4B1A18A4D8FE794EF7CD8567A97BF1FB99340F1081BAD00DD7292DE3458868B40

Function 00007FFB4B2BD7A9 Relevance: .7, Instructions: 664COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3294188990.00007FFB4B2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b2b0000_prod0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a35f49fdf2b4b50c2bfa25645cc6a6473401ce9337750a548d6b68694df80b81
Instruction ID: 3da6fd7f069b7426b9c93ac53e167929a1294b8b89eb272d90018207feb0b72f
Opcode Fuzzy Hash: a35f49fdf2b4b50c2bfa25645cc6a6473401ce9337750a548d6b68694df80b81
Instruction Fuzzy Hash: FE3251B1A18A4D8FDB94EF6CD8567A9BBF1FB99304F1081BAD00DD7252DE345886CB40

Function 00007FFB4B2B94ED Relevance: .6, Instructions: 610COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3294188990.00007FFB4B2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b2b0000_prod0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43794cd20c51c66d3438a0536d4bfe0da8a98425fce5c719565dbf296114609f
Instruction ID: 4fc8816757e9d361bba32399bc989c0ada9565c93d8a9c5054ff078ca8da6920
Opcode Fuzzy Hash: 43794cd20c51c66d3438a0536d4bfe0da8a98425fce5c719565dbf296114609f
Instruction Fuzzy Hash: 5D2291B091CA594BEBA8FF28C8557A47BE0FF68300F14817DD94DC72A2DE34A9468781

Function 00007FFB4B2B0E40 Relevance: .6, Instructions: 598COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3294188990.00007FFB4B2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b2b0000_prod0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f03b0fa0007a87add45d8545f9d2eaf48add8588cabe042460a65157b0955f29
Instruction ID: 3b9e6625c5c2d5fb0eb0c290cc047dc5dba4a2dc488dbefa3145ba023ed343df
Opcode Fuzzy Hash: f03b0fa0007a87add45d8545f9d2eaf48add8588cabe042460a65157b0955f29
Instruction Fuzzy Hash: CA02F7D790D1728AE326BEBCF4455FB6B58DF81374B0881B7D58E8A0D3CD18289782E5

Function 00007FFB4B2B6DA4 Relevance: 1.6, APIs: 1, Instructions: 116
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32 ref: 00007FFB4B2B6E4E

Memory Dump Source

Source File: 00000004.00000002.3294188990.00007FFB4B2B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B2B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffb4b2b0000_prod0.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d582e8552c1dff53de632bd89bf97a9fd9b18901d9a5f1930f25e59a020b975d
Instruction ID: b7d2cbf07516e00281c95064ef76fae963cfd521760c58a9de76f29476b31827
Opcode Fuzzy Hash: d582e8552c1dff53de632bd89bf97a9fd9b18901d9a5f1930f25e59a020b975d
Instruction Fuzzy Hash: 5E31C17190CA5D8FDB19EF68C849AE9BBE0EB55320F04826ED049C3291CB74A8068B91

Analysis Process: saBSI.exePID: 7404, Parent PID: 7824COMMON

Execution Graph

Execution Coverage:	6.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	51

Executed Functions

Function 00EF5318 Relevance: 69.2, APIs: 12, Strings: 27, Instructions: 928
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F488FA: EnterCriticalSection.KERNEL32(00FC742C,?,?,?,00EE402B,00FC827C,87CF6CF3,?,00EE1171,?), ref: 00F48905
Part of subcall function 00F488FA: LeaveCriticalSection.KERNEL32(00FC742C,?,?,?,00EE402B,00FC827C,87CF6CF3,?,00EE1171,?), ref: 00F48942

Part of subcall function 00EF4A40: _com_issue_error.COMSUPP ref: 00EF4AD2
Part of subcall function 00EF4A40: SysFreeString.OLEAUT32(-00000001), ref: 00EF4AFD

Part of subcall function 00EF61F0: Concurrency::cancel_current_task.LIBCPMT ref: 00EF62BF

Part of subcall function 00F488B0: EnterCriticalSection.KERNEL32(00FC742C,?,?,00EE4086,00FC827C,00F868E0,?), ref: 00F488BA
Part of subcall function 00F488B0: LeaveCriticalSection.KERNEL32(00FC742C,?,?,00EE4086,00FC827C,00F868E0,?), ref: 00F488ED
Part of subcall function 00F488B0: RtlWakeAllConditionVariable.NTDLL ref: 00F48964

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,87CF6CF3,?,?), ref: 00EF57B4
FindResourceW.KERNEL32(00000000,00000001,00000010), ref: 00EF57C5
LoadResource.KERNEL32(00000000,00000000), ref: 00EF57D1
LockResource.KERNEL32(00000000), ref: 00EF57DC
Concurrency::cancel_current_task.LIBCPMT ref: 00EF6067
Concurrency::cancel_current_task.LIBCPMT ref: 00EF6085
SysFreeString.OLEAUT32 ref: 00EF610F
SysFreeString.OLEAUT32(00000000), ref: 00EF615A

Strings

orm, xrefs: 00EF5FDD
t, xrefs: 00EF5C0B
IsWow64Process, xrefs: 00EF5F95
select PredictFailure from MSStorageDriver_FailurePredictStatus, xrefs: 00EF564E
kernel32.dll, xrefs: 00EF57A8
Time, xrefs: 00EF537F
EstimatedRunTime, xrefs: 00EF53BA
PCSystemTypeEx, xrefs: 00EF5499
), xrefs: 00EF6016
PowerState, xrefs: 00EF5578
ery), xrefs: 00EF5407
NO_REGKEY, xrefs: 00EF5CDE
4.1.1.865, xrefs: 00EF597A
(error), xrefs: 00EF54DE, 00EF55BD
kState, xrefs: 00EF560D
select EstimatedRunTime from Win32_Battery, xrefs: 00EF53A7
PredictFailure, xrefs: 00EF5661
kernel32, xrefs: 00EF5F82
Root\CIMV2, xrefs: 00EF5391, 00EF5473, 00EF5552
select PowerState from Win32_ComputerSystem, xrefs: 00EF5565
select PCSystemTypeEx from Win32_ComputerSystem, xrefs: 00EF5486
UUID, xrefs: 00EF5D88, 00EF5C84
0.0.0.0, xrefs: 00EF5816
root\wmi, xrefs: 00EF563B
Failed to convert wuuid to string, xrefs: 00EF5C17
UUID, xrefs: 00EF5AC8
Version, xrefs: 00EF5911

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: CriticalSection$Concurrency::cancel_current_taskFreeResourceString$EnterLeave$ConditionFindHandleLoadLockModuleVariableWake_com_issue_error
String ID: (error)$)$0.0.0.0$4.1.1.865$EstimatedRunTime$Failed to convert wuuid to string$IsWow64Process$NO_REGKEY$PCSystemTypeEx$PowerState$PredictFailure$Root\CIMV2$Time$UUID$UUID$Version$ery)$kState$kernel32$kernel32.dll$orm$root\wmi$select EstimatedRunTime from Win32_Battery$select PCSystemTypeEx from Win32_ComputerSystem$select PowerState from Win32_ComputerSystem$select PredictFailure from MSStorageDriver_FailurePredictStatus$t
API String ID: 2830066208-329860846
Opcode ID: 56150423b7b6f4a7391b51aa61dc0c07264930ab6b9e1e4f9ff3130fa7c02661
Instruction ID: 38e2d4e2cc7b6d36b36fc0e8823da5c00023dedf53884978872ee7859d214dca
Opcode Fuzzy Hash: 56150423b7b6f4a7391b51aa61dc0c07264930ab6b9e1e4f9ff3130fa7c02661
Instruction Fuzzy Hash: 258235B090038C9BEB14DFA4CD49BADBBB1AF55304F24421CE505BB3D2DB749A85EB61

Function 00EEF110 Relevance: 68.3, APIs: 21, Strings: 17, Instructions: 1782COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEF268
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEF307
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEF37E
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEF8B0
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEFBBD

Part of subcall function 00ED9BB0: InitOnceBeginInitialize.KERNEL32(00FC80C4,00000000,87CF6CF3,00000000,87CF6CF3,00EDA219,00FC80CC,?,?,?,?,?,?,00EDA219,?,?), ref: 00ED9BE5
Part of subcall function 00ED9BB0: InitOnceComplete.KERNEL32(00FC80C4,00000000,00000000), ref: 00ED9C1D

Part of subcall function 00ED9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00ED9A12

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEFDB6
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EF00BA
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EF015F
GetLastError.KERNEL32(?,00000001,?,?,00000004), ref: 00EF05D7
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EF0614
GetLastError.KERNEL32(?,00000001,?,?,00000004), ref: 00EF086A
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EF08A7
GetLastError.KERNEL32(?,00000001,0000018F,00000000,X-Api-Key: ,0000000B,00000000,00000000,?,?,00000004), ref: 00EF0A90
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EF0ACD

Strings

AWS Adhoc Telemetry Payload = , xrefs: 00EEFB62
AdhocTelemetryAWS, xrefs: 00EEF1B6
HTTP connection failed for AWS: , xrefs: 00EF0EBA
HTTP status error for AWS: , xrefs: 00EF011E
HTTP open request failed for AWS: , xrefs: 00EF0DB8
HTTP send request failed for AWS: , xrefs: 00EF085A
AWS Response Code received , xrefs: 00EF0079
Querying AdhocTelemetryAWS value failed: , xrefs: 00EEF217
HTTP receive response failed for AWS: , xrefs: 00EF05C7
`aco, xrefs: 00EEFE78, 00EEFE8D, 00EF027E, 00EF0293, 00EF0415, 00EF042A, 00EF0733, 00EF0748, 00EF09C6, 00EF09DB, 00EF0BEC, 00EF0C01, 00EF0CFE, 00EF0D13, 00EF0E15
HTTP add request header failed for AWS x_api_key: , xrefs: 00EF0A80
Failed to convert the x_api_key string to wide, xrefs: 00EEFD8F
SOFTWARE\McAfee\WebAdvisor, xrefs: 00EEF181
0Ywx4MUvRidmWf74nsIlBPIxJYIG9Nf0lSnge8SvgvY3RVy4E6gFLp3VDBcDO830QhXvfpgCb55sRtnVqKb2zUO3Vq7ko1b, xrefs: 00EEF5B7, 00EEF656
Failed to initialize buffer for AWS, xrefs: 00EEF889
X-Api-Key: , xrefs: 00EEFF28
NO_REGVALUE, xrefs: 00EEF54F

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$ErrorLast$InitOnce$BeginCompleteInitialize
String ID: 0Ywx4MUvRidmWf74nsIlBPIxJYIG9Nf0lSnge8SvgvY3RVy4E6gFLp3VDBcDO830QhXvfpgCb55sRtnVqKb2zUO3Vq7ko1b$AWS Adhoc Telemetry Payload = $AWS Response Code received $AdhocTelemetryAWS$Failed to convert the x_api_key string to wide$Failed to initialize buffer for AWS$HTTP add request header failed for AWS x_api_key: $HTTP connection failed for AWS: $HTTP open request failed for AWS: $HTTP receive response failed for AWS: $HTTP send request failed for AWS: $HTTP status error for AWS: $NO_REGVALUE$Querying AdhocTelemetryAWS value failed: $SOFTWARE\McAfee\WebAdvisor$X-Api-Key: $`aco
API String ID: 1658547907-4203137873
Opcode ID: cde6de3c83bad86f6eb78e4f2b81e2d4f8a31d1fe8ae1f372438bed03fe602d7
Instruction ID: 16e10beb32f4a3f8e4d8ce18816107090beee2b41f05aa58dcfbe62f398ec802
Opcode Fuzzy Hash: cde6de3c83bad86f6eb78e4f2b81e2d4f8a31d1fe8ae1f372438bed03fe602d7
Instruction Fuzzy Hash: C1F29D70A002689BDB24DF24CC99BEDB7B5AF85304F1081E9E54DB7292EB759AC4CF50

Function 00F03AC0 Relevance: 66.7, APIs: 3, Strings: 34, Instructions: 1934COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 00F03CE8

Part of subcall function 00F33084: __EH_prolog3.LIBCMT ref: 00F3308B
Part of subcall function 00F33084: std::_Lockit::_Lockit.LIBCPMT ref: 00F33096
Part of subcall function 00F33084: std::locale::_Setgloballocale.LIBCPMT ref: 00F330B1
Part of subcall function 00F33084: std::_Lockit::~_Lockit.LIBCPMT ref: 00F33107

std::locale::_Init.LIBCPMT ref: 00F04934
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00F04CD5

Strings

EXIT_UPDATE, xrefs: 00F05344, 00F055FD
false, xrefs: 00F041FF
XML precondition array with tag %s returned false due to sniffer actions, xrefs: 00F042A2
XML precondition array returned true due to sniffer actions, xrefs: 00F0434F
Exit update command triggered. Exiting..., xrefs: 00F0560F
true, xrefs: 00F042E4
Couldn't find the ReturnCode attribute of EXIT command, xrefs: 00F05676
NWebAdvisor::NXmlUpdater::Hound::ExitResult, xrefs: 00F05780
Malformed XML, no UPDATEARRAY element, xrefs: 00F05930
Precondition "%s" evaluated to false, xrefs: 00F04B1E
XML precondition array with tag %s returned true due to sniffer actions, xrefs: 00F04385
EXIT, xrefs: 00F05270, 00F052B2
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\Hound.h, xrefs: 00F03B53, 00F03EFF, 00F03F67, 00F04400, 00F04D16, 00F04DE5, 00F04E51, 00F051E6, 00F0546C, 00F054C3, 00F05585, 00F055DA, 00F05785, 00F0586D, 00F058AF, 00F058EC
2, xrefs: 00F058E2
Command "%s" failed, xrefs: 00F0581A
Unable to substitute the return code, xrefs: 00F056D7, 00F0573F
UPDATECOMMANDS, xrefs: 00F04E06
UPDATE, xrefs: 00F03B7F, 00F054DE
XML precondition array with tag %s returned false, xrefs: 00F04D5C
XML precondition array returned false due to sniffer actions, xrefs: 00F0426C
PRECONDITION, xrefs: 00F043B9, 00F04C71
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\xmlUpdater.cpp, xrefs: 00F0427B, 00F042B1, 00F0435E, 00F04394, 00F04C3A, 00F04D6B, 00F05569, 00F0561E, 00F05746, 00F05829, 00F0593F
TAG, xrefs: 00F03FCA
NWebAdvisor::NXmlUpdater::Hound::End, xrefs: 00F04D11, 00F04DE0, 00F05467, 00F054BE, 00F05580, 00F055D5, 00F05868, 00F058AA, 00F058E7
NWebAdvisor::NXmlUpdater::Hound::Start, xrefs: 00F03B4E, 00F03EFA, 00F03F62, 00F043FB, 00F04E4C, 00F051E1
PRECONDITIONARRAY, xrefs: 00F03F1E
unknown, xrefs: 00F04103
Precondition "%s" evaluated to true, xrefs: 00F04C2B
XML precondition failed - no Type specified, xrefs: 00F0555A
EXIT_XML, xrefs: 00F052FB
Unable to convert ReturnCode into int, xrefs: 00F0573A
ReturnCode, xrefs: 00F05637, 00F0568C, 00F056DE
NWebAdvisor::NXmlUpdater::CUpdater::Process, xrefs: 00F04276, 00F042AC, 00F04359, 00F0438F, 00F04C35, 00F04D66, 00F05564, 00F05619, 00F05741, 00F05824, 00F0593A
UPDATEARRAY, xrefs: 00F03B18

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::locale::_$InitLockitstd::_$H_prolog3Ios_base_dtorLockit::_Lockit::~_Setgloballocalestd::ios_base::_
String ID: 2$Command "%s" failed$Couldn't find the ReturnCode attribute of EXIT command$EXIT$EXIT_UPDATE$EXIT_XML$Exit update command triggered. Exiting...$Malformed XML, no UPDATEARRAY element$NWebAdvisor::NXmlUpdater::CUpdater::Process$NWebAdvisor::NXmlUpdater::Hound::End$NWebAdvisor::NXmlUpdater::Hound::ExitResult$NWebAdvisor::NXmlUpdater::Hound::Start$PRECONDITION$PRECONDITIONARRAY$Precondition "%s" evaluated to false$Precondition "%s" evaluated to true$ReturnCode$TAG$UPDATE$UPDATEARRAY$UPDATECOMMANDS$Unable to convert ReturnCode into int$Unable to substitute the return code$XML precondition array returned false due to sniffer actions$XML precondition array returned true due to sniffer actions$XML precondition array with tag %s returned false$XML precondition array with tag %s returned false due to sniffer actions$XML precondition array with tag %s returned true due to sniffer actions$XML precondition failed - no Type specified$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\Hound.h$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\xmlUpdater.cpp$false$true$unknown
API String ID: 3544396713-2181764886
Opcode ID: 91e613147d939d57059f9b58a928b103b5124c41b4981148fae35a4b731f8076
Instruction ID: 4b79ec5f35dc1f292a39ca169187a0a553d1d37e874e42b3288e2228eb297bb0
Opcode Fuzzy Hash: 91e613147d939d57059f9b58a928b103b5124c41b4981148fae35a4b731f8076
Instruction Fuzzy Hash: F5139BB1D012289BDF20DF64CC49BEEBBB4AF48314F1441D9E509A7291DB74AE84EF91

Function 00EE5870 Relevance: 60.3, APIs: 22, Strings: 12, Instructions: 780
encryptionfilethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00EE58AA
GetCurrentThreadId.KERNEL32 ref: 00EE58B4
CreateFileW.KERNEL32(\\.\WGUARDNT,C0000000,00000000,00000000,00000003,40000000,00000000), ref: 00EE593A
CreateFileW.KERNEL32(\\.\Global\WGUARDNT,C0000000,00000000,00000000,00000003,40000000,00000000), ref: 00EE595C
CreateFileW.KERNEL32(\\.\WGUARDNT,80000000,00000000,00000000,00000003,40000000,00000000), ref: 00EE5991
CreateFileW.KERNEL32(\\.\Global\WGUARDNT,80000000,00000000,00000000,00000003,40000000,00000000), ref: 00EE59B5
CreateFileW.KERNEL32(\\.\WGUARDNT,C0000000,00000000,00000000,00000003,40000000,00000000), ref: 00EE59D9
CreateFileW.KERNEL32(\\.\Global\WGUARDNT,C0000000,00000000,00000000,00000003,40000000,00000000), ref: 00EE59FD
UuidCreate.RPCRT4(00000000), ref: 00EE5A41
UuidCreate.RPCRT4(00000000), ref: 00EE5A57
CryptAcquireContextW.ADVAPI32(?), ref: 00EE5D0E
CryptCreateHash.ADVAPI32(00000010,00008003,00000000,00000000,?), ref: 00EE5D2A
CryptHashData.ADVAPI32(?,?,00000000,00000000), ref: 00EE5D43
CryptGetHashParam.ADVAPI32(00000000,00000002,?,?,00000000), ref: 00EE5D5F
CryptDestroyHash.ADVAPI32(?), ref: 00EE5D6E
CryptReleaseContext.ADVAPI32(?,00000000), ref: 00EE5D7F
CryptAcquireContextW.ADVAPI32(?), ref: 00EE5F87
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,?), ref: 00EE5FA3
CryptHashData.ADVAPI32(?,?,00000000,00000000), ref: 00EE5FBC
CryptGetHashParam.ADVAPI32(00000000,00000002,?,?,00000000), ref: 00EE5FD8
CryptDestroyHash.ADVAPI32(?), ref: 00EE5FE7
CryptReleaseContext.ADVAPI32(?,00000000), ref: 00EE5FF8

Strings

AacControl3, xrefs: 00EE5AB6, 00EE5ABD
al delete policy on terminate process 0x%x (%d) rule, xrefs: 00EE5C8A
\\.\WGUARDNT, xrefs: 00EE592E, 00EE598C, 00EE59D4
AacControl2, xrefs: 00EE5AC5, 00EE5ACC
\\.\Global\WGUARDNT, xrefs: 00EE5957, 00EE59B0, 00EE59F8
AacControl5, xrefs: 00EE5A98, 00EE5A9F
al disable rules on terminate thread 0x%x (%d) rule, xrefs: 00EE5F01
AacControl4, xrefs: 00EE5AA7, 00EE5AAE
accesslib policy %x:%x, xrefs: 00EE5B78
AacControl6, xrefs: 00EE5A76, 00EE5A80, 00EE5A90
Created access handle %p, xrefs: 00EE6171, 00EE620C
AacControl, xrefs: 00EE5AD4

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Crypt$Create$Hash$File$Context$AcquireCurrentDataDestroyParamReleaseUuid$ProcessThread
String ID: AacControl$AacControl2$AacControl3$AacControl4$AacControl5$AacControl6$Created access handle %p$\\.\Global\WGUARDNT$\\.\WGUARDNT$accesslib policy %x:%x$al delete policy on terminate process 0x%x (%d) rule$al disable rules on terminate thread 0x%x (%d) rule
API String ID: 4128897270-3926088020
Opcode ID: 09e56519bc3d9b27be1c26507723ce482aa1868b07347fd0ac0c33a668b637bd
Instruction ID: 7b209fde73d984fa50b8df9331afbc189b097b3463bf2310fb47e6ce011798fc
Opcode Fuzzy Hash: 09e56519bc3d9b27be1c26507723ce482aa1868b07347fd0ac0c33a668b637bd
Instruction Fuzzy Hash: CD5266756043049FDB109F64DC84B6EBBE6BB88718F150859FA4AAB390CB74ED019F82

Function 00F21840 Relevance: 56.8, APIs: 5, Strings: 27, Instructions: 754registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNEL32(80000002,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,-00000028,?,?,-00000028,00000000,?), ref: 00F21932
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000028,?), ref: 00F21DAD
RegCloseKey.ADVAPI32(00000000,?,?,?,-00000028,?,?,-00000028,00000000,?), ref: 00F21DD3
std::locale::_Init.LIBCPMT ref: 00F220C4

Strings

Unable to convert %s to hex, xrefs: 00F21BF9
Unknown registry key type: %s, xrefs: 00F21C24
NWebAdvisor::NXmlUpdater::SetRegistryKey, xrefs: 00F21957, 00F21992, 00F21AAE, 00F21C03, 00F21C2E, 00F21CF1, 00F21D91
memcpy_s failed in NWebAdvisor::NXmlUpdater::SetRegistryKey, xrefs: 00F2198B, 00F21AA4, 00F21CEA
NWebAdvisor::NXmlUpdater::CSetVariableCommand::Execute, xrefs: 00F22288, 00F222CE
Error (%d) setting value (%s) under registry key: %s, xrefs: 00F21D87
invalid stoull argument, xrefs: 00F21E0B
(Default), xrefs: 00F21D2A, 00F21D72
NUM, xrefs: 00F219BD
Value, xrefs: 00F21EF2
STR, xrefs: 00F218AA
Key, xrefs: 00F21E98
Unable to substitute variables for the SETVAR command, xrefs: 00F222BB, 00F222CC
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\SetVariableCommand.cpp, xrefs: 00F2228D, 00F222D3
Setting variable , xrefs: 00F22170
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\RegistryCommand.cpp, xrefs: 00F2195C, 00F21997, 00F21AB3, 00F21C08, 00F21C33, 00F21CF6, 00F21D96
invalid stoul argument, xrefs: 00F21E1F
Error (%d) creating registry key: %s, xrefs: 00F2194D
Unable to set the variable, xrefs: 00F21FA6
stoul argument out of range, xrefs: 00F21E29
to , xrefs: 00F22189
QWORD, xrefs: 00F219E9
DWORD, xrefs: 00F219D3
invalid substitutor, xrefs: 00F21E8C
BIN, xrefs: 00F21AD9
Unable to read key or value attribute of SETVAR command, xrefs: 00F222C7
stoull argument out of range, xrefs: 00F21E15

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Close$CreateInitstd::locale::_
String ID: to $(Default)$BIN$DWORD$Error (%d) creating registry key: %s$Error (%d) setting value (%s) under registry key: %s$Key$NUM$NWebAdvisor::NXmlUpdater::CSetVariableCommand::Execute$NWebAdvisor::NXmlUpdater::SetRegistryKey$QWORD$STR$Setting variable $Unable to convert %s to hex$Unable to read key or value attribute of SETVAR command$Unable to set the variable$Unable to substitute variables for the SETVAR command$Unknown registry key type: %s$Value$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\RegistryCommand.cpp$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\SetVariableCommand.cpp$invalid stoul argument$invalid stoull argument$invalid substitutor$memcpy_s failed in NWebAdvisor::NXmlUpdater::SetRegistryKey$stoul argument out of range$stoull argument out of range
API String ID: 3662814871-412574832
Opcode ID: 95dd1ed9c032eef52bf128ac3a5e99bc33a5d39f8d99b986c8bda6f92e9b6878
Instruction ID: 10786bae6d94089c76758f55740ba6053be705052f10c698342493a20f9917d6
Opcode Fuzzy Hash: 95dd1ed9c032eef52bf128ac3a5e99bc33a5d39f8d99b986c8bda6f92e9b6878
Instruction Fuzzy Hash: 9052DE70E00328EBEF20DF54DC85B9EB7B4BF14714F140199E80967281E775AA85EFA6

Function 00F1FFE0 Relevance: 31.9, APIs: 9, Strings: 9, Instructions: 368
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Wait for process failed for command %s, xrefs: 00F203D5
Failed to get process exit code (%d), xrefs: 00F20406
Unable to run %s, error (%d), xrefs: 00F20393
Failed to delete executable (%d), xrefs: 00F20450
Signature check failed for command %s, xrefs: 00F2008C
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\ExecuteLocalCommand.cpp, xrefs: 00F2003B, 00F20098, 00F2039F, 00F20415, 00F2045F
invalid substitutor, xrefs: 00F2002F
D, xrefs: 00F20103
NWebAdvisor::NXmlUpdater::CExecuteLocalCommand::ExecuteLocalCommand, xrefs: 00F20036, 00F20093, 00F2039A, 00F20410, 00F2045A

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID:
String ID: D$Failed to delete executable (%d)$Failed to get process exit code (%d)$NWebAdvisor::NXmlUpdater::CExecuteLocalCommand::ExecuteLocalCommand$Signature check failed for command %s$Unable to run %s, error (%d)$Wait for process failed for command %s$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\ExecuteLocalCommand.cpp$invalid substitutor
API String ID: 0-284121414
Opcode ID: 243dc62a9bd0a6a0a4f06fb0e5665cdc0370d6106aaea66d87dc7636ca19f31e
Instruction ID: c827c57aa3d8e58846c9dac74cc5b4c9db7749bedb11f5dc1338ed28950d57c6
Opcode Fuzzy Hash: 243dc62a9bd0a6a0a4f06fb0e5665cdc0370d6106aaea66d87dc7636ca19f31e
Instruction Fuzzy Hash: A5E1AB71E052699BEF24DF28DC49BADB7B4AF54304F0041DEE409A7292DBB09E84DF52

Function 00EE5110 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 452
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,Software\McAfee\SystemCore,00000000,00020219,?), ref: 00EE5225
RegQueryValueExW.ADVAPI32(?,szInstallDir32,00000000,?,?,?), ref: 00EE5265
SetLastError.KERNEL32(0000006F,?,?,00FAA17C), ref: 00EE52B6
RegCloseKey.ADVAPI32(?), ref: 00EE52C2
GetLastError.KERNEL32 ref: 00EE52F6
OutputDebugStringW.KERNEL32(NCPrivateLoadAndValidateMPTDll: Looking in current directory), ref: 00EE53E3

Strings

NCPrivateLoadAndValidateMPTDll: Looking in EXE directory, xrefs: 00EE549C
Software\McAfee\SystemCore, xrefs: 00EE521B
%ls\%ls, xrefs: 00EE5533
NCPrivateLoadAndValidateMPTDll: Looking in current directory, xrefs: 00EE53DE
NotComDllGetInterface: %ls loading %ls, WinVerifyTrust failed with %08x, xrefs: 00EE56B7
szInstallDir32, xrefs: 00EE525F

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ErrorLast$CloseDebugOpenOutputQueryStringValue
String ID: %ls\%ls$NCPrivateLoadAndValidateMPTDll: Looking in EXE directory$NCPrivateLoadAndValidateMPTDll: Looking in current directory$NotComDllGetInterface: %ls loading %ls, WinVerifyTrust failed with %08x$Software\McAfee\SystemCore$szInstallDir32
API String ID: 1760606849-3767168787
Opcode ID: b77ed8742aacbfada4c2227591c2759906e180ec602e3b775a5ba811126d650e
Instruction ID: 6ee1be3fbd598737f23951da0c108a43816dd74370fe1b964bc17e291feb23b9
Opcode Fuzzy Hash: b77ed8742aacbfada4c2227591c2759906e180ec602e3b775a5ba811126d650e
Instruction Fuzzy Hash: 6602B0B2E0065DAFEB24DB65CC45BAEB7B4BF04308F1441A9E809B7281DB749E54CF91

Function 00F317A0 Relevance: 27.4, APIs: 18, Instructions: 353
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,00F32520,00000400,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F31815
CryptMsgClose.CRYPT32(00000000), ref: 00F31827

Part of subcall function 00F314F0: CryptMsgGetParam.CRYPT32(?,00000005,00000000,?,?), ref: 00F31581
Part of subcall function 00F314F0: CryptMsgGetParam.CRYPT32(?,00000006,00000000,00000000,?), ref: 00F315B2
Part of subcall function 00F314F0: CryptMsgGetParam.CRYPT32(?,00000006,?,00000000,?), ref: 00F315DD
Part of subcall function 00F314F0: CertGetSubjectCertificateFromStore.CRYPT32(?,00010001,?), ref: 00F31625

CertCloseStore.CRYPT32(00000000,00000001), ref: 00F31837
CryptMsgClose.CRYPT32(00000000), ref: 00F318C0
CertCloseStore.CRYPT32(00000000,00000001), ref: 00F318D0
CryptQueryObject.CRYPT32(00000002,?,00003FFE,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F319CD
CryptMsgClose.CRYPT32(00000000), ref: 00F319DF
CertCloseStore.CRYPT32(00000000,00000001), ref: 00F319F1
CryptMsgClose.CRYPT32(00000000), ref: 00F31A1D
CertCloseStore.CRYPT32(00000000,00000001), ref: 00F31A29
CryptMsgClose.CRYPT32(00000000), ref: 00F31A63
CertCloseStore.CRYPT32(00000000,00000001), ref: 00F31A75
CryptMsgClose.CRYPT32(00000000), ref: 00F31AA1
CertCloseStore.CRYPT32(00000000,00000001), ref: 00F31AAD
CryptMsgClose.CRYPT32(00000000), ref: 00F31ACD
CertCloseStore.CRYPT32(00000000,00000001), ref: 00F31AD9
CryptMsgClose.CRYPT32(00000000), ref: 00F31B50
CertCloseStore.CRYPT32(00000000,00000001), ref: 00F31B5C

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Close$Crypt$CertStore$Param$ObjectQuery$CertificateFromSubject
String ID:
API String ID: 2648890560-0
Opcode ID: 746f45d867dad427e28daeecd08b595843b3aa36a01f8cacf0c9432029d8ecc9
Instruction ID: 76950e38f5f65b1dc128062083f523cf0da4fa229ad9088525c9ca975491e4ad
Opcode Fuzzy Hash: 746f45d867dad427e28daeecd08b595843b3aa36a01f8cacf0c9432029d8ecc9
Instruction Fuzzy Hash: 35C10A71E10249ABEF10DFB5CD89BAEBBB8BF04714F144529E904F7280DB789944DB64

Function 00EE70D9 Relevance: 27.2, APIs: 4, Strings: 11, Instructions: 977COMMON

Download Yara Rule

APIs

Part of subcall function 00EF4B40: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EF521E

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EE7D3D
Concurrency::cancel_current_task.LIBCPMT ref: 00EE7DFC
__Mtx_unlock.LIBCPMT ref: 00EE7DC8

Part of subcall function 00ED9BB0: InitOnceBeginInitialize.KERNEL32(00FC80C4,00000000,87CF6CF3,00000000,87CF6CF3,00EDA219,00FC80CC,?,?,?,?,?,?,00EDA219,?,?), ref: 00ED9BE5
Part of subcall function 00ED9BB0: InitOnceComplete.KERNEL32(00FC80C4,00000000,00000000), ref: 00ED9C1D

Part of subcall function 00ED9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00ED9A12

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EE7EBB

Strings

Failed to add event category (, xrefs: 00EE71F0
Failed to add reserved 5 dimension (, xrefs: 00EE7CFD
Failed to add event label (, xrefs: 00EE7508
z, xrefs: 00EE7CF1
Failed to add reserved 3 dimension (, xrefs: 00EE79CD
Failed to add reserved 1 dimension (, xrefs: 00EE769E
Failed to add event action (, xrefs: 00EE7379
Service has not been initialized, xrefs: 00EE7E88
u, xrefs: 00EE7B57
Failed to add reserved 4 dimension (, xrefs: 00EE7B63
Failed to add reserved 2 dimension (, xrefs: 00EE7834

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$InitOnce$BeginCompleteConcurrency::cancel_current_taskInitializeMtx_unlock
String ID: Failed to add event action ($Failed to add event category ($Failed to add event label ($Failed to add reserved 1 dimension ($Failed to add reserved 2 dimension ($Failed to add reserved 3 dimension ($Failed to add reserved 4 dimension ($Failed to add reserved 5 dimension ($Service has not been initialized$u$z
API String ID: 342047005-3525645681
Opcode ID: d2bed4ef07d36ac25cf02dc009cc151036a2bc0e564d8fedefd96d7facd415f9
Instruction ID: 58e6f07dc94127c122605c1da2bab1ab98db78a8b4501c75ef24cb61d046b723
Opcode Fuzzy Hash: d2bed4ef07d36ac25cf02dc009cc151036a2bc0e564d8fedefd96d7facd415f9
Instruction Fuzzy Hash: 9282F370604288DFDB18EF24CC91BEE7BA4EF45304F10519DE855AB382EB75DA05DBA2

Function 00EE8FB0 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 245COMMON

Download Yara Rule

APIs

CoCreateGuid.OLE32(?), ref: 00EE8FC8
StringFromCLSID.OLE32(?,?), ref: 00EE8FE0
CoTaskMemFree.OLE32(?), ref: 00EE9138
Concurrency::cancel_current_task.LIBCPMT ref: 00EE9173
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EE93D1

Strings

Could not create registry key , xrefs: 00EE923F
SOFTWARE\McAfee\WebAdvisor, xrefs: 00EE91FB

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Concurrency::cancel_current_taskCreateFreeFromGuidIos_base_dtorStringTaskstd::ios_base::_
String ID: Could not create registry key $SOFTWARE\McAfee\WebAdvisor
API String ID: 3741506170-3627174789
Opcode ID: 8e322675d2c2974ab0049d7602f0b8a1235ad931b49e1d26046627e8dfd29af1
Instruction ID: b8df842ba06175acc6fc5a419b2be625845cec39bb0e27492ce141f940652e4a
Opcode Fuzzy Hash: 8e322675d2c2974ab0049d7602f0b8a1235ad931b49e1d26046627e8dfd29af1
Instruction Fuzzy Hash: 578128716002499BDB14EF75DC45BAE77E8EF44310F50462EF916A7382EB34AA04CB92

Function 00ED4C8E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73processCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00ED4CA6
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00ED4CB8
Process32FirstW.KERNEL32(00000000,?), ref: 00ED4CD3
Process32NextW.KERNEL32(00000000,0000022C), ref: 00ED4CE9
FindCloseChangeNotification.KERNEL32(00000000), ref: 00ED4CFA

Strings

saBSI.exe, xrefs: 00ED4D1C

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Process32$ChangeCloseCreateCurrentFindFirstNextNotificationProcessSnapshotToolhelp32
String ID: saBSI.exe
API String ID: 1594840063-3955546181
Opcode ID: c9533e47327c8a06f2d7394560fd035db781cf9c404502c4f7a97cae40c66971
Instruction ID: 92d8db4dca4cf09cdcc07e30dd7f50f03807c0c544e97b56abc235581337f298
Opcode Fuzzy Hash: c9533e47327c8a06f2d7394560fd035db781cf9c404502c4f7a97cae40c66971
Instruction Fuzzy Hash: FF212BB11053049FD220AB24EC89ABFB7D5EB96324F14161AFD15E73D0E734890A97A3

Function 00F314F0 Relevance: 9.2, APIs: 6, Instructions: 215encryptionCOMMON

Download Yara Rule

APIs

CryptMsgGetParam.CRYPT32(?,00000005,00000000,?,?), ref: 00F31581
CryptMsgGetParam.CRYPT32(?,00000006,00000000,00000000,?), ref: 00F315B2
CryptMsgGetParam.CRYPT32(?,00000006,?,00000000,?), ref: 00F315DD
CertGetSubjectCertificateFromStore.CRYPT32(?,00010001,?), ref: 00F31625
CertFreeCRLContext.CRYPT32(?), ref: 00F3175E

Part of subcall function 00F4E960: _free.LIBCMT ref: 00F4E973

CertFreeCRLContext.CRYPT32(?), ref: 00F31738

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: CertCryptParam$ContextFree$CertificateFromStoreSubject_free
String ID:
API String ID: 4059466977-0
Opcode ID: 0586400c77c0dc68e24c4dbb1cb0b2182ece215a1108dd234c547bc26a314d09
Instruction ID: 5adcdd3e9f039b36cb4683e07f27da38e77d0c3d39e992a68777d4b6ca9218cb
Opcode Fuzzy Hash: 0586400c77c0dc68e24c4dbb1cb0b2182ece215a1108dd234c547bc26a314d09
Instruction Fuzzy Hash: EB813775800208EFDF20DFA4DD81BEEBBB4BF09364F144119EC15A7252D735AA08ABA1

Function 00EE4F50 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00000000,00000000,87CF6CF3), ref: 00EE4FB5
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00EE4FDF
GetLastError.KERNEL32 ref: 00EE4FF2
GetLastError.KERNEL32 ref: 00EE500B

Strings

%ls\%ls, xrefs: 00EE5056

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: CurrentDirectoryErrorLast
String ID: %ls\%ls
API String ID: 152501406-2125769799
Opcode ID: 57f5eeb68644499d7d3d3968fa48a749b419c992b8d59edf89306d5f92237e2c
Instruction ID: f887f1ab1b4f31c2913871a2593ffb4564fcd356bbcb4b268309ddacdf04590d
Opcode Fuzzy Hash: 57f5eeb68644499d7d3d3968fa48a749b419c992b8d59edf89306d5f92237e2c
Instruction Fuzzy Hash: D24196B2E006599BDB14DFA5CC45BAFBBB9AB44704F24413AF805E7281EB35D9008B91

Function 00F5E8FE Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00F5E8FD,00000002,00000002,?,00000002), ref: 00F5E920
TerminateProcess.KERNEL32(00000000,?,00F5E8FD,00000002,00000002,?,00000002), ref: 00F5E927
ExitProcess.KERNEL32 ref: 00F5E939

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: e24e813828c80de790017f1bad8403dbef1c1e577fd484d56e4f3a7c749ae138
Instruction ID: 1143821c89ef340f08576a5bbf3ef1775e1b11af79a8a63898492f0d3426764b
Opcode Fuzzy Hash: e24e813828c80de790017f1bad8403dbef1c1e577fd484d56e4f3a7c749ae138
Instruction Fuzzy Hash: ECE0B67140054CAFCF556F64DD49AA83B69FB44352B144814FA0986131CB79EE45EB52

Function 00ED5C1E Relevance: 3.1, APIs: 2, Instructions: 76comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00F9D808,00000000,00000017,00FAB024,00000000,87CF6CF3,?,?,?,00000000,00000000,00000000,00F78687,000000FF), ref: 00ED5C7A
OleRun.OLE32(00000000), ref: 00ED5C89

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 0ef40e4e34ae514268257296d832bd9d92b5e0dc02a5cbfb51a3bc06e920be17
Instruction ID: 6ae8f759b78626f16c292bad955096c8cf51530f16c743934b9480ca2a8b7169
Opcode Fuzzy Hash: 0ef40e4e34ae514268257296d832bd9d92b5e0dc02a5cbfb51a3bc06e920be17
Instruction Fuzzy Hash: 4321AC76610618AFDB04CB58CC45F6EBBB9EB88B20F20412AE505A73A0DB30AD019B50

Function 00ED4E1F Relevance: 65.5, APIs: 9, Strings: 28, Instructions: 767
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EFD6D0: GetModuleHandleW.KERNEL32(kernel32.dll,00ED4E6C,87CF6CF3), ref: 00EFD6D5
Part of subcall function 00EFD6D0: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00EFD6E5

CoInitializeEx.OLE32(00000000,00000000,87CF6CF3), ref: 00ED4F3E
CommandLineToArgvW.SHELL32(?,?), ref: 00ED5226
GetLastError.KERNEL32(?,00000001), ref: 00ED5276
GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 00ED52A8
GetLastError.KERNEL32(?,00000001), ref: 00ED52F3
GetLongPathNameW.KERNEL32(?,?,00000104), ref: 00ED535F
GetLastError.KERNEL32(?,00000002), ref: 00ED53AE
CloseHandle.KERNEL32(?,?,00000001), ref: 00ED58E9

Part of subcall function 00ED9BB0: InitOnceBeginInitialize.KERNEL32(00FC80C4,00000000,87CF6CF3,00000000,87CF6CF3,00EDA219,00FC80CC,?,?,?,?,?,?,00EDA219,?,?), ref: 00ED9BE5
Part of subcall function 00ED9BB0: InitOnceComplete.KERNEL32(00FC80C4,00000000,00000000), ref: 00ED9C1D

Part of subcall function 00ED9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00ED9A12

Part of subcall function 00ED136C: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00ED13A5

CoUninitialize.OLE32(?,00000001), ref: 00ED58D4

Part of subcall function 00EE6BD0: __Mtx_init_in_situ.LIBCPMT ref: 00EE6CC0

Strings

Process, xrefs: 00ED5208
SELF_UPDATE_ALLOWED, xrefs: 00ED54CE
InitSecureDllLoading failed., xrefs: 00ED4EAB
TRUE, xrefs: 00ED54AA, 00ED54B9, 00ED55B2
BSI installation success. Exit code: , xrefs: 00ED57BC
Failed to create xml updater logger, xrefs: 00ED4FD1
Started, xrefs: 00ED5203, 00ED561D
Failed to create xml updater signature verifier, xrefs: 00ED505B
MAIN_XML, xrefs: 00ED5553
GetModuleFileName failed: , xrefs: 00ED52E3
InvalidArguments, xrefs: 00ED56B5
Failed, xrefs: 00ED580B
failed to initialize updater, xrefs: 00ED51DC
WaitForOtherBSIToExit failed, xrefs: 00ED4F16
SaBsi.cpp, xrefs: 00ED4E6C, 00ED510A, 00ED51C3, 00ED524D, 00ED52CA, 00ED5385, 00ED5669, 00ED56E7, 00ED57A3, 00ED584A
STORE_XML_ON_DISK, xrefs: 00ED55D5
GetLongPathName failed (, xrefs: 00ED539E
/xml, xrefs: 00ED5513, 00ED5542
Ended, xrefs: 00ED5764
/store_xml_on_disk, xrefs: 00ED559B
Some command line BSI variables are invalid., xrefs: 00ED5700
Install, xrefs: 00ED5622, 00ED56BA, 00ED5769, 00ED5810
/no_self_update, xrefs: 00ED548C
BootStrapInstaller, xrefs: 00ED520D, 00ED5627, 00ED56BF, 00ED576E, 00ED5815
Failed to allocate memory for event sender service, xrefs: 00ED5123
FALSE, xrefs: 00ED54A2
CommandLineToArgvW failed: , xrefs: 00ED5266
SA/WA installation failed with exit code: , xrefs: 00ED5863

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ErrorLast$HandleInitInitializeIos_base_dtorModuleNameOncestd::ios_base::_$AddressArgvBeginCloseCommandCompleteFileLineLongMtx_init_in_situPathProcUninitialize
String ID: /no_self_update$/store_xml_on_disk$/xml$BSI installation success. Exit code: $BootStrapInstaller$CommandLineToArgvW failed: $Ended$FALSE$Failed$Failed to allocate memory for event sender service$Failed to create xml updater logger$Failed to create xml updater signature verifier$GetLongPathName failed ($GetModuleFileName failed: $InitSecureDllLoading failed.$Install$InvalidArguments$MAIN_XML$Process$SA/WA installation failed with exit code: $SELF_UPDATE_ALLOWED$STORE_XML_ON_DISK$SaBsi.cpp$Some command line BSI variables are invalid.$Started$TRUE$WaitForOtherBSIToExit failed$failed to initialize updater
API String ID: 126520999-360321973
Opcode ID: 110d6d049d12e3ff4a5eb5bfe735cf485f107b12168d7ce5fb16b5cee7039404
Instruction ID: 521a0816d43d00c7d6cb90d92e4b9f58489e0bc9aa2dbe821aa9187a4c5742bf
Opcode Fuzzy Hash: 110d6d049d12e3ff4a5eb5bfe735cf485f107b12168d7ce5fb16b5cee7039404
Instruction Fuzzy Hash: 0D628EB0900248EFDF14EFA0D895AED7BB4EF15344F50509AF809B7382DB709A49DBA1

Function 00F0EFC0 Relevance: 63.7, APIs: 13, Strings: 23, Instructions: 743
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00F0F13D

Part of subcall function 00F08650: std::locale::_Init.LIBCPMT ref: 00F0882F

CloseHandle.KERNEL32(?,?,?,?,?,00000006,00000000,?,?,?,00000000,?,?,?,00000000,00000000), ref: 00F0FAC8

Part of subcall function 00F4E960: _free.LIBCMT ref: 00F4E973

Strings

true, xrefs: 00F0F2BA, 00F0F2C5
File already exists: %s, xrefs: 00F0F8C1
HTTP add request headers failed (%d), url: %s, xrefs: 00F0F265
HTTP query content length (%d), url: %s, xrefs: 00F0F3C1
Unable to open HTTP transaction, xrefs: 00F0F055
HTTP receive response failed (%d), url: %s, xrefs: 00F0F31A
HTTP send request failed (%d), url: %s, ignore proxy flag %s, xrefs: 00F0F2C9
WinHttpCrackUrl failed (%d), url: %s, xrefs: 00F0F159
Unable to extract the filename from url (%s), xrefs: 00F0F567
Unable to allocate %d bytes, xrefs: 00F0F430
empty filename, xrefs: 00F0F541
WriteFile failed (%d), xrefs: 00F0FAA4
<, xrefs: 00F0F0D2
NWebAdvisor::NHttp::NDownloadFile::StoreOnDisk::<lambda_2af623cb1b195cc2505e5df23daadde2>::operator (), xrefs: 00F0F05F, 00F0F26F, 00F0F2D3, 00F0F369, 00F0F3CB, 00F0F43A, 00F0F54B, 00F0F571, 00F0F803, 00F0F898, 00F0F8CB, 00F0FAAE
false, xrefs: 00F0F2B5
Cache-Control: no-cache, xrefs: 00F0F23D
HTTP status (%d) error (%d), url: %s, xrefs: 00F0F35F
HTTP connection failed (%d), url: %s, xrefs: 00F0F1C9
Unable to rename the old file (%d): %s, xrefs: 00F0F7F9
CreateFile failed (%d), xrefs: 00F0F88E
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpsDownloadFile.cpp, xrefs: 00F0F064, 00F0F274, 00F0F2D8, 00F0F36E, 00F0F3D0, 00F0F43F, 00F0F550, 00F0F576, 00F0F808, 00F0F89D, 00F0F8D0, 00F0FAB3
GET, xrefs: 00F0F1FD
HTTP GET request failed (%d), url: %s, xrefs: 00F0F227

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: CloseErrorHandleInitLast_freestd::locale::_
String ID: <$Cache-Control: no-cache$CreateFile failed (%d)$File already exists: %s$GET$HTTP GET request failed (%d), url: %s$HTTP add request headers failed (%d), url: %s$HTTP connection failed (%d), url: %s$HTTP query content length (%d), url: %s$HTTP receive response failed (%d), url: %s$HTTP send request failed (%d), url: %s, ignore proxy flag %s$HTTP status (%d) error (%d), url: %s$NWebAdvisor::NHttp::NDownloadFile::StoreOnDisk::<lambda_2af623cb1b195cc2505e5df23daadde2>::operator ()$Unable to allocate %d bytes$Unable to extract the filename from url (%s)$Unable to open HTTP transaction$Unable to rename the old file (%d): %s$WinHttpCrackUrl failed (%d), url: %s$WriteFile failed (%d)$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpsDownloadFile.cpp$empty filename$false$true
API String ID: 2292809486-983596374
Opcode ID: 3d3fb28fb6abbea485b907187e13e0d0b5432a5bdc233d872fe5b51bec88c0ea
Instruction ID: ba60afad563f93d3541f33e6bd5902b0837013c5ffca583aca7dcde36941bf91
Opcode Fuzzy Hash: 3d3fb28fb6abbea485b907187e13e0d0b5432a5bdc233d872fe5b51bec88c0ea
Instruction Fuzzy Hash: DE629EB0A40619ABEB24DF10CC45FA9B7B4AF45704F0001E9F618672D2DBB5AA84EF95

Function 00F165F0 Relevance: 38.9, APIs: 4, Strings: 18, Instructions: 416
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentVariableW.KERNEL32(ProgramW6432,?,00000104), ref: 00F1683B
GetLastError.KERNEL32 ref: 00F1686E
SHGetKnownFolderPath.SHELL32(?,00000000,00000000,?,?,?,?), ref: 00F16A15
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000000,?,?,?,?), ref: 00F16A6B

Strings

CSIDL_SYSTEMX86, xrefs: 00F16C0C
CSIDL_COMMON_DOCUMENTS, xrefs: 00F16ACA
Unknown folder identifier: %s, xrefs: 00F16965
CSIDL_PROGRAM_FILESX64, xrefs: 00F16652, 00F16B60
GetEnvironmentVariable failed (%d), xrefs: 00F16875
CSIDL_PROGRAM_FILES, xrefs: 00F16B05
Error retrieving directory %s, xrefs: 00F16A27
NWebAdvisor::NXmlUpdater::CDirSubstitution::Substitute, xrefs: 00F16744, 00F1687C, 00F1696C, 00F16A2E
CSIDL_COMMON_STARTUP, xrefs: 00F16AE3
CSIDL_SYSTEM, xrefs: 00F16BCD
CSIDL_COMMON_APPDATA, xrefs: 00F16AAE
Unable to get the platform, xrefs: 00F1673D
CSIDL_PROGRAM_FILESX86, xrefs: 00F16B47
CSIDL_WINDOWS, xrefs: 00F16C45
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\DirSubstitution.cpp, xrefs: 00F16749, 00F16881, 00F16971, 00F16A33
ProgramW6432, xrefs: 00F16832, 00F1683A
ProgramFiles, xrefs: 00F1682D
CSIDL_PROGRAM_FILES_COMMON, xrefs: 00F16B82

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: EnvironmentErrorFolderFreeKnownLastPathTaskVariable
String ID: CSIDL_COMMON_APPDATA$CSIDL_COMMON_DOCUMENTS$CSIDL_COMMON_STARTUP$CSIDL_PROGRAM_FILES$CSIDL_PROGRAM_FILESX64$CSIDL_PROGRAM_FILESX86$CSIDL_PROGRAM_FILES_COMMON$CSIDL_SYSTEM$CSIDL_SYSTEMX86$CSIDL_WINDOWS$Error retrieving directory %s$GetEnvironmentVariable failed (%d)$NWebAdvisor::NXmlUpdater::CDirSubstitution::Substitute$ProgramFiles$ProgramW6432$Unable to get the platform$Unknown folder identifier: %s$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\DirSubstitution.cpp
API String ID: 3946049928-1874136459
Opcode ID: d0974ea40ef2632ffff7b556f5db6c4812cadc54954e69208bc89201d3cb12e9
Instruction ID: 68e5349269856fb4d3ddea2f3af0bc876a637b47d3bfcd7c27774f39e53a3cff
Opcode Fuzzy Hash: d0974ea40ef2632ffff7b556f5db6c4812cadc54954e69208bc89201d3cb12e9
Instruction Fuzzy Hash: C502AF70A00358DBEB20EF64CC49BDDB7B0EF14704F544189E809A7291EB75AAC9EF56

Function 00F0EAA0 Relevance: 37.8, APIs: 8, Strings: 17, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(87CF6CF3), ref: 00F0EBF9
GetLastError.KERNEL32(87CF6CF3,?,00000000,00F05D40), ref: 00F0EC70
GetLastError.KERNEL32(87CF6CF3,GET,?,00000000,00000000,00000000,00000000,?,00000000,00F05D40), ref: 00F0ECD8

Part of subcall function 00F08650: std::locale::_Init.LIBCPMT ref: 00F0882F

GetLastError.KERNEL32(87CF6CF3,Cache-Control: no-cache,000000FF,40000000,GET,?,00000000,00000000,00000000,00000000,?,00000000,00F05D40), ref: 00F0ED2E
GetLastError.KERNEL32(87CF6CF3,true,00000000,00000000,Cache-Control: no-cache,000000FF,40000000,GET,?,00000000,00000000,00000000,00000000,?,00000000,00F05D40), ref: 00F0ED75

Strings

true, xrefs: 00F0ED6B, 00F0ED73
HTTP add request headers failed (%d), url: %s, xrefs: 00F0ED31
HTTP query content length (%d), url: %s, xrefs: 00F0EE58
HTTP receive response failed (%d), url: %s, xrefs: 00F0EDB8
WinHttpCrackUrl failed (%d), url: %s, xrefs: 00F0EC00
Not enough space in buffer: bufferLength(%d) Read(%d), xrefs: 00F0EF88
Unable to allocate %d bytes, xrefs: 00F0EEAC
false, xrefs: 00F0ED66
Cache-Control: no-cache, xrefs: 00F0ED13
HTTP status (%d) error (%d), url: %s, xrefs: 00F0EE07
HTTP connection failed (%d), url: %s, xrefs: 00F0EC77
<, xrefs: 00F0EB91
NWebAdvisor::NHttp::NDownloadFile::From::<lambda_1effc98e56da47b46c9f3c737083b6c0>::operator (), xrefs: 00F0EC07, 00F0EC7E, 00F0ECE6, 00F0ED38, 00F0ED7F, 00F0EDBF, 00F0EE0E, 00F0EE62, 00F0EEB6, 00F0EF92
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpsDownloadFile.cpp, xrefs: 00F0EC0C, 00F0EC83, 00F0ECEB, 00F0ED3D, 00F0ED84, 00F0EDC4, 00F0EE13, 00F0EE67, 00F0EEBB, 00F0EF97
GET, xrefs: 00F0ECC9
HTTP send request failed (%d), url: %s, proxy ignore flag %s, xrefs: 00F0ED78
HTTP GET request failed (%d), url: %s, xrefs: 00F0ECDF

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ErrorLast$Initstd::locale::_
String ID: <$Cache-Control: no-cache$GET$HTTP GET request failed (%d), url: %s$HTTP add request headers failed (%d), url: %s$HTTP connection failed (%d), url: %s$HTTP query content length (%d), url: %s$HTTP receive response failed (%d), url: %s$HTTP send request failed (%d), url: %s, proxy ignore flag %s$HTTP status (%d) error (%d), url: %s$NWebAdvisor::NHttp::NDownloadFile::From::<lambda_1effc98e56da47b46c9f3c737083b6c0>::operator ()$Not enough space in buffer: bufferLength(%d) Read(%d)$Unable to allocate %d bytes$WinHttpCrackUrl failed (%d), url: %s$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpsDownloadFile.cpp$false$true
API String ID: 1579124236-1699437461
Opcode ID: 8dd64cd46d07ea9d454d3bdc533ea51fa6429487a7af1703fc71e0f89b2c7bd5
Instruction ID: eda58b1f05d1baf4bc52353780290d4a59919c582b9f0e2d4312b1aa4f96ad01
Opcode Fuzzy Hash: 8dd64cd46d07ea9d454d3bdc533ea51fa6429487a7af1703fc71e0f89b2c7bd5
Instruction Fuzzy Hash: 50C1E4B0A40719AAFF209F10DC42FE9B764AF15B04F404599F608771C2D7B56A84EF6A

Function 00F0BC60 Relevance: 33.8, APIs: 2, Strings: 17, Instructions: 570
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathFindExtensionW.SHLWAPI(00000000,?,?,?,?,00FABFD0,00000000,87CF6CF3), ref: 00F0BD7A
DeleteFileW.KERNEL32(00000000), ref: 00F0BE57

Strings

.cab, xrefs: 00F0BD98
Unable to verify signature, deleting file: %s, xrefs: 00F0BDE1
DestFile, xrefs: 00F0C2D4
Unable to create destination directory (%d), xrefs: 00F0C2AF
Unable to read Location and/or DestDir attribute of DOWNLOAD command, xrefs: 00F0C382
extra, xrefs: 00F0C096
Unable to get substitute download variables, xrefs: 00F0C312, 00F0C346
NWebAdvisor::NXmlUpdater::CDownloadCommand::Execute, xrefs: 00F0C2B6, 00F0C34D, 00F0C389
DestDir, xrefs: 00F0BFBE
Location, xrefs: 00F0BF76
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\DownloadCommand.cpp, xrefs: 00F0BD50, 00F0BE3C, 00F0C2BB, 00F0C352, 00F0C38E
.exe, xrefs: 00F0BD84
NWebAdvisor::NXmlUpdater::CDownloadCommand::DownloadCommand, xrefs: 00F0BD4B, 00F0BE37
Unable to download %s, xrefs: 00F0BD44
Unable to verify MD5, deleting file: %s, xrefs: 00F0BE2D
invalid substitutor, xrefs: 00F0BF6A, 00F0C387
MD5, xrefs: 00F0C006

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: DeleteExtensionFileFindPath
String ID: .cab$.exe$DestDir$DestFile$Location$MD5$NWebAdvisor::NXmlUpdater::CDownloadCommand::DownloadCommand$NWebAdvisor::NXmlUpdater::CDownloadCommand::Execute$Unable to create destination directory (%d)$Unable to download %s$Unable to get substitute download variables$Unable to read Location and/or DestDir attribute of DOWNLOAD command$Unable to verify MD5, deleting file: %s$Unable to verify signature, deleting file: %s$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\DownloadCommand.cpp$extra$invalid substitutor
API String ID: 3618814920-733304951
Opcode ID: ec96ffc7710e31924bab9a40bb551d788f65e80a7970681cca7a1023dcbebfce
Instruction ID: 8b5dc425933d61333a3217366f54949de6029dcb743abdd172d1c04a409d1a46
Opcode Fuzzy Hash: ec96ffc7710e31924bab9a40bb551d788f65e80a7970681cca7a1023dcbebfce
Instruction Fuzzy Hash: ED229EB1E002089BDF24DFA4CC95BDEB7B5EF18314F104159E815A72C2DB74AA49EFA1

Function 00EE0890 Relevance: 28.6, APIs: 12, Strings: 4, Instructions: 560
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA),00000001,?,00000000), ref: 00EE0903
LocalFree.KERNEL32(?,?), ref: 00EE0A26
LocalFree.KERNEL32(?,?), ref: 00EE0A43

Part of subcall function 00ED2510: __EH_prolog3_catch.LIBCMT ref: 00ED2517

std::_Lockit::_Lockit.LIBCPMT ref: 00EE0B08
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00EE0B50
std::_Locinfo::~_Locinfo.LIBCPMT ref: 00EE0B86
std::locale::_Init.LIBCPMT ref: 00EE0B97
std::_Lockit::_Lockit.LIBCPMT ref: 00EE0BC0
std::_Lockit::~_Lockit.LIBCPMT ref: 00EE0BE1
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00EE0BF2
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EE1017
__Mtx_unlock.LIBCPMT ref: 00EE1020

Strings

D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA), xrefs: 00EE08FE
ios_base::eofbit set, xrefs: 00EE1064
ios_base::failbit set, xrefs: 00EE105F
ios_base::badbit set, xrefs: 00EE0F6E, 00EE1055, 00EE1081

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$DescriptorFreeLocalLockit::_Securitystd::locale::_$AddfacConvertH_prolog3_catchInitIos_base_dtorLocimp::_Locimp_LocinfoLocinfo::_Locinfo::~_Locinfo_ctorLockit::~_Mtx_unlockStringstd::ios_base::_
String ID: D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2168703646-3388121372
Opcode ID: 108e1f1f9e35848df32cced3812736e8a76fc2eaa297ccdbe652685f421a49a4
Instruction ID: 9ed978f67de6d4f7fbab43bc8a796ee6a64088b63df99745ab49af5387486643
Opcode Fuzzy Hash: 108e1f1f9e35848df32cced3812736e8a76fc2eaa297ccdbe652685f421a49a4
Instruction Fuzzy Hash: 55327D7090029C8FDB15DFA4C945BEDBBB4BF09304F1440A9E949AB392DB74AE84DF91

Function 00F09400 Relevance: 25.4, APIs: 7, Strings: 7, Instructions: 870
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(kernel32,87CF6CF3,?), ref: 00F0947B
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00F0948B
GetCurrentProcess.KERNEL32(?), ref: 00F094A8
GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,00FAA52C,00FAA52A), ref: 00F097C1
GetLastError.KERNEL32(?,?,?,00FAA52C,00FAA52A), ref: 00F097CB
GetLongPathNameW.KERNEL32(00000000,?,00000104), ref: 00F0987C
GetLastError.KERNEL32 ref: 00F0989A

Strings

NWebAdvisor::NXmlUpdater::CSubstitutionManager::GetExtractDir, xrefs: 00F097DC, 00F098AC
1.1, xrefs: 00F09BCB
IsWow64Process, xrefs: 00F09485
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\SubstitutionManager.cpp, xrefs: 00F097E1, 00F098B1
kernel32, xrefs: 00F09472
GetLongPathName failed (%d) for %s, xrefs: 00F098A2
GetModuleFileName failed (%d), xrefs: 00F097D2

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ErrorLastModuleName$AddressCurrentFileHandleLongPathProcProcess
String ID: 1.1$GetLongPathName failed (%d) for %s$GetModuleFileName failed (%d)$IsWow64Process$NWebAdvisor::NXmlUpdater::CSubstitutionManager::GetExtractDir$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\SubstitutionManager.cpp$kernel32
API String ID: 891933594-2307011595
Opcode ID: e2a2f04cf0800d4bff5a67c6b35da173e57d6b099e4f0ce4c386adb2b5b1c7eb
Instruction ID: 82afa541e82cfbdea09a33c083e980ed45046a24c6b1363de99af74f6a8969b2
Opcode Fuzzy Hash: e2a2f04cf0800d4bff5a67c6b35da173e57d6b099e4f0ce4c386adb2b5b1c7eb
Instruction Fuzzy Hash: 6672ADB0A002189FDB24DF64CC85B9EB7B5AF48314F1041DCE609AB2D2DB74AE85EF55

Function 00EF59AA Relevance: 24.9, APIs: 7, Strings: 7, Instructions: 407
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00EF6067
Concurrency::cancel_current_task.LIBCPMT ref: 00EF6085
SysFreeString.OLEAUT32 ref: 00EF610F
SysFreeString.OLEAUT32(00000000), ref: 00EF615A

Strings

orm, xrefs: 00EF5FDD
UUID, xrefs: 00EF5C84
), xrefs: 00EF6016
IsWow64Process, xrefs: 00EF5F95
UUID, xrefs: 00EF5AC8
kernel32, xrefs: 00EF5F82
NO_REGKEY, xrefs: 00EF5CDE

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Concurrency::cancel_current_taskFreeString
String ID: )$IsWow64Process$NO_REGKEY$UUID$UUID$kernel32$orm
API String ID: 3597043392-3766208032
Opcode ID: 2544af124b772aa2ac2f4f06a11695efaa7683a6871955cd70c80908729a38f4
Instruction ID: e343c86f94d6ab7648d9c25fb0088285a2f1051c454be89b33148bb2f15428a5
Opcode Fuzzy Hash: 2544af124b772aa2ac2f4f06a11695efaa7683a6871955cd70c80908729a38f4
Instruction Fuzzy Hash: 0DE1F2B1A006489BEB28DF74C8887ADBBB1EF51304F24461CE505BB3D2DB789A85CB51

Function 00F06560 Relevance: 24.2, APIs: 14, Strings: 2, Instructions: 211
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalFree.KERNEL32(00000000), ref: 00F06590
GlobalFree.KERNEL32(?), ref: 00F065A1
GlobalFree.KERNEL32(00000000), ref: 00F065B2
GlobalFree.KERNEL32(?), ref: 00F065E1
GlobalAlloc.KERNEL32(00000000,?), ref: 00F0660D
GlobalFree.KERNEL32(00000000), ref: 00F06636
GlobalAlloc.KERNEL32(00000000,?), ref: 00F0666A
GlobalFree.KERNEL32(?), ref: 00F06696
GlobalFree.KERNEL32(?), ref: 00F066A7
GlobalFree.KERNEL32(?), ref: 00F066B9
GlobalFree.KERNEL32(00000000), ref: 00F0677C
GlobalFree.KERNEL32(00000000), ref: 00F0678D
GlobalFree.KERNEL32(00000000), ref: 00F067BD
GlobalFree.KERNEL32(00000000), ref: 00F067CE

Strings

`aco, xrefs: 00F06763
Temp, xrefs: 00F06713

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Global$Free$Alloc
String ID: Temp$`aco
API String ID: 1780285237-1699746194
Opcode ID: 6a1d4becbd483f1e3d2a58130961528f68cf86b70348937db5f25fec32fa587a
Instruction ID: a6862ae3354cee0bdf62a6719685d14c171fcbaf6e86d7202145ca422ca00f9c
Opcode Fuzzy Hash: 6a1d4becbd483f1e3d2a58130961528f68cf86b70348937db5f25fec32fa587a
Instruction Fuzzy Hash: 79714CB0E002199BDF109FA5CC84BAEFBB8AF04714F098159EC01EB281DB76D955EF60

Function 00EE4200 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 337COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000400,00000000,?,87CF6CF3,?,?), ref: 00EE4257
GetLastError.KERNEL32(?,00000001,?,?), ref: 00EE42BC
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EE42F2
QueryFullProcessImageNameW.KERNEL32(00000000,00000000,00000000,?,00000104,00000000,?,?), ref: 00EE4367
GetLastError.KERNEL32(?,?), ref: 00EE4375
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EE440A
CloseHandle.KERNEL32(00000000,?), ref: 00EE455B

Part of subcall function 00ED9BB0: InitOnceBeginInitialize.KERNEL32(00FC80C4,00000000,87CF6CF3,00000000,87CF6CF3,00EDA219,00FC80CC,?,?,?,?,?,?,00EDA219,?,?), ref: 00ED9BE5
Part of subcall function 00ED9BB0: InitOnceComplete.KERNEL32(00FC80C4,00000000,00000000), ref: 00ED9C1D

Part of subcall function 00ED9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00ED9A12

Strings

Filename for process with id , xrefs: 00EE44B0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$ErrorInitLastOnceProcess$BeginCloseCompleteFullHandleImageInitializeNameOpenQuery
String ID: Filename for process with id
API String ID: 563014942-4200337779
Opcode ID: d3cac86eeda2d0c4e2951132c8995235eb814081e8878a3ae6c96dd82379a032
Instruction ID: 61ad4ea465e4f97ac94d93e38ef198dc847b2edcd16a9520e716a38f595470de
Opcode Fuzzy Hash: d3cac86eeda2d0c4e2951132c8995235eb814081e8878a3ae6c96dd82379a032
Instruction Fuzzy Hash: 44D16BB0D1025DDBDB20DFA4DC45BEEB7B4FF44304F10466AE819A7281EB746A49CB91

Function 00F700DE Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F6FE25: CreateFileW.KERNEL32(00000000,00000000,?,00F70187,?,?,00000000,?,00F70187,00000000,0000000C), ref: 00F6FE42

GetLastError.KERNEL32 ref: 00F701F2
__dosmaperr.LIBCMT ref: 00F701F9
GetFileType.KERNEL32(00000000), ref: 00F70205
GetLastError.KERNEL32 ref: 00F7020F
__dosmaperr.LIBCMT ref: 00F70218
CloseHandle.KERNEL32(00000000), ref: 00F70238
CloseHandle.KERNEL32(00000000), ref: 00F70385
GetLastError.KERNEL32 ref: 00F703B7
__dosmaperr.LIBCMT ref: 00F703BE

Strings

H, xrefs: 00F70343

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: ec0f8fc3f7328db5d7ab869c5c176bf94291c15dbab52f83c71a66230b6747d0
Instruction ID: fec53c5fcb43adab32424c1c28c629c2ebbbb9ddec85d374f51a43a38d767964
Opcode Fuzzy Hash: ec0f8fc3f7328db5d7ab869c5c176bf94291c15dbab52f83c71a66230b6747d0
Instruction Fuzzy Hash: CAA11832E041498FCF19DF68DC96BAD3BB1AF06324F14415AF815EB292DB359C12EB52

Function 00EEE380 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 271COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEE4A1

Part of subcall function 00EEDE80: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEDF0C

__Mtx_unlock.LIBCPMT ref: 00EEE3DE

Part of subcall function 00EEE0D0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEE161

__Mtx_unlock.LIBCPMT ref: 00EEE4FB
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEE665
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEE6F8

Part of subcall function 00ED9BB0: InitOnceBeginInitialize.KERNEL32(00FC80C4,00000000,87CF6CF3,00000000,87CF6CF3,00EDA219,00FC80CC,?,?,?,?,?,?,00EDA219,?,?), ref: 00ED9BE5
Part of subcall function 00ED9BB0: InitOnceComplete.KERNEL32(00FC80C4,00000000,00000000), ref: 00ED9C1D

Part of subcall function 00ED9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00ED9A12

Strings

], xrefs: 00EEE605
SOFTWARE\McAfee\WebAdvisor, xrefs: 00EEE57E
AdhocTelemetryAzure, xrefs: 00EEE5B3
Event string is empty, xrefs: 00EEE477
Querying AdhocTelemetryAzure value failed: , xrefs: 00EEE614

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$InitMtx_unlockOnce$BeginCompleteInitialize
String ID: AdhocTelemetryAzure$Event string is empty$Querying AdhocTelemetryAzure value failed: $SOFTWARE\McAfee\WebAdvisor$]
API String ID: 1670716954-2879113573
Opcode ID: 71000dad69ee058714a6f7992d1cc7d425d037bed084d6bfd2372ab6e3993d07
Instruction ID: deaac75caf6f64906e383c3a929e7c912e1d298fc5b381cd19761ab1640f5f8f
Opcode Fuzzy Hash: 71000dad69ee058714a6f7992d1cc7d425d037bed084d6bfd2372ab6e3993d07
Instruction Fuzzy Hash: D491D07190025C9BDB14EF60DC42BEEB3B8EF55314F0041AAE909B7381EB746B49DAA1

Function 00EF5A23 Relevance: 17.8, APIs: 3, Strings: 7, Instructions: 265COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00EF6085
SysFreeString.OLEAUT32 ref: 00EF610F
SysFreeString.OLEAUT32(00000000), ref: 00EF615A

Strings

orm, xrefs: 00EF5FDD
UUID, xrefs: 00EF5C84
), xrefs: 00EF6016
IsWow64Process, xrefs: 00EF5F95
UUID, xrefs: 00EF5AC8
kernel32, xrefs: 00EF5F82
NO_REGKEY, xrefs: 00EF5CDE

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: FreeString$Concurrency::cancel_current_task
String ID: )$IsWow64Process$NO_REGKEY$UUID$UUID$kernel32$orm
API String ID: 2663709405-3766208032
Opcode ID: 863d08d554d7a8458c07090cd03d6dea5fc2cb814fcd0e2b2662b3e34e08d3a7
Instruction ID: b19a526baeeb92e63849a3b7288be818260e58f9d48b9cb503a9e1f653b4e5f8
Opcode Fuzzy Hash: 863d08d554d7a8458c07090cd03d6dea5fc2cb814fcd0e2b2662b3e34e08d3a7
Instruction Fuzzy Hash: B2B1D2B1A0074C9BEF14DFA4C9887ADBBB2AF56304F24425CE504BB392DB749A85CB51

Function 00F35822 Relevance: 16.7, APIs: 11, Instructions: 183COMMON

Download Yara Rule

APIs

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F35853
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F35866
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F358AB
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F358DF
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F35933
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F35946
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F35963
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F35980
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F359BD
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F359D0
std::locale::_Locimp::_Makeushloc.LIBCPMT ref: 00F359F8

Part of subcall function 00EFC930: __Getctype.LIBCPMT ref: 00EFC948

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Locimp::_std::locale::_$AddfacLocimp_$Lockitstd::_$GetctypeLockit::_Lockit::~_Makeushloc
String ID:
API String ID: 1462480416-0
Opcode ID: a91b19a643c8e8915aaa915e0c7c50fe755a5ad69cdbb454b1cf29f04f811675
Instruction ID: 10c3b384fa6319ab2e095c691479805b3ae4db42bb2962f2a6a1c28b26722ebd
Opcode Fuzzy Hash: a91b19a643c8e8915aaa915e0c7c50fe755a5ad69cdbb454b1cf29f04f811675
Instruction Fuzzy Hash: E951C5B1D01605AAEB117B658C46F7F3AA8DF91B70F54441DF904A7282EF388901B2B2

Function 00EECE00 Relevance: 14.5, APIs: 2, Strings: 6, Instructions: 545COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 00EED1E6

Part of subcall function 00EDBBB0: std::locale::_Init.LIBCPMT ref: 00EDBBFC

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EED6C4

Strings

Content-Type: application/atom+xml;type=entry;charset=utf-8, xrefs: 00EECF5D
.servicebus.windows.net/, xrefs: 00EED348
AWS m_url_aws = , xrefs: 00EED675
/messages?timeout=60&api-version=2014-01, xrefs: 00EED368
https://, xrefs: 00EED334
u, xrefs: 00EED666

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: InitIos_base_dtorMtx_init_in_situstd::ios_base::_std::locale::_
String ID: .servicebus.windows.net/$/messages?timeout=60&api-version=2014-01$AWS m_url_aws = $Content-Type: application/atom+xml;type=entry;charset=utf-8$https://$u
API String ID: 655687434-3999228595
Opcode ID: d354710f114eab535adfc69dcb3f7749525c6fcdbada694143f4623fd19dda82
Instruction ID: 1668625b8af2dc5496e1ee25e1f3bfeb1f1eeff7b69f2dc9c418d9cdff5375de
Opcode Fuzzy Hash: d354710f114eab535adfc69dcb3f7749525c6fcdbada694143f4623fd19dda82
Instruction Fuzzy Hash: CF429FB0904789CFEB14CF28DD45BA9BBB0FF55308F109699D448AB692E774AAC4CF50

Function 00EE3D80 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 188COMMON

Download Yara Rule

APIs

WTSGetActiveConsoleSessionId.KERNEL32(0000003C,?), ref: 00EE3E00
OutputDebugStringW.KERNEL32(WTSQuerySessionInformation failed to retrieve current user name for the log name.), ref: 00EE3F9C
Concurrency::cancel_current_task.LIBCPMT ref: 00EE3FCA

Strings

WTSQuerySessionInformation failed to retrieve current user name for the log name., xrefs: 00EE3F97
WTSQuerySessionInformation failed to retrieve the size of the current user name for the log name., xrefs: 00EE3F81
UNKNOWN, xrefs: 00EE3DD2
Error retrieving session id for generating log name., xrefs: 00EE3E0B

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ActiveConcurrency::cancel_current_taskConsoleDebugOutputSessionString
String ID: Error retrieving session id for generating log name.$UNKNOWN$WTSQuerySessionInformation failed to retrieve current user name for the log name.$WTSQuerySessionInformation failed to retrieve the size of the current user name for the log name.
API String ID: 1186403813-1860316991
Opcode ID: 6f51d67ea5f33ab6baa7440e049c8ba8fc139f4e822f5e93293ddcf0547bd623
Instruction ID: 3c53e25facdb104a2fa7ac64feadfad0edd4b9522a558737eeee57d56fa84233
Opcode Fuzzy Hash: 6f51d67ea5f33ab6baa7440e049c8ba8fc139f4e822f5e93293ddcf0547bd623
Instruction Fuzzy Hash: D251C271E003499BCB149FB5DC89BEEBBB4FF44314F201629E826E7290E7749A40DB91

Function 00F49900 Relevance: 13.7, APIs: 9, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00EF4AA5,00EF4AA7,00000000,00000000,87CF6CF3,?,00000000,?,00F4BE00,00FBBF08,000000FE,?,00EF4AA5,?), ref: 00F49989
MultiByteToWideChar.KERNEL32(00000000,00000000,00EF4AA5,?,00000000,00000000,?,00F4BE00,00FBBF08,000000FE,?,00EF4AA5), ref: 00F49A04
SysAllocString.OLEAUT32(00000000), ref: 00F49A0F
_com_issue_error.COMSUPP ref: 00F49A38
_com_issue_error.COMSUPP ref: 00F49A42
GetLastError.KERNEL32(80070057,87CF6CF3,?,00000000,?,00F4BE00,00FBBF08,000000FE,?,00EF4AA5,?), ref: 00F49A47
_com_issue_error.COMSUPP ref: 00F49A5A
GetLastError.KERNEL32(00000000,?,00000000,?,00F4BE00,00FBBF08,000000FE,?,00EF4AA5,?), ref: 00F49A70
_com_issue_error.COMSUPP ref: 00F49A83

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: _com_issue_error$ByteCharErrorLastMultiWide$AllocString
String ID:
API String ID: 1353541977-0
Opcode ID: 1af749b01315423483f0932398a3175e93497ddac32d2668e27b7b03490f8ef0
Instruction ID: a9bc29cc3da7ce0dd5a4a8a35bda36d2b32c0e65d7b5f162b3be38822ad6b550
Opcode Fuzzy Hash: 1af749b01315423483f0932398a3175e93497ddac32d2668e27b7b03490f8ef0
Instruction Fuzzy Hash: EB41C871B04209AFDB10DF69DC45BAFBFA8AB49760F10422EFD05E7281D7789800E7A5

Function 00ED9C50 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 313COMMON

Download Yara Rule

APIs

Part of subcall function 00EDE310: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA),00000001,00000000,00000000), ref: 00EDE36C

__Mtx_init_in_situ.LIBCPMT ref: 00ED9DD4
Concurrency::cancel_current_task.LIBCPMT ref: 00EDA06D

Strings

SOFTWARE\McAfee\WebAdvisor, xrefs: 00ED9CF1, 00ED9D51, 00ED9F83
LogLevel, xrefs: 00ED9FA8
LogRotationFileSize, xrefs: 00ED9D16
LogRotationCount, xrefs: 00ED9D76
log, xrefs: 00ED9D8E

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: DescriptorSecurity$Concurrency::cancel_current_taskConvertMtx_init_in_situString
String ID: LogLevel$LogRotationCount$LogRotationFileSize$SOFTWARE\McAfee\WebAdvisor$log
API String ID: 239504998-2017128786
Opcode ID: ed9e8fd3b7805e82165a3c5a1a4187b290ff1705026821326fc3d06f433ed9ec
Instruction ID: 87d73f54210d85cb9281f83fa1e0051a1833d6570b47c1565894757d3b8a512f
Opcode Fuzzy Hash: ed9e8fd3b7805e82165a3c5a1a4187b290ff1705026821326fc3d06f433ed9ec
Instruction Fuzzy Hash: 7FC19B71D002499FDB04DFA4C945BEEBBF1EF49304F24812AE805BB391EB75AA45CB91

Function 00EE6D24 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 166COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 00EE6D7B
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EE6F75
__Mtx_unlock.LIBCPMT ref: 00EE6F88

Strings

Failed to initialize , xrefs: 00EE6F1C
=, xrefs: 00EE6F10
event sender, xrefs: 00EE6EB0, 00EE6F4E
async, xrefs: 00EE6E9A, 00EE6F38

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorMtx_init_in_situMtx_unlockstd::ios_base::_
String ID: event sender$=$Failed to initialize $async
API String ID: 3676452600-816272291
Opcode ID: ab5113897380776e6894236f882e36e518365321449069d36d31ea762d010187
Instruction ID: 6156e1aa04e618c39ada1a2011bb42dce59e382240aa3ba8d4cf9cb98520bdeb
Opcode Fuzzy Hash: ab5113897380776e6894236f882e36e518365321449069d36d31ea762d010187
Instruction Fuzzy Hash: D861AEB0A00349CFDB04DFA0C855BAEBBF5AF55304F5050AAD805BB392DB759A48DBA1

Function 00EE928D Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 130COMMON

Download Yara Rule

APIs

Part of subcall function 00EE8FB0: CoCreateGuid.OLE32(?), ref: 00EE8FC8
Part of subcall function 00EE8FB0: StringFromCLSID.OLE32(?,?), ref: 00EE8FE0
Part of subcall function 00EE8FB0: CoTaskMemFree.OLE32(?), ref: 00EE9138

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EE93D1

Part of subcall function 00ED9BB0: InitOnceBeginInitialize.KERNEL32(00FC80C4,00000000,87CF6CF3,00000000,87CF6CF3,00EDA219,00FC80CC,?,?,?,?,?,?,00EDA219,?,?), ref: 00ED9BE5
Part of subcall function 00ED9BB0: InitOnceComplete.KERNEL32(00FC80C4,00000000,00000000), ref: 00ED9C1D

Part of subcall function 00ED9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00ED9A12

Strings

Could not set registry value , xrefs: 00EE9338
InstallerFlags, xrefs: 00EE9368
Could not set registry value InstallerFlags, xrefs: 00EE93AA
Failed to create new UUID, xrefs: 00EE92C8
], xrefs: 00EE939E
UUID, xrefs: 00EE92F6

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: InitIos_base_dtorOncestd::ios_base::_$BeginCompleteCreateFreeFromGuidInitializeStringTask
String ID: Could not set registry value $Could not set registry value InstallerFlags$Failed to create new UUID$InstallerFlags$UUID$]
API String ID: 598746661-2174109026
Opcode ID: 840ec919bc28f44e8e6796e60111e0086f275a648d6e9bfd055a6bdba255e160
Instruction ID: 01d047974dd83ee13debcdff2e98734d3c7d0c4b1f14980492a341b1261650f3
Opcode Fuzzy Hash: 840ec919bc28f44e8e6796e60111e0086f275a648d6e9bfd055a6bdba255e160
Instruction Fuzzy Hash: 5051B070A00288EEDF14EF60D851BED77F4EF55304F50905AE84977282EB74AA49DBA1

Function 00EE5790 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,NotComDllGetInterface), ref: 00EE5808
FreeLibrary.KERNEL32(?), ref: 00EE5828
GetLastError.KERNEL32 ref: 00EE5830
FreeLibrary.KERNEL32(?), ref: 00EE5839

Strings

NotComDllGetInterface, xrefs: 00EE5802
mfeaaca.dll, xrefs: 00EE57A9, 00EE57B0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: FreeLibrary$AddressErrorLastProc
String ID: NotComDllGetInterface$mfeaaca.dll
API String ID: 1092183831-2777911605
Opcode ID: 806d46cb13198a2592e2d7b1133fde99763be6bce492c15fc0fa48471976a90c
Instruction ID: 2a60302af0fe1327ac06e9b63518e67c7fdbd21cb0ebd8a4d3054801e6280c72
Opcode Fuzzy Hash: 806d46cb13198a2592e2d7b1133fde99763be6bce492c15fc0fa48471976a90c
Instruction Fuzzy Hash: 3921A173D00A1D9BDB159BA9D8496BEBBB8FF56758F44016AEC01F7240EB708D009BD1

Function 00ED4D63 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 55synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00ED4C8E: GetCurrentProcessId.KERNEL32 ref: 00ED4CA6
Part of subcall function 00ED4C8E: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00ED4CB8
Part of subcall function 00ED4C8E: Process32FirstW.KERNEL32(00000000,?), ref: 00ED4CD3
Part of subcall function 00ED4C8E: Process32NextW.KERNEL32(00000000,0000022C), ref: 00ED4CE9
Part of subcall function 00ED4C8E: FindCloseChangeNotification.KERNEL32(00000000), ref: 00ED4CFA

CreateMutexW.KERNEL32(00000000,00000000,Global\{48ca68e-e4ff-43ac-a993-6d162f33de7c}), ref: 00ED4D88
GetLastError.KERNEL32 ref: 00ED4DD0

Part of subcall function 00ED136C: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00ED13A5

WaitForSingleObject.KERNEL32(00000000,0000EA60), ref: 00ED4DFC
CloseHandle.KERNEL32 ref: 00ED4E0D

Part of subcall function 00ED9BB0: InitOnceBeginInitialize.KERNEL32(00FC80C4,00000000,87CF6CF3,00000000,87CF6CF3,00EDA219,00FC80CC,?,?,?,?,?,?,00EDA219,?,?), ref: 00ED9BE5
Part of subcall function 00ED9BB0: InitOnceComplete.KERNEL32(00FC80C4,00000000,00000000), ref: 00ED9C1D

Part of subcall function 00ED9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00ED9A12

Strings

Global\{48ca68e-e4ff-43ac-a993-6d162f33de7c}, xrefs: 00ED4D7F
SaBsi.cpp, xrefs: 00ED4DA9
CreateMutex failed: , xrefs: 00ED4DC2

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: CloseCreateInitIos_base_dtorOnceProcess32std::ios_base::_$BeginChangeCompleteCurrentErrorFindFirstHandleInitializeLastMutexNextNotificationObjectProcessSingleSnapshotToolhelp32Wait
String ID: CreateMutex failed: $Global\{48ca68e-e4ff-43ac-a993-6d162f33de7c}$SaBsi.cpp
API String ID: 2189495138-1117126455
Opcode ID: 111463196b886f6b0a2e2db53fe8996edea59374563282cd5bb434da6954bbcd
Instruction ID: 9940e89274e34aa7e1ade436d1242343b5a56c6a8555fba12118a11bec194d0a
Opcode Fuzzy Hash: 111463196b886f6b0a2e2db53fe8996edea59374563282cd5bb434da6954bbcd
Instruction Fuzzy Hash: 471191B1214342ABD720EF20D809BAA77E4FF61744F005D1EB8D5672D2EB709449DB67

Function 00F1C600 Relevance: 12.2, APIs: 8, Instructions: 240COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 00F1C641

Part of subcall function 00F33084: __EH_prolog3.LIBCMT ref: 00F3308B
Part of subcall function 00F33084: std::_Lockit::_Lockit.LIBCPMT ref: 00F33096
Part of subcall function 00F33084: std::locale::_Setgloballocale.LIBCPMT ref: 00F330B1
Part of subcall function 00F33084: std::_Lockit::~_Lockit.LIBCPMT ref: 00F33107

std::_Lockit::_Lockit.LIBCPMT ref: 00F1C6CB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00F1C713
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00F1C748
std::_Lockit::~_Lockit.LIBCPMT ref: 00F1C7DD

Part of subcall function 00F4E960: _free.LIBCMT ref: 00F4E973

std::_Lockit::_Lockit.LIBCPMT ref: 00F1C82B
std::_Lockit::~_Lockit.LIBCPMT ref: 00F1C84C
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F1C85B

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_std::locale::_$Locinfo::_$AddfacH_prolog3InitLocimp::_Locimp_Locinfo_ctorLocinfo_dtorSetgloballocale_free
String ID:
API String ID: 3887427400-0
Opcode ID: 1c1cf7052c55467b312e934bd3c9fcc321fb42d9cca7c845a999faf87c49fb0e
Instruction ID: f9be1837ce6c9bd0e286d354d6690100e5ff37af8ceb481b6bfaed776d414cba
Opcode Fuzzy Hash: 1c1cf7052c55467b312e934bd3c9fcc321fb42d9cca7c845a999faf87c49fb0e
Instruction Fuzzy Hash: B6A1AFB0D003489FEB10DFA9D985B9EBBF4BF04314F144519E805A7382EB79EA44EB91

Function 00EEEEC0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00EECCB0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EECDBB

Concurrency::cancel_current_task.LIBCPMT ref: 00EEF0FC
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEF268
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEF307

Strings

AdhocTelemetryAWS, xrefs: 00EEF1B6
SOFTWARE\McAfee\WebAdvisor, xrefs: 00EEF181
Querying AdhocTelemetryAWS value failed: , xrefs: 00EEF217

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$Concurrency::cancel_current_task
String ID: AdhocTelemetryAWS$Querying AdhocTelemetryAWS value failed: $SOFTWARE\McAfee\WebAdvisor
API String ID: 1722207485-3297656441
Opcode ID: 9c631b82b048650fa49774f9e351b750d589e5e09d7dac6976feaab0a800d2c7
Instruction ID: 6ae7d97b9f37571775b4ebbff7ac79e663e45058d0611339d748deadd423ff6b
Opcode Fuzzy Hash: 9c631b82b048650fa49774f9e351b750d589e5e09d7dac6976feaab0a800d2c7
Instruction Fuzzy Hash: 2BC1D1B0D0025C9BDB14DF64CC45BEEBBB4EF45314F1042AAE415B7382EB74AA45CB92

Function 00EEE0D0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 171COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEE161
GetLastError.KERNEL32(?,00000001), ref: 00EEE278
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEE351

Part of subcall function 00ED9BB0: InitOnceBeginInitialize.KERNEL32(00FC80C4,00000000,87CF6CF3,00000000,87CF6CF3,00EDA219,00FC80CC,?,?,?,?,?,?,00EDA219,?,?), ref: 00ED9BE5
Part of subcall function 00ED9BB0: InitOnceComplete.KERNEL32(00FC80C4,00000000,00000000), ref: 00ED9C1D

Part of subcall function 00ED9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00ED9A12

Strings

WinHttpCrackUrl failed for AWS: , xrefs: 00EEE268
Event Sender already initialized for AWS, xrefs: 00EEE137
Unable to open HTTP session for AWS, xrefs: 00EEE327

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$InitOnce$BeginCompleteErrorInitializeLast
String ID: Event Sender already initialized for AWS$Unable to open HTTP session for AWS$WinHttpCrackUrl failed for AWS:
API String ID: 2211357200-794796586
Opcode ID: 28c0ab0a337e5a9a533776596d740f54cfd48c8adadaaf66ac742579c2be74d5
Instruction ID: 02dcbdebf72794f893a7953c41748a6c82ffdb4871298f7ffa2a494f2ff7b396
Opcode Fuzzy Hash: 28c0ab0a337e5a9a533776596d740f54cfd48c8adadaaf66ac742579c2be74d5
Instruction Fuzzy Hash: F061AB70900B489ADB24DFA0DC55BEAB3F9FB44305F0005AEE519A7391EBB06A48CF91

Function 00EEDE80 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 147COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEDF0C
GetLastError.KERNEL32(?,00000001), ref: 00EEDFD7
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEE0A2

Part of subcall function 00ED9BB0: InitOnceBeginInitialize.KERNEL32(00FC80C4,00000000,87CF6CF3,00000000,87CF6CF3,00EDA219,00FC80CC,?,?,?,?,?,?,00EDA219,?,?), ref: 00ED9BE5
Part of subcall function 00ED9BB0: InitOnceComplete.KERNEL32(00FC80C4,00000000,00000000), ref: 00ED9C1D

Part of subcall function 00ED9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00ED9A12

Strings

Event Sender already initialized for Azure, xrefs: 00EEDEE2
Unable to open HTTP session for Azure, xrefs: 00EEE078
WinHttpCrackUrl failed for Azure: , xrefs: 00EEDFC7

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$InitOnce$BeginCompleteErrorInitializeLast
String ID: Event Sender already initialized for Azure$Unable to open HTTP session for Azure$WinHttpCrackUrl failed for Azure:
API String ID: 2211357200-3864554942
Opcode ID: b73e8860e46be3411731776345520df174aabfe54507ac239e5c871badda5f4d
Instruction ID: 3a31ce0accb8af7db61590068e908236cabb234c2e9139ca60a61e485ea00446
Opcode Fuzzy Hash: b73e8860e46be3411731776345520df174aabfe54507ac239e5c871badda5f4d
Instruction Fuzzy Hash: AD515A709047589EDB24DF60CC59BEEB7F8FB04304F00459EE44AA7391EBB4AA48CB95

Function 00ED5A4F Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 81COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00ED5A59

Part of subcall function 00ED5C1E: CoCreateInstance.OLE32(00F9D808,00000000,00000017,00FAB024,00000000,87CF6CF3,?,?,?,00000000,00000000,00000000,00F78687,000000FF), ref: 00ED5C7A
Part of subcall function 00ED5C1E: OleRun.OLE32(00000000), ref: 00ED5C89

Part of subcall function 00ED9BB0: InitOnceBeginInitialize.KERNEL32(00FC80C4,00000000,87CF6CF3,00000000,87CF6CF3,00EDA219,00FC80CC,?,?,?,?,?,?,00EDA219,?,?), ref: 00ED9BE5
Part of subcall function 00ED9BB0: InitOnceComplete.KERNEL32(00FC80C4,00000000,00000000), ref: 00ED9C1D

Part of subcall function 00ED9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00ED9A12

_com_issue_error.COMSUPP ref: 00ED5B97

Strings

Activation option is set successfuly, xrefs: 00ED5B69
Failed to set new option. Error , xrefs: 00ED5B26
i, xrefs: 00ED5B5D
Failed to create Global Options object. Error , xrefs: 00ED5AA9

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: InitOnce$BeginCompleteCreateH_prolog3_InitializeInstanceIos_base_dtor_com_issue_errorstd::ios_base::_
String ID: Activation option is set successfuly$Failed to create Global Options object. Error $Failed to set new option. Error $i
API String ID: 1362393928-3233122435
Opcode ID: 5ef671cf0b15122d0493e43916313c664e4493cd4df841192941dd7c54eeb942
Instruction ID: c088e5d170acb07835416e672bec6176a9b6cf435118999d62cab81361733a00
Opcode Fuzzy Hash: 5ef671cf0b15122d0493e43916313c664e4493cd4df841192941dd7c54eeb942
Instruction Fuzzy Hash: EE314770A10219DADF04EBA4CC62BEDB3B4EF54304F40559AE505B7282EB745A0ACFA2

Function 00F522D9 Relevance: 9.3, APIs: 6, Instructions: 264COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00F52461
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F5247D
__allrem.LIBCMT ref: 00F52494
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F524B2
__allrem.LIBCMT ref: 00F524C9
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F524E7

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: f87d5442f0ebf9ebcbd6879315b9098c2ef1ccdfcdcf202bff3e40a4258d3857
Instruction ID: 160b89006c177ff00cdd78d22ddee9eef2915cc0d212735ce62f82e8fcab8a21
Opcode Fuzzy Hash: f87d5442f0ebf9ebcbd6879315b9098c2ef1ccdfcdcf202bff3e40a4258d3857
Instruction Fuzzy Hash: C881F972B00B019BE724EE28CC81B5AB7E5AF42731F14432AFE55D62C1E778D909A790

Function 00EE07C0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 00EE085F
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA),00000001,?,00000000), ref: 00EE0903
LocalFree.KERNEL32(?,?), ref: 00EE0A26
__Mtx_unlock.LIBCPMT ref: 00EE1020

Strings

D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA), xrefs: 00EE08FE

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: DescriptorSecurity$ConvertFreeLocalMtx_destroy_in_situMtx_unlockString
String ID: D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)
API String ID: 4147401711-3078421892
Opcode ID: ed542b4da8e420d6737384d73e7568dededb10b397cdc30db3c7653a07fa3ff7
Instruction ID: 4ac63ea366f02543d11874a73a5dd14a2e4727102fbc2d1e8f9be8691063e504
Opcode Fuzzy Hash: ed542b4da8e420d6737384d73e7568dededb10b397cdc30db3c7653a07fa3ff7
Instruction Fuzzy Hash: 1E6116719002988FDB18DF64CC85BEEBBB5EF44304F0441ADE849A7791D778AAC4CB94

Function 00F0E580 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 131COMMON

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 00F0E6B0

Strings

c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\XMLParser.cpp, xrefs: 00F0E5AF, 00F0E6C8
invalid input, xrefs: 00F0E5A3
Unable to convert XML buffer into wide characters, xrefs: 00F0E6BC
NWebAdvisor::XMLParser::ParseBuffer, xrefs: 00F0E5AA, 00F0E6C3

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: __cftoe
String ID: NWebAdvisor::XMLParser::ParseBuffer$Unable to convert XML buffer into wide characters$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\XMLParser.cpp$invalid input
API String ID: 4189289331-3914853187
Opcode ID: b6a203b97227d7e919ed30c291c07967fbf47a14ce4c22f3d20fc287fd869616
Instruction ID: ccfb295a4d2f313883122158f648b319afaa8a8b1624047a1db9d07da47d7a71
Opcode Fuzzy Hash: b6a203b97227d7e919ed30c291c07967fbf47a14ce4c22f3d20fc287fd869616
Instruction Fuzzy Hash: 7E41E5B1A01304ABDB24EF54DC42B6FFBA4BF24710F41452DE84AA73C1DB75A905A791

Function 00ED7F60 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

__Xtime_get_ticks.LIBCPMT ref: 00ED7FAA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00ED7FBC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00ED7FD0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00ED7FE2

Strings

[%Y%m%d %H:%M:%S., xrefs: 00ED800C, 00ED8019

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$Xtime_get_ticks
String ID: [%Y%m%d %H:%M:%S.
API String ID: 3638035285-2843400524
Opcode ID: 1c077547466ad4d736b692d45249f17795c17118d02685cfed9aab602c03f439
Instruction ID: 5b00baf18bdcb4e12c851b251d0ea239203697f778295625ed859f1d66ae4a47
Opcode Fuzzy Hash: 1c077547466ad4d736b692d45249f17795c17118d02685cfed9aab602c03f439
Instruction Fuzzy Hash: 2C316071E40214AFDB10EFA4CD46FAEBBF8EB45750F10412AF508BB381DB78A9058B95

Function 00EECCB0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00ED9BB0: InitOnceBeginInitialize.KERNEL32(00FC80C4,00000000,87CF6CF3,00000000,87CF6CF3,00EDA219,00FC80CC,?,?,?,?,?,?,00EDA219,?,?), ref: 00ED9BE5
Part of subcall function 00ED9BB0: InitOnceComplete.KERNEL32(00FC80C4,00000000,00000000), ref: 00ED9C1D

Part of subcall function 00ED9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00ED9A12

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EECDBB

Strings

AdhocAWSQAMode, xrefs: 00EECD24
SOFTWARE\McAfee\WebAdvisor, xrefs: 00EECCF8
Querying AdhocAWSQAMode value failed: , xrefs: 00EECD76
5, xrefs: 00EECD6A

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: InitIos_base_dtorOncestd::ios_base::_$BeginCompleteInitialize
String ID: 5$AdhocAWSQAMode$Querying AdhocAWSQAMode value failed: $SOFTWARE\McAfee\WebAdvisor
API String ID: 539357862-4010608570
Opcode ID: a364f4059e29746a5faeb86449a0dd9f8a03e7d7c801eb056eea62b1bf3b17d0
Instruction ID: 519f58ac423207531d09b98f5483c4cfc1b624d07b66e1fd980a6afaebfc3a76
Opcode Fuzzy Hash: a364f4059e29746a5faeb86449a0dd9f8a03e7d7c801eb056eea62b1bf3b17d0
Instruction Fuzzy Hash: B1319E7191025C9ADF14EFA0CC52BEDBBF8FF48304F60556AE506B3282EB745A09DB61

Function 00EF4B40 Relevance: 7.6, APIs: 2, Strings: 2, Instructions: 562COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00EF5182
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EF521E

Strings

Invalid arguements passed to AddDimension, xrefs: 00EF51F7
N, xrefs: 00EF51EB

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Concurrency::cancel_current_taskIos_base_dtorstd::ios_base::_
String ID: Invalid arguements passed to AddDimension$N
API String ID: 4106036149-286115907
Opcode ID: f4ccb17d0005d0b1d7a6bd448e98d3ec84d01cd4a711fd1d673e4725f59ac916
Instruction ID: 199a98651bd8427e068b3b2f2ce7ce1e91a28bdd473c653de1fd8694ac760a71
Opcode Fuzzy Hash: f4ccb17d0005d0b1d7a6bd448e98d3ec84d01cd4a711fd1d673e4725f59ac916
Instruction Fuzzy Hash: 6632EEB1D003489FEB24CF64C844BAEBBF1FF45304F149299E549AB392DB75A985CB81

Function 00F74DB0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 352COMMON

Download Yara Rule

Strings

\\?\, xrefs: 00F74F61, 00F753C0, 00F755DE
%s\%s, xrefs: 00F74FEC, 00F7507D
%s%s, xrefs: 00F75044

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID:
String ID: %s%s$%s\%s$\\?\
API String ID: 0-2843747179
Opcode ID: 72d8bdcccc7b0e3a494c40202865756365a5f6df7dfab467b68c8017d3fcbb52
Instruction ID: d12c6c553a0df3600e8934dcac0ee3c352200f8a41b87e13e396f771e9e20b21
Opcode Fuzzy Hash: 72d8bdcccc7b0e3a494c40202865756365a5f6df7dfab467b68c8017d3fcbb52
Instruction Fuzzy Hash: 0DD18F72D00218DBDF10DFA4CC85AEEB7F8EF05320F54452AE819B7291E774AA05DB92

Function 00F139A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 133registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\WATesting,00000000,00000001,?,87CF6CF3,00000000,00000001), ref: 00F139FC

Part of subcall function 00F12820: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000,87CF6CF3,00000000,00000001,?), ref: 00F128AC

Strings

path, xrefs: 00F13A22
SOFTWARE\WATesting, xrefs: 00F139EB

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: InfoOpenQuery
String ID: SOFTWARE\WATesting$path
API String ID: 165108877-1550987622
Opcode ID: ac015e81d897d82e742b328a66cfa98b2425480c356ef005d710632b3777dbee
Instruction ID: a318d3309c2638166d5fc0a357f03e507638e4b2c1f6fb222101ebbf61601eb3
Opcode Fuzzy Hash: ac015e81d897d82e742b328a66cfa98b2425480c356ef005d710632b3777dbee
Instruction Fuzzy Hash: C0515D71D0025CABDB20DBA4DD45BDEBBF8EF58714F100199E509B7281DB74AA88CBA1

Function 00F0FBE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 80COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00FABFD0,00000000,00FABFD0,00000000,?,0000001C,00000001,00000000,0000001C,?,?,00000014,00FABFD0,00000000,87CF6CF3), ref: 00F0FC1D

Strings

NWebAdvisor::NHttp::NDownloadFile::StoreOnDisk, xrefs: 00F0FC99
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpsDownloadFile.cpp, xrefs: 00F0FC9E
Destination directory does not exist, xrefs: 00F0FC8F

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AttributesFile
String ID: Destination directory does not exist$NWebAdvisor::NHttp::NDownloadFile::StoreOnDisk$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpsDownloadFile.cpp
API String ID: 3188754299-3555079292
Opcode ID: 530d9e86ca9312314e1ce94fdd0b8293cbeccfc1e12d34d19f8504ecd42fec44
Instruction ID: 2418c605d037be4be152f0f4ef26517bfcd164f896c53778d6cb72b715e67893
Opcode Fuzzy Hash: 530d9e86ca9312314e1ce94fdd0b8293cbeccfc1e12d34d19f8504ecd42fec44
Instruction Fuzzy Hash: D2215E71E0021C9BDF10DFA8D842AEEB7F4EB48714F11426AFC15B3281DB749A46EB91

Function 00EDDC20 Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 553COMMON

Download Yara Rule

Strings

D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA), xrefs: 00EDE367

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID:
String ID: D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)
API String ID: 0-3078421892
Opcode ID: 381a6694818423af32fa536fc32ffa81527e256a5a22e1fcc2f669d40d833124
Instruction ID: d5ab6d10325529a6f18afce5dbfdfb7994131c577a4ec97e0bd5991e86be934a
Opcode Fuzzy Hash: 381a6694818423af32fa536fc32ffa81527e256a5a22e1fcc2f669d40d833124
Instruction Fuzzy Hash: 00220971A00208DBDB14DF64DD89BEDBBB6FF44304F10865ED409AB791DB74AA85CB90

Function 00F08650 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 337COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 00F0882F

Strings

Failed to create log message string. Error 0x, xrefs: 00F089CF
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\XmlUpdaterLogger.cpp, xrefs: 00F08AF6

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Initstd::locale::_
String ID: Failed to create log message string. Error 0x$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\XmlUpdaterLogger.cpp
API String ID: 1620887387-1553574442
Opcode ID: 7b61bf813f7f9e1bb404dd630e22b49a70efe9842f008c125c8eec5231b380a0
Instruction ID: e4837712739c8d4c4bd2e6453a2ab7487ff6de49ab7678ff50a0c126804bfc4e
Opcode Fuzzy Hash: 7b61bf813f7f9e1bb404dd630e22b49a70efe9842f008c125c8eec5231b380a0
Instruction Fuzzy Hash: 67E15B71E00259DFEF24CF58CC85B9DBBB1BF48300F10819AE949A7281DB75AA85DF50

Function 00EDE310 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA),00000001,00000000,00000000), ref: 00EDE36C

Strings

D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA), xrefs: 00EDE367

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID: D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA)
API String ID: 3907675253-3078421892
Opcode ID: 4840f6874c5ea3acee0cf83f6c993e26df9be0ba8798c2ccf998478d6666f948
Instruction ID: b320b12efaad0f114e87032167e7e7add488d208d88a4c9b9c415fbdabe78b91
Opcode Fuzzy Hash: 4840f6874c5ea3acee0cf83f6c993e26df9be0ba8798c2ccf998478d6666f948
Instruction Fuzzy Hash: 2481B4309012599BDB24DF24DD8CB9DB7B1EF85308F1046DAE418AB391E779AB85CF50

Function 00EFCC20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 00ED9BB0: InitOnceBeginInitialize.KERNEL32(00FC80C4,00000000,87CF6CF3,00000000,87CF6CF3,00EDA219,00FC80CC,?,?,?,?,?,?,00EDA219,?,?), ref: 00ED9BE5
Part of subcall function 00ED9BB0: InitOnceComplete.KERNEL32(00FC80C4,00000000,00000000), ref: 00ED9C1D

Part of subcall function 00ED9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00ED9A12

GetLastError.KERNEL32(?,00000001), ref: 00EFCCBB
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EFCCEC

Strings

Unable to set proxy option, error: , xrefs: 00EFCCAB

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: InitIos_base_dtorOncestd::ios_base::_$BeginCompleteErrorInitializeLast
String ID: Unable to set proxy option, error:
API String ID: 879576418-14943890
Opcode ID: b76855cf8855b8acb9cd8176693fa352705aa8581521e34018e46eb3e75a7e15
Instruction ID: e3877a8a9a43762f6c25d79c8763b19dc4744da4ae480b6070ea9644b8cab872
Opcode Fuzzy Hash: b76855cf8855b8acb9cd8176693fa352705aa8581521e34018e46eb3e75a7e15
Instruction Fuzzy Hash: 3A318F71A0431DDFEB24DF60CC05BAEB7B9FB04710F10856EE809A3291EB716A04DB61

Function 00F65FD8 Relevance: 4.7, APIs: 3, Instructions: 177fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F6576D: GetConsoleCP.KERNEL32(?,00F0860A,00000000), ref: 00F657B5

WriteFile.KERNEL32(?,00000000,00FBC218,87CF6CF3,00000000,87CF6CF3,00F0860A,00F0860A,00F0860A,87CF6CF3,00000000,?,00F5591E,00000000,00FBC218,00000010), ref: 00F66129
GetLastError.KERNEL32(?,00F5591E,00000000,00FBC218,00000010,00F0860A), ref: 00F66133
__dosmaperr.LIBCMT ref: 00F66178

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ConsoleErrorFileLastWrite__dosmaperr
String ID:
API String ID: 251514795-0
Opcode ID: ed409bd33e335caf60e6658a526fffb9b7e9cdb0105cff898813052f324927df
Instruction ID: fd9ecc5af0d71ab474a7d45eddead63e8e21f57725b4afeee858ea06d6ba4fd5
Opcode Fuzzy Hash: ed409bd33e335caf60e6658a526fffb9b7e9cdb0105cff898813052f324927df
Instruction Fuzzy Hash: 1A519371D0020AAFDF11DFA4CC85BEEBBB9EF4A754F140055E800E7152D6759D41B761

Function 00EDE640 Relevance: 4.6, APIs: 3, Instructions: 120COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,87CF6CF3,0000005C,?,?,?,?,00000000,00F7952D,000000FF,?,00EDE09D), ref: 00EDE681
CreateDirectoryW.KERNEL32(00000000,?,?,?,?,?,00000000,00F7952D,000000FF,?,00EDE09D), ref: 00EDE738
GetLastError.KERNEL32(?,?,?,?,00000000,00F7952D,000000FF,?,00EDE09D), ref: 00EDE742

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AttributesCreateDirectoryErrorFileLast
String ID:
API String ID: 674977465-0
Opcode ID: 06e3e88bd6a49f45008d1a5295fa9201b6b8f384cc075b7b1866222baf47e8a4
Instruction ID: 4c6bbaa73bd5686210fa10b3bf696d15b002a2dd4f970dfff9b31abb91b80907
Opcode Fuzzy Hash: 06e3e88bd6a49f45008d1a5295fa9201b6b8f384cc075b7b1866222baf47e8a4
Instruction Fuzzy Hash: 71312631A002089BCB14DFA8ED88BAEF7B4FF45718F14462FE815A7780D735A906CB90

Function 00F31F70 Relevance: 4.6, APIs: 3, Instructions: 104encryptionCOMMON

Download Yara Rule

APIs

CertGetCertificateChain.CRYPT32(00000000,?,?,?), ref: 00F3206C
CertVerifyCertificateChainPolicy.CRYPT32(00000003,?,?,?), ref: 00F320A4
CertFreeCertificateChain.CRYPT32(?), ref: 00F320D0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: CertCertificateChain$FreePolicyVerify
String ID:
API String ID: 1741975133-0
Opcode ID: c19b4394a9309ea50e3b5229961e0c663f8f8f7b04556c8f0496419b08aac26b
Instruction ID: 8070e0c873962cabe6d4d787229707743878a3b5558bd15efd479c35e5b04ade
Opcode Fuzzy Hash: c19b4394a9309ea50e3b5229961e0c663f8f8f7b04556c8f0496419b08aac26b
Instruction Fuzzy Hash: 2541B0B15083849BD720CF54C884B9BBBF8FF89314F00091DF98897250E775D588DB62

Function 00F6A690 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00F6A699
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00F6A707

Part of subcall function 00F698FF: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,00F67B21,?,00000000,00000000), ref: 00F699A1

Part of subcall function 00F62174: RtlAllocateHeap.NTDLL(00000000,?,?,?,00F4872D,?,?,00EDA1ED,0000002C,87CF6CF3), ref: 00F621A6

_free.LIBCMT ref: 00F6A6F8

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: EnvironmentStrings$AllocateByteCharFreeHeapMultiWide_free
String ID:
API String ID: 2560199156-0
Opcode ID: d158cde382ab5df2a0a91159a51499b594d5506703967ba5a29ccb2b57382e3f
Instruction ID: 5daac9b8b040b3982c684f917e3eb9bfbf6415ca338d8ac56ece76973510f8a5
Opcode Fuzzy Hash: d158cde382ab5df2a0a91159a51499b594d5506703967ba5a29ccb2b57382e3f
Instruction Fuzzy Hash: 4E01F2B3A017197B672116BA5CC9D7B797DDFC7FA03180128F900E7201EAA58C02B6B2

Function 00F66B6C Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(00000000,00000000,00F0860A,?,00F66A9A,00F0860A,00FBC5B8,0000000C,00F66B4C,00FBC218), ref: 00F66BC2
GetLastError.KERNEL32(?,00F66A9A,00F0860A,00FBC5B8,0000000C,00F66B4C,00FBC218), ref: 00F66BCC
__dosmaperr.LIBCMT ref: 00F66BF7

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: d706bc96f76fdb57137b7f6a7e4cd9c28fc62643a8062f8449aadda33f4ceff4
Instruction ID: 1bd54f8205692bc9d1fe65282a2e9bd2abb86f4252a8843a0ae0ad2282a6365d
Opcode Fuzzy Hash: d706bc96f76fdb57137b7f6a7e4cd9c28fc62643a8062f8449aadda33f4ceff4
Instruction Fuzzy Hash: 0B012633E091649AC6256334AC4AB7E37899FD3734F25024DE819DB1C2DF358C80BA92

Function 00F668F6 Relevance: 4.5, APIs: 3, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,?,00000000,00F6F765,00000008,00000000,?,?,?,00F669A3,00000000,00000000,?,00F6F765), ref: 00F6692F
GetLastError.KERNEL32(?,?,?,00F669A3,00000000,00000000,?,00F6F765,?,00F6F765,?,00000000,00000000,00000001,?,00000008), ref: 00F66939
__dosmaperr.LIBCMT ref: 00F66940

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID:
API String ID: 2336955059-0
Opcode ID: 31a9cf8866d0148670e468658b372918a8da25e8100f5a192119214a804884f0
Instruction ID: f4b4446d7db51b4ecd93a3ac1d7072a9c68ba698a31649cb793f44e7b9436f16
Opcode Fuzzy Hash: 31a9cf8866d0148670e468658b372918a8da25e8100f5a192119214a804884f0
Instruction Fuzzy Hash: B601FC33A10519BFCB059F59DC469AE7B2AEB863307240205FC11D7290EA71DD01FB50

Function 00F63E2F Relevance: 4.5, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00F62174: RtlAllocateHeap.NTDLL(00000000,?,?,?,00F4872D,?,?,00EDA1ED,0000002C,87CF6CF3), ref: 00F621A6

_free.LIBCMT ref: 00F63E42
_free.LIBCMT ref: 00F63E68

Part of subcall function 00F62098: RtlFreeHeap.NTDLL(00000000,00000000,?,00F6B729,?,00000000,?,?,?,00F6B9CC,?,00000007,?,?,00F6BDD6,?), ref: 00F620AE
Part of subcall function 00F62098: GetLastError.KERNEL32(?,?,00F6B729,?,00000000,?,?,?,00F6B9CC,?,00000007,?,?,00F6BDD6,?,?), ref: 00F620C0

_free.LIBCMT ref: 00F63E98

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: _free$Heap$AllocateErrorFreeLast
String ID:
API String ID: 4150789928-0
Opcode ID: e6cf5ad7ee28672ace70fb70d539d815d7db59d91254a1e098047906647d6ff3
Instruction ID: d862c63e215ee42556d304d4dc7b60841aa310670af76be404d84a31a0619232
Opcode Fuzzy Hash: e6cf5ad7ee28672ace70fb70d539d815d7db59d91254a1e098047906647d6ff3
Instruction Fuzzy Hash: 0BF0F937C0453566CF32A2349C01AFE77644F62760F150299E485B2183DE2A4E8DB7A0

Function 00F24D93 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F24D1C

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Strings

`aco, xrefs: 00F24D16

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: `aco
API String ID: 1269201914-3232419237
Opcode ID: 90afc75a003a12782ffb918da3dc7b93ce4cb53ab1a9dfb23f8797e87a4e012d
Instruction ID: 558666b7c90ba7c50b49ce652a3bd7131158b9d75654291186161c60278a0147
Opcode Fuzzy Hash: 90afc75a003a12782ffb918da3dc7b93ce4cb53ab1a9dfb23f8797e87a4e012d
Instruction Fuzzy Hash: B4B0129639D2027C37445119AD47F77032CC2C0B20770411EFC04C0251E4C46C44B533

Function 00F24D89 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F24D1C

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Strings

`aco, xrefs: 00F24D16

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: `aco
API String ID: 1269201914-3232419237
Opcode ID: cd29e86fe25955fe13bec33eafb538e201b7ad235cd58305beb6d4ebe8c4f1ee
Instruction ID: 9224efb045f7d7259b8bff622622dba7e8998a89d22447c6ce2f570c5adcfdde
Opcode Fuzzy Hash: cd29e86fe25955fe13bec33eafb538e201b7ad235cd58305beb6d4ebe8c4f1ee
Instruction Fuzzy Hash: FAB0129639D2027C33445119BE47F37131CC2C0B20770801EF904C0251E4C56C017533

Function 00F24D75 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F24D1C

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Strings

`aco, xrefs: 00F24D16

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: `aco
API String ID: 1269201914-3232419237
Opcode ID: 57bd35cfc1550a83731ab51ebb677ab0338ced45c151e33b2da9e4df2eb75bc7
Instruction ID: b4cbe5fd70a3563a1a02e7a03ae33754700c47f6b96cebd6f911bb2eef38df12
Opcode Fuzzy Hash: 57bd35cfc1550a83731ab51ebb677ab0338ced45c151e33b2da9e4df2eb75bc7
Instruction Fuzzy Hash: 30B0129639D012BC36445119AD07F37031CC2C0B20770C01FF904C0251E4C46C047533

Function 00F24D7F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F24D1C

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Strings

`aco, xrefs: 00F24D16

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: `aco
API String ID: 1269201914-3232419237
Opcode ID: fe8d5e8069ff90105bbb40bb78d9e56144e7448c761f2312c658bc15f7a08730
Instruction ID: e4dc9ee871b0a5e5b3ff67d09d8d00d64544db632cb96542e4abff86c2b9dda7
Opcode Fuzzy Hash: fe8d5e8069ff90105bbb40bb78d9e56144e7448c761f2312c658bc15f7a08730
Instruction Fuzzy Hash: FEB012D63DD106BC3244511AAD47F37032CC2C0B20770401EF804C0251E4C46C00B633

Function 00F24D61 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F24D1C

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Strings

`aco, xrefs: 00F24D16

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: `aco
API String ID: 1269201914-3232419237
Opcode ID: 40374c36d943231376a4e8df825d15034827761208d6431920e4da74c00e6e37
Instruction ID: 6392f1d97b3d862c3f9125824b1b4c25fc4ff693ac13172c8aa7749fe3f30860
Opcode Fuzzy Hash: 40374c36d943231376a4e8df825d15034827761208d6431920e4da74c00e6e37
Instruction Fuzzy Hash: 57B0129639D112BC36445119AD47F37031CC2C0B20770801EFD04C0251E4C46C007533

Function 00F24D6B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F24D1C

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Strings

`aco, xrefs: 00F24D16

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: `aco
API String ID: 1269201914-3232419237
Opcode ID: 4f72f9b43ace1cc74b399fd87c7ebb0caa28d606b6c362a740403d352b5f3380
Instruction ID: b66678fc5a76e5ca9cdc6c23832e87cb86754a92a8abe71165e5e365d9696cbb
Opcode Fuzzy Hash: 4f72f9b43ace1cc74b399fd87c7ebb0caa28d606b6c362a740403d352b5f3380
Instruction Fuzzy Hash: 3FB0129639D1027C33445119AD07F77031CC2C0B20770411EF804C0251E4C46C487533

Function 00F24D57 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F24D1C

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Strings

`aco, xrefs: 00F24D16

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: `aco
API String ID: 1269201914-3232419237
Opcode ID: 0459ed4f7c4ed4df87ab9e84c22bc078879c43aae3612efbb154d40cb366723a
Instruction ID: dac1257bb0d4e33b97ff85d95e147b7dea39df9553f034c7ea15f5a12f04f63c
Opcode Fuzzy Hash: 0459ed4f7c4ed4df87ab9e84c22bc078879c43aae3612efbb154d40cb366723a
Instruction Fuzzy Hash: 90B012963AD002BC32445119ED07F37032CC2C0B30770421FF405C0251E4C46C00B533

Function 00F24D43 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F24D1C

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Strings

`aco, xrefs: 00F24D16

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: `aco
API String ID: 1269201914-3232419237
Opcode ID: a5624b9b35b938c6e028145f39d46271b84b1e719b05b3a0ba9379d0bea58927
Instruction ID: c03f7d86767c266bbb1a9962bf6df961a3a9652f63c82fca4a4acd28b343ea47
Opcode Fuzzy Hash: a5624b9b35b938c6e028145f39d46271b84b1e719b05b3a0ba9379d0bea58927
Instruction Fuzzy Hash: 24B0129639D4027C33445119EE07F37131DC2C0B307B0821EF505C0251E4C46C017533

Function 00F24D4D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F24D1C

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Strings

`aco, xrefs: 00F24D16

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: `aco
API String ID: 1269201914-3232419237
Opcode ID: 6534deeea2a13dbabd5079395456e618565237d89d357f369e550f866983de38
Instruction ID: cf8d2e58bddaeb9cfa9d68dc014798f53fa6bbae6db195bbaffac321ca99f34f
Opcode Fuzzy Hash: 6534deeea2a13dbabd5079395456e618565237d89d357f369e550f866983de38
Instruction Fuzzy Hash: 2EB0129639D012BC37445119AD07F37032CC2C0B20770801EF804C1251E4C46C087533

Function 00F24D39 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F24D1C

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Strings

`aco, xrefs: 00F24D16

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: `aco
API String ID: 1269201914-3232419237
Opcode ID: a99d47f7b962b848203392c5e7d65df561bdcbb1b14c58f9029ae494dc6a6d17
Instruction ID: fcac8ab9eaae546011bf42cfe6a0b3e41f107e69c43e2a4379973a1e74227ff7
Opcode Fuzzy Hash: a99d47f7b962b848203392c5e7d65df561bdcbb1b14c58f9029ae494dc6a6d17
Instruction Fuzzy Hash: 18B0129639D1027C33445119ED47F77031CC2C0B30770421EF805C0251E4C46C447533

Function 00F24D25 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F24D1C

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Strings

`aco, xrefs: 00F24D16, 00F24D25

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: `aco
API String ID: 1269201914-3232419237
Opcode ID: 95f2d02bee222095e220208cba8983edb969ed6390924df21d238423a9000b94
Instruction ID: 95dff3c46543581f0128c320e6c5a0153bea718a492ceb7be9aa44c1c92f3f60
Opcode Fuzzy Hash: 95f2d02bee222095e220208cba8983edb969ed6390924df21d238423a9000b94
Instruction Fuzzy Hash: ECB0129639D002BD32445119AD07F77032CC2C0B20770401EF404C0251E4C46C04B533

Function 00F24D2F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F24D1C

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Strings

`aco, xrefs: 00F24D16

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: `aco
API String ID: 1269201914-3232419237
Opcode ID: 4c449b5aa56bf9a6fce1aa47f7f25175f87cb619f294572f1be1a3c4a7c027ce
Instruction ID: e3be8741d34dc58ccc5c16cad726d3712c9664e7deb11579e55c558bd9379737
Opcode Fuzzy Hash: 4c449b5aa56bf9a6fce1aa47f7f25175f87cb619f294572f1be1a3c4a7c027ce
Instruction Fuzzy Hash: 80B0129639D012BC36445119ED07F37031CC2C4B30770811EF805C0351E4C46C007533

Function 00F24D0A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F24D1C

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Strings

`aco, xrefs: 00F24D16

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: `aco
API String ID: 1269201914-3232419237
Opcode ID: 8f62c23f90f64dc061edbc11affb5bbb70be0c18d4f0752e1a0a55a1f2b5ca31
Instruction ID: 26f2f21d691b7634ceb58a09165bdc626f7b5d6a63c37d280b1955f011e960e7
Opcode Fuzzy Hash: 8f62c23f90f64dc061edbc11affb5bbb70be0c18d4f0752e1a0a55a1f2b5ca31
Instruction Fuzzy Hash: 6CB0129639D0037C33041115AE07F37131CC2C0B24770801EF500C0152E4C46C057433

Function 00EF4A40 Relevance: 3.1, APIs: 2, Instructions: 90COMMON

Download Yara Rule

APIs

_com_issue_error.COMSUPP ref: 00EF4AD2
SysFreeString.OLEAUT32(-00000001), ref: 00EF4AFD

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: FreeString_com_issue_error
String ID:
API String ID: 709734423-0
Opcode ID: 21efad7e51991a14aac518067cb5f37b986b63fb4760ae14fa8b8b7ea2bf5a0d
Instruction ID: f319b4cde5f2020eb7bbfa7c8b121a525def695493c2b458d30918cc3db70344
Opcode Fuzzy Hash: 21efad7e51991a14aac518067cb5f37b986b63fb4760ae14fa8b8b7ea2bf5a0d
Instruction Fuzzy Hash: C221B5B1900715ABD7209F59CC05B6BFBE8EF40B60F20471EE965A76C0E7B8E840C790

Function 00F65BF0 Relevance: 3.1, APIs: 2, Instructions: 80fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,?,00F0860A,00000000,?,00F6610D,00F0860A,00F0860A,00000000,00FBC218,87CF6CF3,00F0860A), ref: 00F65C8C
GetLastError.KERNEL32(?,00F6610D,00F0860A,00F0860A,00000000,00FBC218,87CF6CF3,00F0860A,00F0860A,00F0860A,87CF6CF3,00000000,?,00F5591E,00000000,00FBC218), ref: 00F65CB2

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: adb9218319e410101a832bbf3b53c2c556ae042989b807dcba5280301daf2180
Instruction ID: 2a3e08803987da3fd0d0bc56536ca96400db64af6c58871b0902a21a3c26cd5d
Opcode Fuzzy Hash: adb9218319e410101a832bbf3b53c2c556ae042989b807dcba5280301daf2180
Instruction Fuzzy Hash: 42219F31A002299FCF19CF29CC809EDB7BAEB49701F2440AAE946E7311D630DE42DF60

Function 00ED9BB0 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

InitOnceBeginInitialize.KERNEL32(00FC80C4,00000000,87CF6CF3,00000000,87CF6CF3,00EDA219,00FC80CC,?,?,?,?,?,?,00EDA219,?,?), ref: 00ED9BE5
InitOnceComplete.KERNEL32(00FC80C4,00000000,00000000), ref: 00ED9C1D

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: InitOnce$BeginCompleteInitialize
String ID:
API String ID: 51270584-0
Opcode ID: f4cf7393f0339632ac436cc948d733415ba2f6e6ef117f2aa1fbde650baa6914
Instruction ID: db5d597a9fe4d3734caa2f888f194a1368372149346c4af0b493b6014531e91f
Opcode Fuzzy Hash: f4cf7393f0339632ac436cc948d733415ba2f6e6ef117f2aa1fbde650baa6914
Instruction Fuzzy Hash: 85019670A40649AFE710DF94DD06FBEB7B4FB04B08F10062AB915A72C1DB74A509DB52

Function 00F499E1 Relevance: 3.0, APIs: 2, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00EF4AA5,?,00000000,00000000,?,00F4BE00,00FBBF08,000000FE,?,00EF4AA5), ref: 00F49A04
SysAllocString.OLEAUT32(00000000), ref: 00F49A0F

Part of subcall function 00F4E960: _free.LIBCMT ref: 00F4E973

_com_issue_error.COMSUPP ref: 00F49A38
_com_issue_error.COMSUPP ref: 00F49A42
GetLastError.KERNEL32(80070057,87CF6CF3,?,00000000,?,00F4BE00,00FBBF08,000000FE,?,00EF4AA5,?), ref: 00F49A47
_com_issue_error.COMSUPP ref: 00F49A5A
GetLastError.KERNEL32(00000000,?,00000000,?,00F4BE00,00FBBF08,000000FE,?,00EF4AA5,?), ref: 00F49A70
_com_issue_error.COMSUPP ref: 00F49A83

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: _com_issue_error$ErrorLast$AllocByteCharMultiStringWide_free
String ID:
API String ID: 878839965-0
Opcode ID: f7588afcd1c62b5717f3c446342df028d19097e7eceb6113bbe0e55202d49950
Instruction ID: 0f889ad00bf8f3c6ef62043e9fce2167c4fddae3689fe827f9cbedc166486847
Opcode Fuzzy Hash: f7588afcd1c62b5717f3c446342df028d19097e7eceb6113bbe0e55202d49950
Instruction Fuzzy Hash: 65016272F092589FDB208F949C45BEFBBB4EF48760F000129ED0567381DB795810D7A1

Function 00F5ED5C Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F5EDA4

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 88929c290d6149755cb6fbecd806d47d33b7c237976822bf7f2b32fab48785f4
Instruction ID: a3829aecb8f7e619dde19407160de2ff0a44cd73a0717842db2bfac8c8cdf146
Opcode Fuzzy Hash: 88929c290d6149755cb6fbecd806d47d33b7c237976822bf7f2b32fab48785f4
Instruction Fuzzy Hash: E6E02B23D45E2155E239773EBC06B6A36A58BC1372F120216FD30C71D1DF344A8ABD91

Function 00EFDEC0 Relevance: 3.0, APIs: 2, Instructions: 22registryCOMMON

Download Yara Rule

APIs

SHDeleteKeyW.SHLWAPI(?,00FABFD0,?,00EFDE7B), ref: 00EFDED6
RegCloseKey.KERNEL32(?,?,00EFDE7B), ref: 00EFDEE4

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: CloseDelete
String ID:
API String ID: 453069226-0
Opcode ID: aed209b21eec0ae6cf9f1b2d77cbbe3a14ac7992aea9b9764271417a03481ae4
Instruction ID: e2d7c04fa46250a11fa481714e81de640a9c6894c57b74a6793a5a52b6a0717c
Opcode Fuzzy Hash: aed209b21eec0ae6cf9f1b2d77cbbe3a14ac7992aea9b9764271417a03481ae4
Instruction Fuzzy Hash: B5E01A70A08B559FD7309F29EC08B93BBE8AB05714F14C84DE49AD7A90C3B8E840DB54

Function 00EDDEB0 Relevance: 1.8, APIs: 1, Instructions: 298COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000023,00000001,87CF6CF3,?,?), ref: 00EDDF08
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(D;OICI;GA;;;BG)(D;OICI;GA;;;AN)(A;OICI;GRGWGX;;;AU)(A;OICI;GA;;;BA),00000001,00000000,00000000), ref: 00EDE36C

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: DescriptorSecurity$ConvertFolderPathSpecialString
String ID:
API String ID: 4077199523-0
Opcode ID: a316c0e98e86ec4fd2a5b2b4735832917ca529f1f1ed2406d7d56882764d2525
Instruction ID: bea4b0ddf13d686d13f4b735e5b553b12ba08045b009332fd43b69e772b6e014
Opcode Fuzzy Hash: a316c0e98e86ec4fd2a5b2b4735832917ca529f1f1ed2406d7d56882764d2525
Instruction Fuzzy Hash: 66C10971A002049BCB28DF64DD8D7ADB7B2FF85304F10869ED4096B791DB75AA86CF90

Function 00F6627A Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eafc834458914f03706ea981a104fd4c80b349aa52870aa36b9010219430bfd
Instruction ID: 3a07b420e67ca17633529102c341a94dbf294e8929b5e5364545dd143e44ca16
Opcode Fuzzy Hash: 3eafc834458914f03706ea981a104fd4c80b349aa52870aa36b9010219430bfd
Instruction Fuzzy Hash: B441C471E00208AFDB10DF58CC82AAE7BA2EB89364F29816CF849DB351D775DD41EB50

Function 00F6732A Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00F67364

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 1a6df0b23191daf2b6a0cffb17d4a05d2b0abc42c47ffb31df8c83a66bddf263
Instruction ID: 695402be0bd07d36d19d1ddcd81c655bd2e70bd0e598a16d0bc6af4632a42996
Opcode Fuzzy Hash: 1a6df0b23191daf2b6a0cffb17d4a05d2b0abc42c47ffb31df8c83a66bddf263
Instruction Fuzzy Hash: 82115A71A0420AAFCF05DF58E94199F7BF4EF48304F004059F809EB351D631EA11DBA5

Function 00F55854 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 738b2551a80a8a8d4bf8db57af4b31d13eda5225752eac16fda81814e4d2ac91
Instruction ID: 33262c52df14268f4f7ebd9f11c170790ae60b7a4bcd20c3d9c469d03b4f95e2
Opcode Fuzzy Hash: 738b2551a80a8a8d4bf8db57af4b31d13eda5225752eac16fda81814e4d2ac91
Instruction Fuzzy Hash: 63F0FF32902E141BDA2136698C15B5B36989F82737F140729FE21E65D2CA78E80AF6A1

Function 00EFDF10 Relevance: 1.5, APIs: 1, Instructions: 41registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?), ref: 00EFDF45

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ada8e5e08f590042b534cf75c63eecc83116c9dc953959f2c19d4a21b37ccdbf
Instruction ID: cd6bbbd32fe8e248bcce49d6ef4379bbc43fa3335bd77e567f7c2faeea0dac99
Opcode Fuzzy Hash: ada8e5e08f590042b534cf75c63eecc83116c9dc953959f2c19d4a21b37ccdbf
Instruction Fuzzy Hash: A0015A36600209ABCB11CF45CC04F9EBFBAFF98310F108059F905A7250C770AA14DB90

Function 00F16050 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(?), ref: 00F16061

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: d5ca555c3484e41de92adff300f52035516e16fd7475975080d2bf23880dea90
Instruction ID: d98189a9d5c1825131e2d307e4c5f5c042c19dd7635cca8c0ec915c2a77d9e6b
Opcode Fuzzy Hash: d5ca555c3484e41de92adff300f52035516e16fd7475975080d2bf23880dea90
Instruction Fuzzy Hash: 86F049752002048BC724DF69D858BABB7E9EF88710F40861DE449CB620D375E945CBA0

Function 00F62174 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00F4872D,?,?,00EDA1ED,0000002C,87CF6CF3), ref: 00F621A6

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 88d2b7157b4c71fea818888942084b460a4ff319e721211a05fc8f39a9ba299b
Instruction ID: 8f93267cba5887b33007b40a795abd7be2d6a54a5fc08e8338729c3df2d30171
Opcode Fuzzy Hash: 88d2b7157b4c71fea818888942084b460a4ff319e721211a05fc8f39a9ba299b
Instruction Fuzzy Hash: 5AE02236A08A2567EBB037219C00B9F3A58EF433F2F146120FE14D6091CB34CC48B2E0

Function 00EFE500 Relevance: 1.5, APIs: 1, Instructions: 30registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,?,00000000,?,?), ref: 00EFE51F

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 9c7851aae4757a63897372134d82fcc25e96ce555ec3a7c413b63b9125eb50fd
Instruction ID: 9ccb59ad0ed8c02209780e8bcc19114b8711ac00e3205dcecd19e77877935688
Opcode Fuzzy Hash: 9c7851aae4757a63897372134d82fcc25e96ce555ec3a7c413b63b9125eb50fd
Instruction Fuzzy Hash: 7EF05E31600208ABDB248F09DC04F9EBBA8EF95714F20845EF80597250D6B0AA109B94

Function 00ED136C Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00ED13A5

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID:
API String ID: 323602529-0
Opcode ID: 4e974ef7af4ff6df131144f5fe8bb1e30e1dd7400f88f40dc465b347976bd7c4
Instruction ID: 585dd36b64f4da7e919d9502b81ab7d540c34f48c379f0d89f6c7d08aa6dccc5
Opcode Fuzzy Hash: 4e974ef7af4ff6df131144f5fe8bb1e30e1dd7400f88f40dc465b347976bd7c4
Instruction Fuzzy Hash: B4F06572914658EFD7059F44DC01F9AB7ECEB08720F10462FE81193781DB7569059A94

Function 00F74D80 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,?,00F74E6A,00000000,00000000,-00000002,87CF6CF3,00000028,00000000,?,00000000,extra,00000005,00000000,00000000,00F944E4), ref: 00F74D92

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 1272043b7b827404563f6313acdd790b3ae79b48cca3d786bfd7416a88d35afa
Instruction ID: 118f2f0d00dfdaf490ca324345f64f254fcedb5157bf196ffef2352d5f39f20f
Opcode Fuzzy Hash: 1272043b7b827404563f6313acdd790b3ae79b48cca3d786bfd7416a88d35afa
Instruction Fuzzy Hash: 36D0A73171020919AF740E7C9469EB6334C994277474D8652F49EC60D4E730FC82B131

Function 00EFED10 Relevance: 1.5, APIs: 1, Instructions: 20registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNEL32(?,?,00000000,?,?,?), ref: 00EFED2F

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 348c451b8c54ebd4ea28bab8b54e29a6991898b20204a375b5ad565900bff6fd
Instruction ID: 1274891b2baf52ff525c969908ccfb22ba4dfc122d5528826fe552130a4aa8d9
Opcode Fuzzy Hash: 348c451b8c54ebd4ea28bab8b54e29a6991898b20204a375b5ad565900bff6fd
Instruction Fuzzy Hash: 3FE0EC3524010CABDB008E94EC40FA77B2AEB94704F10C815F9085A6A5C373EC21ABA0

Function 00F6FE25 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00F70187,?,?,00000000,?,00F70187,00000000,0000000C), ref: 00F6FE42

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a28ef42bb3cd866b879d6d31d05bbed0000ae3492044c749ec4f204365e4ad00
Instruction ID: 9a0e9440fc49a104ba232f51a0a8aa0a1b31a13ffcfed0390e321c3fe3d7e58e
Opcode Fuzzy Hash: a28ef42bb3cd866b879d6d31d05bbed0000ae3492044c749ec4f204365e4ad00
Instruction Fuzzy Hash: E9D06C3200010DBBDF028F84DD06EDA3BAAFB88714F014000BA1856060C772E921AB91

Function 00F3269D Relevance: 1.5, APIs: 1, Instructions: 13COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F32743: DloadGetSRWLockFunctionPointers.DELAYIMP ref: 00F32743
Part of subcall function 00F32743: AcquireSRWLockExclusive.KERNEL32(?,00F328F1), ref: 00F32760

DloadProtectSection.DELAYIMP ref: 00F326C5

Part of subcall function 00F3286C: DloadObtainSection.DELAYIMP ref: 00F3287C

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Dload$LockSection$AcquireExclusiveFunctionObtainPointersProtect
String ID:
API String ID: 1209458687-0
Opcode ID: f25f3399fa6eb9fbfc9b03f659c56b728a3725f874e0fa0fafc707f8b41d4aa7
Instruction ID: eaceadf71aaab4902e24012e5f3ed070a5884d7220aba4cca528437dedc10071
Opcode Fuzzy Hash: f25f3399fa6eb9fbfc9b03f659c56b728a3725f874e0fa0fafc707f8b41d4aa7
Instruction Fuzzy Hash: ECD0123094C2544AC3C1BB1AAD87B143250B744331F90441AB505C60B4E7B59840FA25

Function 00EFE8C0 Relevance: 1.5, APIs: 1, Instructions: 11registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,?,00000000,?,?,?), ref: 00EFE8D4

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: ddcfa4a93b6ee3db1cde04865848aef029f23c262615560bee73d7055bac4117
Instruction ID: 64df6f556082ab20b9314769cc6a89bc5343359cbf922768b62ff64d17acd686
Opcode Fuzzy Hash: ddcfa4a93b6ee3db1cde04865848aef029f23c262615560bee73d7055bac4117
Instruction Fuzzy Hash: 2DD0EA3604020DBBDF025F81ED05EDA7F2AEB09765F148815FA191806187B39575BBA5

Function 00F4E960 Relevance: 1.5, APIs: 1, Instructions: 11COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F4E973

Part of subcall function 00F62098: RtlFreeHeap.NTDLL(00000000,00000000,?,00F6B729,?,00000000,?,?,?,00F6B9CC,?,00000007,?,?,00F6BDD6,?), ref: 00F620AE
Part of subcall function 00F62098: GetLastError.KERNEL32(?,?,00F6B729,?,00000000,?,?,?,00F6B9CC,?,00000007,?,?,00F6BDD6,?,?), ref: 00F620C0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: fab4fa4e78e3bb56b6f0db2a41ca46f282b47d196b259d4a4af83b9d8bde8242
Instruction ID: 6be086c9edb4690997b5c9efa11a70f0ee42cd29103eb2f97e1e978b75456326
Opcode Fuzzy Hash: fab4fa4e78e3bb56b6f0db2a41ca46f282b47d196b259d4a4af83b9d8bde8242
Instruction Fuzzy Hash: 4FC08C3140020CBBCB009B41C806A4E7BA8DB803A4F200044F40117241CAB1EE04A680

Function 00F24CFA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F24C81

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 677485a2d398a7a5d5917a90f9eaf39077ae88e02be87ec358300d88c01bef85
Instruction ID: 626361b7e844199d13962c97be70914ba6758ea12e333ff592c917f4601bd2ad
Opcode Fuzzy Hash: 677485a2d398a7a5d5917a90f9eaf39077ae88e02be87ec358300d88c01bef85
Instruction Fuzzy Hash: C0B012963DE001FD3148511D6E07F37121CC2C4B30F30401EF001C0141E4C05C007037

Function 00F24CEA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F24C81

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 19a4a5c5bad90294c1d95ab82688f9a63ee403bd97f1dca4261eb5a61f7247a7
Instruction ID: a41801163306a74456145da1b51d2e4d37f921024f414dff20ed4ce6d9ce7fa9
Opcode Fuzzy Hash: 19a4a5c5bad90294c1d95ab82688f9a63ee403bd97f1dca4261eb5a61f7247a7
Instruction Fuzzy Hash: F0B012A63DE001BD3248511D6F07F37220CC2C4B30F30801EF101C0141E4C15C013033

Function 00F24CDA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F24C81

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b90ebf1cfd5319656671fc2675454314030e765c4232caf3ce02b33c7b2f0141
Instruction ID: c290c818eed2c5fda9cdad0620d20dd767a5559a4c7376c79d6cfc27a21ee321
Opcode Fuzzy Hash: b90ebf1cfd5319656671fc2675454314030e765c4232caf3ce02b33c7b2f0141
Instruction Fuzzy Hash: E2B012963DE101BD3248511D6E07F77120CC2C4B30F30411EF401C0151E4C05C443033

Function 00F24CCA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F24C81

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c183a9333c64e4aab9117c8db836b3f84c248214913ac02f3ddbb9c4c0fdb3da
Instruction ID: c6f0a1a083b4e6627145420ee9db860fd24f6a2e31e8b241222333ee652fabcc
Opcode Fuzzy Hash: c183a9333c64e4aab9117c8db836b3f84c248214913ac02f3ddbb9c4c0fdb3da
Instruction Fuzzy Hash: 7BB0929629A011BD3148511D6E06E36120CC284B20B20801EF401C0141E4C058003033

Function 00F24CBA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F24C81

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ded9c6bcd0e3684bbce3a8162a802ff7bb3dd07bb78bc4be72f099c7b16f0759
Instruction ID: 735436fd8a98c3cade01463cd72561f802c19e640a1621a729f1c3eb0eb0e788
Opcode Fuzzy Hash: ded9c6bcd0e3684bbce3a8162a802ff7bb3dd07bb78bc4be72f099c7b16f0759
Instruction Fuzzy Hash: B2B0929629A011BD314852196D06E36120CC684B20B20801AF400C0141E88158003433

Function 00F24CAA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F24C81

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8ab4717a0c2e09d3cdd14cb7fb6c35687633d254f079df7ad7b38ce5e1e6b3be
Instruction ID: 6c9ad7006b1493019553d97dbb802d81494d399764492d727bf5782cad4db202
Opcode Fuzzy Hash: 8ab4717a0c2e09d3cdd14cb7fb6c35687633d254f079df7ad7b38ce5e1e6b3be
Instruction Fuzzy Hash: 2AB012963DE0017D3248511D6E07F37220CC6C4B30F30801EF200C11C1E4C15C013033

Function 00F24C9A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F24C81

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d8849603508c127881dd1c694f55e37cca466c492546fa34e0384861bc9403f6
Instruction ID: 3332ede0819d8ca645c951e90678cd5048fb0c0881925d789c8b54b9d1a052b1
Opcode Fuzzy Hash: d8849603508c127881dd1c694f55e37cca466c492546fa34e0384861bc9403f6
Instruction Fuzzy Hash: 98B012963DE1017D3248511D6D07F77120CC6C4B30F30411EF500C1181E4C05C443037

Function 00F24C8A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F24C81

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ecdcbe4f3d7aa47e8a2aa9eed11c20e568ba8c42e9f13cd036147603ebdb37c0
Instruction ID: 4b20aa885f15ba5c27af62f4c343887285f38c50c04ac7d8a2e7f0b16021a3af
Opcode Fuzzy Hash: ecdcbe4f3d7aa47e8a2aa9eed11c20e568ba8c42e9f13cd036147603ebdb37c0
Instruction Fuzzy Hash: 57B012963DE012BD3148511DAD07F37120CC6C4B30F30841EF500C1181E4C05C003033

Function 00F24C69 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F24C81

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 62a0bb58027e009643f3c8a0e7999d6c5085ce9542b0c3a14f18565c09869347
Instruction ID: 435abbe423ec00af51bab5f1a742bfaee6650184ff59a2ce8566dba49cc794ea
Opcode Fuzzy Hash: 62a0bb58027e009643f3c8a0e7999d6c5085ce9542b0c3a14f18565c09869347
Instruction Fuzzy Hash: CEB012AB3DE101BD320812296E0BE77220CC6C0B30F30411EF400C0041A8C15C453073

Function 00F24DB8 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F24DAF

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2b2404af5877caffe71d2064cbb25087883163e83190aa59c4c6cbea3afb7438
Instruction ID: 11a4975c48f13d18ed4161c2e2a8c7a4ac83f6f976a5129bfa99164b92c72dcf
Opcode Fuzzy Hash: 2b2404af5877caffe71d2064cbb25087883163e83190aa59c4c6cbea3afb7438
Instruction Fuzzy Hash: 3BB012D63DD421BC318451297D07F37030CC2C4B20770802EF404C4152E4C09C043033

Function 00F24D9D Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F24DAF

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 0d8eea919339fd63ae238d7a79f50ee7adae50be38a2af974ce381c0dc8cbbc4
Instruction ID: 95b23355eb85bff3a1f902ffadec5742d5cb6d7584572d6cb4b2eec1e119413d
Opcode Fuzzy Hash: 0d8eea919339fd63ae238d7a79f50ee7adae50be38a2af974ce381c0dc8cbbc4
Instruction Fuzzy Hash: 55B012D73DE421BC31441215BD07F37021CC6C1B20BF0401EF040C4052A8C09C007033

Function 00F314C6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F314D8

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 52547d3ea1caffae945b0c4e0b2dee9d8b28b5766522e1fee50edeb002fdaaac
Instruction ID: 06013490a3cfc2a621bba91586524cb03fee9502e3c9e464781bb95b80296cbc
Opcode Fuzzy Hash: 52547d3ea1caffae945b0c4e0b2dee9d8b28b5766522e1fee50edeb002fdaaac
Instruction Fuzzy Hash: C2B012BA39E0017C320451269E07F37220CC2C1B30F30C01EF100C1042E4845C013033

Function 00F497AC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F497C4

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e52ec4b040d30e847fdcffda015b13183ecc41a302f8e3326c2afba1b48bce39
Instruction ID: 752204f14a4a033f654aacf632f61ce63cec17878407babe225e9921100749c2
Opcode Fuzzy Hash: e52ec4b040d30e847fdcffda015b13183ecc41a302f8e3326c2afba1b48bce39
Instruction Fuzzy Hash: 24B012B63BD0017C320421295E47E371B0CC2C0B20730C42EFD00D0042B4C04C053433

Function 00F49BF0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F49BE7

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 9b24e12d9ea6b59e55a8f6cb1cae6ce33bf39bc4b662cbe282b4f1315f025832
Instruction ID: 177fe3e946c197a45e510a92d190e0a602fd5b1c7445b0965a3fcbc12a84e323
Opcode Fuzzy Hash: 9b24e12d9ea6b59e55a8f6cb1cae6ce33bf39bc4b662cbe282b4f1315f025832
Instruction Fuzzy Hash: F8B012A63ED0017C324851196E47F37220DC2C0B20B30961EF500C0141F4C04C813033

Function 00F49BFA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F49BE7

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 456c1dd0d7bd10b8806245ae663b30021a582b6ffe3bdde8416b596a990c64f7
Instruction ID: 50879a90faad3900294328484052fe935a3f19aceddbc32fba0abe625ee88024
Opcode Fuzzy Hash: 456c1dd0d7bd10b8806245ae663b30021a582b6ffe3bdde8416b596a990c64f7
Instruction Fuzzy Hash: 0BB012A63ED001BC314851196D47F37131DC2C0B20B30961EF800C0141E4C04C803133

Function 00F49C54 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F49BE7

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: bcee01716d65d257d9c946a9f1eb1441d871d320efcd361e1a76fc29fc8d7f8d
Instruction ID: 32ebd2dc6bf4c9f1ace90e6f1dcf24ae9f8fd5d841c78d4c25db630f93bdcfa6
Opcode Fuzzy Hash: bcee01716d65d257d9c946a9f1eb1441d871d320efcd361e1a76fc29fc8d7f8d
Instruction Fuzzy Hash: 2FB012963ED001BC314851196D47F37121DC2C0B20B304A1EF400C0181E4C04C407033

Function 00F49C40 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F49BE7

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a1acb9f40151bb66a77fb9753f66ee8ecf687e77153a9db2d23e40a78c0f55f7
Instruction ID: 3ebd55eb588490cdb116ededf2a4e33ea0c433788a5c896ff2156de1abba95c5
Opcode Fuzzy Hash: a1acb9f40151bb66a77fb9753f66ee8ecf687e77153a9db2d23e40a78c0f55f7
Instruction Fuzzy Hash: CBB012963ED1017C324851196D47FB7120DC2C0B20B30471EF800C0141E4C04D843033

Function 00F49C4A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F49BE7

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6fd69fbffbbce83fc570efe0f4a62775a4dbc3656208b18d7c5a060db8300007
Instruction ID: 84063f88fce1d05fe7176abe18ea1a0f4c9866b7b1b161bcbc0e58b01a529391
Opcode Fuzzy Hash: 6fd69fbffbbce83fc570efe0f4a62775a4dbc3656208b18d7c5a060db8300007
Instruction Fuzzy Hash: 7DB012963ED0017C32485119AE47F37220DC2C0B20B30861EF501C0151E4C04C413033

Function 00F49C36 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F49BE7

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 61a04e4626fa487d33f603e5de87a737d5bc0b877e56472bc641a045ea5427d5
Instruction ID: 85e9b868f02dbb516d86cec57356c06f7537e234920c0c2b97d3ae8326436c81
Opcode Fuzzy Hash: 61a04e4626fa487d33f603e5de87a737d5bc0b877e56472bc641a045ea5427d5
Instruction Fuzzy Hash: 2DB012963ED001BC314851196D47F37120DC2C0B20B30861EF800C0141E4C08C403033

Function 00F49C22 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F49BE7

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8d1e25de895e5e061d030b5e8d75382db68b83cf40fffabc3136c1c2ccad5212
Instruction ID: cfc28272099bc174cd15022c38d245b8109e118c34f2b5d938cfebff7e22c0d5
Opcode Fuzzy Hash: 8d1e25de895e5e061d030b5e8d75382db68b83cf40fffabc3136c1c2ccad5212
Instruction Fuzzy Hash: 81B012E63ED4017C324851196E47F37268DC2C0B20F30861EF500C0141E4C04C413033

Function 00F49C2C Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F49BE7

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a1a62a6180dc6d52b06e6941dda38dacd7aac239fcd3146c608d5ce8671172d0
Instruction ID: 0b9a8595f22d0f84fe5156323c6674927405b727b9a911761d80b6037dd39f4d
Opcode Fuzzy Hash: a1a62a6180dc6d52b06e6941dda38dacd7aac239fcd3146c608d5ce8671172d0
Instruction Fuzzy Hash: CEB012973ED501BC314851196D47F37165DC2C0B20B30461EF400C0141E4C04C407033

Function 00F49C18 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F49BE7

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6d92ea47a9d2f8b5ccfef426d47b5a9f10d0609c9876ca225418a55f0c043cc3
Instruction ID: 443a519d57a869041b925bafa97c8bd47479936c9dd460cb83412944149e2a77
Opcode Fuzzy Hash: 6d92ea47a9d2f8b5ccfef426d47b5a9f10d0609c9876ca225418a55f0c043cc3
Instruction Fuzzy Hash: C4B0129A3ED5017C324851196D47F77164DC2C0B20B30471EF800C0141E4C04C843033

Function 00F49C04 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F49BE7

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 96def0f26413d4d675499e06f77f0bd44a59e6c160d0c213eecb3ee5b204e93e
Instruction ID: 622582001babc83a1a92a9e2f4aa3103684440e38fdcdbebfc57cc5a6c18fb50
Opcode Fuzzy Hash: 96def0f26413d4d675499e06f77f0bd44a59e6c160d0c213eecb3ee5b204e93e
Instruction Fuzzy Hash: ABB012A63ED001BC314851196D47F37121DC3C0B20B30561EF400C0141E4C04C80B033

Function 00F49C0E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00F49BE7

Part of subcall function 00F3293C: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00F329AF
Part of subcall function 00F3293C: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00F329C0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 592e252a1369e9cbc5f085b9ddf22d9452ce7f6dbcc3343e732423a7dfa85809
Instruction ID: fbf8f08fad51e37625f3a8ab912fe94f490bea564ff8fec09105180bfa0c3b2d
Opcode Fuzzy Hash: 592e252a1369e9cbc5f085b9ddf22d9452ce7f6dbcc3343e732423a7dfa85809
Instruction Fuzzy Hash: E5B012963ED401BC314851296D47F37164DC2C0B20B30861EF800C0141E4C04C403033

Function 00EFECD0 Relevance: 1.3, APIs: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 00EFECEE

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: baeef44394a881ac1e28365bd7770efefeab81bce1171978bdc4256f98a5ac77
Instruction ID: 38cce395d99a3ab339bf652d02081bde8c8d5cc18798b57e0aa4901832c0837c
Opcode Fuzzy Hash: baeef44394a881ac1e28365bd7770efefeab81bce1171978bdc4256f98a5ac77
Instruction Fuzzy Hash: C1E0ED3720011DABDB018B8AEC84DAAFB6DEBD5371704417BFA0487220D772AC25DBA0

Non-executed Functions

Function 00F00540 Relevance: 98.2, APIs: 29, Strings: 27, Instructions: 220libraryloaderCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,87CF6CF3), ref: 00F00571
FreeLibrary.KERNEL32(00000000), ref: 00F005B7
GetProcAddress.KERNEL32(?,SetEntriesInAclW), ref: 00F005DD
GetProcAddress.KERNEL32(?,GetFileSecurityW), ref: 00F005E9
GetProcAddress.KERNEL32(?,SetFileSecurityW), ref: 00F005F5
GetProcAddress.KERNEL32(?,LookupAccountSidW), ref: 00F00601
GetProcAddress.KERNEL32(?,GetExplicitEntriesFromAclW), ref: 00F0060D
GetProcAddress.KERNEL32(?,RegGetKeySecurity), ref: 00F0061C
GetProcAddress.KERNEL32(?,RegSetKeySecurity), ref: 00F00628
GetProcAddress.KERNEL32(?,InitializeSecurityDescriptor), ref: 00F00634
GetProcAddress.KERNEL32(?,SetSecurityDescriptorDacl), ref: 00F00640
GetProcAddress.KERNEL32(?,GetSecurityDescriptorDacl), ref: 00F0064C
GetProcAddress.KERNEL32(?,AllocateAndInitializeSid), ref: 00F00658
GetProcAddress.KERNEL32(?,FreeSid), ref: 00F00664
GetProcAddress.KERNEL32(?,OpenThreadToken), ref: 00F00670
GetProcAddress.KERNEL32(?,GetTokenInformation), ref: 00F0067C
GetProcAddress.KERNEL32(?,InitializeAcl), ref: 00F00688
GetProcAddress.KERNEL32(?,InitializeSid), ref: 00F00694
GetProcAddress.KERNEL32(?,GetSidSubAuthority), ref: 00F006A0
GetProcAddress.KERNEL32(?,AddAccessAllowedAce), ref: 00F006AC
GetProcAddress.KERNEL32(?,GetSecurityInfo), ref: 00F006B8
GetProcAddress.KERNEL32(?,SetSecurityInfo), ref: 00F006C4
GetProcAddress.KERNEL32(?,QueryServiceStatusEx), ref: 00F006D0
GetProcAddress.KERNEL32(?,GetAce), ref: 00F006DC
GetProcAddress.KERNEL32(?,DeleteAce), ref: 00F006E8
GetProcAddress.KERNEL32(?,EqualSid), ref: 00F006F4
GetProcAddress.KERNEL32(?,GetAclInformation), ref: 00F00700
GetProcAddress.KERNEL32(?,SetSecurityDescriptorControl), ref: 00F0070F
LeaveCriticalSection.KERNEL32(?), ref: 00F007DE

Strings

FreeSid, xrefs: 00F0065A
AllocateAndInitializeSid, xrefs: 00F0064E
advapi32.dll, xrefs: 00F00595
RegGetKeySecurity, xrefs: 00F0060F
EqualSid, xrefs: 00F006EA
QueryServiceStatusEx, xrefs: 00F006C9
GetTokenInformation, xrefs: 00F00672
GetFileSecurityW, xrefs: 00F005DF
AddAccessAllowedAce, xrefs: 00F006A2
GetSecurityDescriptorDacl, xrefs: 00F00642
GetAce, xrefs: 00F006D2
RegSetKeySecurity, xrefs: 00F0061E
InitializeSecurityDescriptor, xrefs: 00F0062A
SetEntriesInAclW, xrefs: 00F005D6
DeleteAce, xrefs: 00F006DE
GetExplicitEntriesFromAclW, xrefs: 00F00603
SetSecurityDescriptorDacl, xrefs: 00F00636
LookupAccountSidW, xrefs: 00F005F7
SetSecurityDescriptorControl, xrefs: 00F00702
InitializeSid, xrefs: 00F0068A
SetSecurityInfo, xrefs: 00F006BA
GetSidSubAuthority, xrefs: 00F00696
InitializeAcl, xrefs: 00F0067E
OpenThreadToken, xrefs: 00F00666
GetSecurityInfo, xrefs: 00F006AE
SetFileSecurityW, xrefs: 00F005EB
GetAclInformation, xrefs: 00F006F6

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AddressProc$CriticalSection$EnterFreeLeaveLibrary
String ID: AddAccessAllowedAce$AllocateAndInitializeSid$DeleteAce$EqualSid$FreeSid$GetAce$GetAclInformation$GetExplicitEntriesFromAclW$GetFileSecurityW$GetSecurityDescriptorDacl$GetSecurityInfo$GetSidSubAuthority$GetTokenInformation$InitializeAcl$InitializeSecurityDescriptor$InitializeSid$LookupAccountSidW$OpenThreadToken$QueryServiceStatusEx$RegGetKeySecurity$RegSetKeySecurity$SetEntriesInAclW$SetFileSecurityW$SetSecurityDescriptorControl$SetSecurityDescriptorDacl$SetSecurityInfo$advapi32.dll
API String ID: 2701342527-838666417
Opcode ID: 73dd3385d801ce005291ff5f2808ae0ff43a2b7b0440b0c25fcf0b5ac17cfc02
Instruction ID: ad84bf6aa628a279cdc6bf19dfad05ce3174d29e5251445258784f41abfc93f5
Opcode Fuzzy Hash: 73dd3385d801ce005291ff5f2808ae0ff43a2b7b0440b0c25fcf0b5ac17cfc02
Instruction Fuzzy Hash: 0E810C34D40B1AEADF259B65C848B95BFB0FF05765F000527E50462AA0DB79B468FFC2

Function 00F1F3C0 Relevance: 33.7, APIs: 13, Strings: 6, Instructions: 463encryptionCOMMON

Download Yara Rule

APIs

CryptMsgGetParam.CRYPT32(00000000,00000005,00000000,?,?), ref: 00F1F442
CryptMsgGetParam.CRYPT32(00000000,00000006,00000000,00000000,00000004), ref: 00F1F488
CryptMsgGetParam.CRYPT32(?,00000006,00000000,00000000,00000000), ref: 00F1F4C6
CertGetSubjectCertificateFromStore.CRYPT32(?,00010001,?), ref: 00F1F527
CertGetNameStringW.CRYPT32(00000000,00000005,00000000,00000000,00000000,00000000), ref: 00F1F5AD
CertGetNameStringW.CRYPT32(?,00000005,00000000,00000000,00000000,?), ref: 00F1F602
CertGetCertificateChain.CRYPT32(00000000,?,?,00000000,00000010,00000000,00000000,?), ref: 00F1F89C
CertFreeCertificateChain.CRYPT32(00000000), ref: 00F1F8B1
CertFreeCertificateChain.CRYPT32(00000000), ref: 00F1F8CB

Part of subcall function 00F1E760: CertGetCertificateContextProperty.CRYPT32(?,00000003,00000000,00000000), ref: 00F1E877

CertVerifyCertificateChainPolicy.CRYPT32(00000003,00000000,0000000C,00000014), ref: 00F1F906
CertFreeCertificateChain.CRYPT32(00000000), ref: 00F1F942
CertFreeCRLContext.CRYPT32(?), ref: 00F1FA73
CertFreeCRLContext.CRYPT32(00000000), ref: 00F1FAA6

Strings

McAfee, LLC., xrefs: 00F1F657
Intel Corporation, xrefs: 00F1F705
McAfee, LLC, xrefs: 00F1F61D
McAfee, Inc., xrefs: 00F1F693
4, xrefs: 00F1F9D1
Yahoo! Inc., xrefs: 00F1F6CF

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Cert$Certificate$ChainFree$ContextCryptParam$NameString$FromPolicyPropertyStoreSubjectVerify
String ID: 4$Intel Corporation$McAfee, Inc.$McAfee, LLC$McAfee, LLC.$Yahoo! Inc.
API String ID: 2452394995-549729705
Opcode ID: 34618350fa4593a2ae10a18b483209b81356576715475c94fe9e0ed5e2172953
Instruction ID: ed9d8cfc62f63aa8258e3fab6f60402b27496b7452432a7593587065dee8e835
Opcode Fuzzy Hash: 34618350fa4593a2ae10a18b483209b81356576715475c94fe9e0ed5e2172953
Instruction Fuzzy Hash: C4129271D002299BDF209F24CD49BEAB7B5BF25724F0401E9E809A7291D7759EC8EF50

Function 00F1EB60 Relevance: 27.5, APIs: 18, Instructions: 477encryptionCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000001,00F0BDCE,00000400,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F1EBD2
CryptMsgClose.CRYPT32(00000000), ref: 00F1EBE4
CertCloseStore.CRYPT32(00000000,00000001), ref: 00F1EBF4
CryptMsgClose.CRYPT32(00000000), ref: 00F1ECEE
CertCloseStore.CRYPT32(00000000,00000001), ref: 00F1ECFE
CryptQueryObject.CRYPT32(00000002,?,00003FFE,00000002,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F1EDEE
CryptMsgClose.CRYPT32(00000000), ref: 00F1EE0A
CertCloseStore.CRYPT32(00000000,00000001), ref: 00F1EE1C
CryptMsgClose.CRYPT32(00000000), ref: 00F1EEB6
CertCloseStore.CRYPT32(00000000,00000001), ref: 00F1EEC2

Part of subcall function 00F1F3C0: CryptMsgGetParam.CRYPT32(00000000,00000005,00000000,?,?), ref: 00F1F442
Part of subcall function 00F1F3C0: CryptMsgGetParam.CRYPT32(00000000,00000006,00000000,00000000,00000004), ref: 00F1F488
Part of subcall function 00F1F3C0: CryptMsgGetParam.CRYPT32(?,00000006,00000000,00000000,00000000), ref: 00F1F4C6
Part of subcall function 00F1F3C0: CertGetSubjectCertificateFromStore.CRYPT32(?,00010001,?), ref: 00F1F527

CryptMsgClose.CRYPT32(00000000), ref: 00F1EF02
CertCloseStore.CRYPT32(00000000,00000001), ref: 00F1EF14
CryptMsgClose.CRYPT32(00000000), ref: 00F1EFAE
CertCloseStore.CRYPT32(00000000,00000001), ref: 00F1EFBA
CryptMsgClose.CRYPT32(00000000), ref: 00F1EFDA
CertCloseStore.CRYPT32(00000000,00000001), ref: 00F1EFEA
CryptMsgClose.CRYPT32(00000000), ref: 00F1F0CB
CertCloseStore.CRYPT32(00000000,00000001), ref: 00F1F0DB

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Close$Crypt$CertStore$Param$ObjectQuery$CertificateFromSubject
String ID:
API String ID: 2648890560-0
Opcode ID: dd340f12c46f8ade3d56be0200720292cd695ccf0ee2d10f6efc19cc81988070
Instruction ID: 8fbf69a37dc9056eb7c22486afdf5b880cfeee92e3a392baad4ac4d060ee42a0
Opcode Fuzzy Hash: dd340f12c46f8ade3d56be0200720292cd695ccf0ee2d10f6efc19cc81988070
Instruction Fuzzy Hash: 95025071E002099BEF14DFA8CD89BEEBBF8AF48314F144519E901F7281D7799A44DBA0

Function 00F12B30 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 107libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,87CF6CF3,00000000,?,?,?,00F13AE3,00000000,00000000,?,00000000,811C9DC5,path,00000004,?), ref: 00F12B73
GetProcAddress.KERNEL32(00000000,Dispatcher), ref: 00F12B98
GetProcAddress.KERNEL32(00000000,Controller), ref: 00F12BA7
GetProcAddress.KERNEL32(00000000,Release), ref: 00F12BC8
FreeLibrary.KERNEL32(00000000), ref: 00F12C46
FreeLibrary.KERNEL32(00000000), ref: 00F12CC3
GetLastError.KERNEL32(?,00F13AE3,00000000,00000000,?,00000000,811C9DC5,path,00000004), ref: 00F12CCB

Strings

Dispatcher, xrefs: 00F12B92
Failed to load library %s. Error 0x%08X, xrefs: 00F12CD5
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\Hound.cpp, xrefs: 00F12CE4
Release, xrefs: 00F12BC2
Controller, xrefs: 00F12B9E
NWebAdvisor::NXmlUpdater::InternalImpl::GetInstance, xrefs: 00F12CDF

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AddressLibraryProc$Free$ErrorLastLoad
String ID: Controller$Dispatcher$Failed to load library %s. Error 0x%08X$NWebAdvisor::NXmlUpdater::InternalImpl::GetInstance$Release$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\Hound.cpp
API String ID: 2058215185-435243658
Opcode ID: 1f023c18628d848874df8a879d289cbbd1e9ac3df50b9995807ff610740cac90
Instruction ID: 206338b22257e5e3b4107ef657f1334b7173963f2cde92c197bf34a6801ad898
Opcode Fuzzy Hash: 1f023c18628d848874df8a879d289cbbd1e9ac3df50b9995807ff610740cac90
Instruction Fuzzy Hash: 6D416CB19003189FDB008FA9C945BAEBBF4FF08720F15456AE505AB291D7B58940EFA5

Function 00EE6220 Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 428encryptionthreadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?), ref: 00EE6268
GetCurrentThreadId.KERNEL32 ref: 00EE6274
CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000,?,?,?,?,?,?,?,?), ref: 00EE63BF
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00EE63DF
CryptHashData.ADVAPI32(00000000,?,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00EE63FC

Strings

3c224a00-5d51-11cf-b3ca-000000000001, xrefs: 00EE671E
al exception rule %x:%x res %s, xrefs: 00EE632E

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Crypt$CurrentHash$AcquireContextCreateDataProcessThread
String ID: 3c224a00-5d51-11cf-b3ca-000000000001$al exception rule %x:%x res %s
API String ID: 3004248768-911235813
Opcode ID: 04263bea4d1a086e4f9b7cdb60be35a9b84ec5f98e34523af4391b5c2bfd2744
Instruction ID: f08f31663cae23d2ef9331ed2c98f584db33bffcbcffb5d15296db23006d3155
Opcode Fuzzy Hash: 04263bea4d1a086e4f9b7cdb60be35a9b84ec5f98e34523af4391b5c2bfd2744
Instruction Fuzzy Hash: E4F12835B012289FDB259F14DC95BEDBBB5BF58714F140099EA0AA7390CB70AE81DF90

Function 00EE67B0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 150encryptionthreadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00EE67F3
GetCurrentThreadId.KERNEL32 ref: 00EE67FB
CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00EE687F
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 00EE689F
CryptHashData.ADVAPI32(00000000,?,00000000,00000000), ref: 00EE68BC
CryptGetHashParam.ADVAPI32(00000000,00000002,?,00000010,00000000), ref: 00EE68DE
CryptDestroyHash.ADVAPI32(00000000), ref: 00EE68EF
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 00EE6902
DeviceIoControl.KERNEL32(00000000,9EDBA51C,00000000,00000000,00000000,00000000,?,00000000), ref: 00EE6951
DeviceIoControl.KERNEL32(?,9EDB651C,00000000,00000000,00000000,00000000,?,00000000), ref: 00EE6980

Strings

al exception rule %x:%x res %s, xrefs: 00EE6824
Freeing access handle %p, xrefs: 00EE67D0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Crypt$Hash$ContextControlCurrentDevice$AcquireCreateDataDestroyParamProcessReleaseThread
String ID: Freeing access handle %p$al exception rule %x:%x res %s
API String ID: 581428007-3582322424
Opcode ID: d53482783af40fc6365ad508699605807adb1377d75ddcaf7976c8f65234546a
Instruction ID: 682aa90a1a4cf1ee18b2c0edf405865bbb9837a4ab9ccb1aa530dd837e8899ce
Opcode Fuzzy Hash: d53482783af40fc6365ad508699605807adb1377d75ddcaf7976c8f65234546a
Instruction Fuzzy Hash: 3151A371A0021CABEB248F61DC46FEAB7B8AB14744F100595FA04F61C1DBB0EE84DF61

Function 00F1F150 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 342encryptionCOMMON

Download Yara Rule

APIs

CryptMsgGetParam.CRYPT32(00000000,00000005,00000000,?,?), ref: 00F1F442
CryptMsgGetParam.CRYPT32(00000000,00000006,00000000,00000000,00000004), ref: 00F1F488
CryptMsgGetParam.CRYPT32(?,00000006,00000000,00000000,00000000), ref: 00F1F4C6
CertGetSubjectCertificateFromStore.CRYPT32(?,00010001,?), ref: 00F1F527

Strings

1.3.6.1.4.1.311.2.4.1, xrefs: 00F1F1A3

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: CryptParam$CertCertificateFromStoreSubject
String ID: 1.3.6.1.4.1.311.2.4.1
API String ID: 738114118-146536318
Opcode ID: ba069c1087d0e60abfd533fe6072740231ea1e0e5883bc3dc3e7bbebf8fee726
Instruction ID: aff927f33e5f617dc8fbbcab09eefc2f421b022a03593c042d591180ab6196d7
Opcode Fuzzy Hash: ba069c1087d0e60abfd533fe6072740231ea1e0e5883bc3dc3e7bbebf8fee726
Instruction Fuzzy Hash: 1CD17C71D002199FDB24DF64C885BEEBBB5FF49720F1441A9E819A7350D734AA88DFA0

Function 00F6C65F Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 257COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F61CA9: GetLastError.KERNEL32(00000008,00000016,00000000,00F64E01), ref: 00F61CAE
Part of subcall function 00F61CA9: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00F61D4C

GetACP.KERNEL32(?,?,?,?,?,?,00F600E4,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00F6C720
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00F600E4,?,?,?,00000055,?,-00000050,?,?), ref: 00F6C74B
_wcschr.LIBVCRUNTIME ref: 00F6C7DF
_wcschr.LIBVCRUNTIME ref: 00F6C7ED
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00F6C8B4

Strings

utf8, xrefs: 00F6C81D

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: 69c2fd8f0036b0d610b07785996996c5ae22024b9f4a68c1a72aaebb265580f6
Instruction ID: de4733bb3942d38c12087f9dd38935f3f8f33d6d0558df805c386fca4b8596ad
Opcode Fuzzy Hash: 69c2fd8f0036b0d610b07785996996c5ae22024b9f4a68c1a72aaebb265580f6
Instruction Fuzzy Hash: 8671F772A00202ABD735AB35CC86BB777A8EF54710F14402AF9C5D7181EB79ED40ABE5

Function 00F6CE06 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00F6D124,00000002,00000000,?,?,?,00F6D124,?,00000000), ref: 00F6CE9F
GetLocaleInfoW.KERNEL32(?,20001004,00F6D124,00000002,00000000,?,?,?,00F6D124,?,00000000), ref: 00F6CEC8
GetACP.KERNEL32(?,?,00F6D124,?,00000000), ref: 00F6CEDD

Strings

OCP, xrefs: 00F6CE5A
ACP, xrefs: 00F6CE24

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: fcbdce48b252c4cd16ea81b5a3416ce5da890eb9c40c9c9b84d8c49741d46639
Instruction ID: f62ed1d7dd8ced3b7cbbed7ce50cca1892f2f0acdc6141e5419ac34e84ef4b8e
Opcode Fuzzy Hash: fcbdce48b252c4cd16ea81b5a3416ce5da890eb9c40c9c9b84d8c49741d46639
Instruction Fuzzy Hash: A9216D32E40105AAEB248F64C905BB7B2B6AB74B74B568464E9CAD7214E733DE41F3D0

Function 00F6CFDB Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F61CA9: GetLastError.KERNEL32(00000008,00000016,00000000,00F64E01), ref: 00F61CAE
Part of subcall function 00F61CA9: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00F61D4C

Part of subcall function 00F61CA9: _free.LIBCMT ref: 00F61D0B
Part of subcall function 00F61CA9: _free.LIBCMT ref: 00F61D41

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00F6D0E7
IsValidCodePage.KERNEL32(00000000), ref: 00F6D130
IsValidLocale.KERNEL32(?,00000001), ref: 00F6D13F
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00F6D187
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00F6D1A6

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID:
API String ID: 949163717-0
Opcode ID: e17e7c9b3a0a5906b074742c935ead21bcb3a006c6ac9a66359dc9061b75b16a
Instruction ID: 8a7bd69734adc5b321469730783dd89a2bab509a32630ab06de515d1fce62312
Opcode Fuzzy Hash: e17e7c9b3a0a5906b074742c935ead21bcb3a006c6ac9a66359dc9061b75b16a
Instruction Fuzzy Hash: 4B51AF72E0020AABEB10DFA4CC85BBA77B8BF09710F144429E951EB154EB719905EBA1

Function 00F77BC0 Relevance: 6.1, APIs: 4, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 00F77BE9
GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 00F77BFD
VirtualAlloc.KERNEL32(?,-00000001,00001000,00000004,?,?,?,0000001C), ref: 00F77C4D
VirtualProtect.KERNEL32(?,-00000001,00000104,?,?,?,0000001C), ref: 00F77C62

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Virtual$AllocInfoProtectQuerySystem
String ID:
API String ID: 3562403962-0
Opcode ID: 5a68087fece36de0a67d652e591661b782a2841643626460ff7d161f0d202c9b
Instruction ID: b143fd21095d069166d28a3ec0ab915bac69f8500ccbb70ba2eacf6c1da520ec
Opcode Fuzzy Hash: 5a68087fece36de0a67d652e591661b782a2841643626460ff7d161f0d202c9b
Instruction Fuzzy Hash: 5821A772E10218ABDB21EFA4DC85EEFB7BCEB4C750F054526E905E7140DA30D900EB91

Function 00F493F2 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00F493FE
IsDebuggerPresent.KERNEL32 ref: 00F494CA
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00F494EA
UnhandledExceptionFilter.KERNEL32(?), ref: 00F494F4

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 5924f1b963d9168b736bd63ce6977184af46605c8b60691bd2858856c53fafe9
Instruction ID: cdd5a49bac67e37552dd60a39d67b158f34fc0fa83faed0cf972dc470003bf1b
Opcode Fuzzy Hash: 5924f1b963d9168b736bd63ce6977184af46605c8b60691bd2858856c53fafe9
Instruction Fuzzy Hash: ED312975D4521C9BEB11DFA4DD89BCDBBF8AF08300F1041AAE40DAB250EB749A859F05

Function 00F6CA80 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00F61CA9: GetLastError.KERNEL32(00000008,00000016,00000000,00F64E01), ref: 00F61CAE
Part of subcall function 00F61CA9: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00F61D4C

Part of subcall function 00F61CA9: _free.LIBCMT ref: 00F61D0B
Part of subcall function 00F61CA9: _free.LIBCMT ref: 00F61D41

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F6CAD4
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F6CB1E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F6CBE4

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: InfoLocale$ErrorLast_free
String ID:
API String ID: 3140898709-0
Opcode ID: dc7879879cd1a44c1e7d754c31938a8c90e3a2b6e7ad8a1df9e11793a6566543
Instruction ID: 50a3f4312adec48af0ce4d03b05a90d89619511d6a95e76a1068e88631837296
Opcode Fuzzy Hash: dc7879879cd1a44c1e7d754c31938a8c90e3a2b6e7ad8a1df9e11793a6566543
Instruction Fuzzy Hash: 7E61B4719002179FDB289F28CC82BBA77A8FF05310F14417AEDC9C6585E778D980EB90

Function 00F4D453 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00FC80CC), ref: 00F4D54B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00FC80CC), ref: 00F4D555
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00FC80CC), ref: 00F4D562

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 5afed26812a61321a43f81a0852ca57bbc51dc901886a6b9d277ec9ebcdfdc15
Instruction ID: d5a9c1518ca295f343d8dd9f215e2040a7ffa04cd2af19a2bdca8dd093c5c8a3
Opcode Fuzzy Hash: 5afed26812a61321a43f81a0852ca57bbc51dc901886a6b9d277ec9ebcdfdc15
Instruction Fuzzy Hash: 8531B575D0122CABCB21DF28DC8979DBBB8AF18310F5041DAE80CA7250EB749F859F45

Function 00F49215 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00F4922B

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 517a1ac723f3a24a216698e24a166d096b101d7764fe63c04fa5670ec6ca18ed
Instruction ID: 164a467a61031ee9b7b2a05c27d628443c338822e20efb38e177009a4827cc2c
Opcode Fuzzy Hash: 517a1ac723f3a24a216698e24a166d096b101d7764fe63c04fa5670ec6ca18ed
Instruction Fuzzy Hash: 65518FB1E142099FEB15CFA9D9C57AABBF5FB44320F14866AD805EB290D3B49900DF50

Function 00F69BF0 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf2ef56ed630778a5fa113557980b5ff4fd19e552bf1eb550d8f5490ca7a7929
Instruction ID: a65c405c9357ee88412ab7efd5d81697f1d693731b530af34d8c487d50ed40f7
Opcode Fuzzy Hash: cf2ef56ed630778a5fa113557980b5ff4fd19e552bf1eb550d8f5490ca7a7929
Instruction Fuzzy Hash: DD31E772D04219AFCB24EFA9CC89DBB77BDEB84320F144569F81597241EA70AE40EB50

Function 00F6CCE0 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00F61CA9: GetLastError.KERNEL32(00000008,00000016,00000000,00F64E01), ref: 00F61CAE
Part of subcall function 00F61CA9: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00F61D4C

Part of subcall function 00F61CA9: _free.LIBCMT ref: 00F61D0B
Part of subcall function 00F61CA9: _free.LIBCMT ref: 00F61D41

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00F6CD34

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ErrorLast_free$InfoLocale
String ID:
API String ID: 2003897158-0
Opcode ID: 222756c35eb975fd019d24b2dc4bd6e81c1312056188439f983fd842978cf75d
Instruction ID: 418b965292066f52f5838ee236ced550af14716846ee5e948aa5295ef0e62267
Opcode Fuzzy Hash: 222756c35eb975fd019d24b2dc4bd6e81c1312056188439f983fd842978cf75d
Instruction Fuzzy Hash: 3721A772E10206ABDB289B25DC42ABA7BACEF44310F14007AFD96D7141EB35DD44AB90

Function 00F6C952 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F61CA9: GetLastError.KERNEL32(00000008,00000016,00000000,00F64E01), ref: 00F61CAE
Part of subcall function 00F61CA9: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00F61D4C

EnumSystemLocalesW.KERNEL32(00F6CA80,00000001,00000000,?,-00000050,?,00F6D0BB,00000000,?,?,?,00000055,?), ref: 00F6C9C4

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 5a125f7decf3747fa3ca0c647f1b1123a03ebcae3b4b105da792b8a1847ad607
Instruction ID: af2aedfa8300b33d1666fc7096aea64a87337ff83f6267c98fa22db29195613c
Opcode Fuzzy Hash: 5a125f7decf3747fa3ca0c647f1b1123a03ebcae3b4b105da792b8a1847ad607
Instruction Fuzzy Hash: 14114C376007055FDB18AF79C8915BABB91FF84328B18442DE9C787740D375B902D780

Function 00F6CF0C Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00F61CA9: GetLastError.KERNEL32(00000008,00000016,00000000,00F64E01), ref: 00F61CAE
Part of subcall function 00F61CA9: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00F61D4C

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00F6CC9C,00000000,00000000,?), ref: 00F6CF38

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 9aea4094ea010dae392126f64eb3805a1d2cefda3228b2a5e6451550ad7d7296
Instruction ID: aba035eebe7bb11d608e658ab31b2c1b00a52f9504bd38f90d9b0ccb02f6ae72
Opcode Fuzzy Hash: 9aea4094ea010dae392126f64eb3805a1d2cefda3228b2a5e6451550ad7d7296
Instruction Fuzzy Hash: 59F02D36D00115BBDB245765DC05BFB7B59EB40764F054424EDD5A3180DA34FE41E6F0

Function 00F6C9ED Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F61CA9: GetLastError.KERNEL32(00000008,00000016,00000000,00F64E01), ref: 00F61CAE
Part of subcall function 00F61CA9: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00F61D4C

EnumSystemLocalesW.KERNEL32(00F6CCE0,00000001,?,?,-00000050,?,00F6D07F,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00F6CA37

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 7bb915888baf1ba8b2870a09d9f005d0994889e2ef0fef7f57c689b602371632
Instruction ID: a87066e584626d8bc7a4441cfccf9ad8800de245e0740c52e730ec3d3beb1e53
Opcode Fuzzy Hash: 7bb915888baf1ba8b2870a09d9f005d0994889e2ef0fef7f57c689b602371632
Instruction Fuzzy Hash: ADF0F6367003485FDB149F79DC91ABA7B95FF81368B09842DF9C58B690C6799C01E790

Function 00F63F6D Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F5CD41: EnterCriticalSection.KERNEL32(?,?,00F5F653,00000000,00FBC338,0000000C,00F5F61A,?,?,00F63400,?,?,00F61E4B,00000001,00000364,00000006), ref: 00F5CD50

EnumSystemLocalesW.KERNEL32(00F63F60,00000001,00FBC4B8,0000000C,00F6447F,00000000), ref: 00F63FA5

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 6dbb25a6f16395fb3f73d000674dadca78346ba5836f5a1442b8b20b2f47aab7
Instruction ID: 087d6eeea1c3d97df968b9757d5bb230386fe78964bd1951d970603755c60965
Opcode Fuzzy Hash: 6dbb25a6f16395fb3f73d000674dadca78346ba5836f5a1442b8b20b2f47aab7
Instruction Fuzzy Hash: 26F04F32A44208DFD704DF98EC46B9D7BF0EB08721F10412AF910DB2A0CBB94A04EF51

Function 00F6C907 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F61CA9: GetLastError.KERNEL32(00000008,00000016,00000000,00F64E01), ref: 00F61CAE
Part of subcall function 00F61CA9: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00F61D4C

EnumSystemLocalesW.KERNEL32(00F6C860,00000001,?,?,?,00F6D0DD,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00F6C93E

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 9c0dd3f57aa263e004977511f6666228699639096475cb50a595aa9a023108a1
Instruction ID: 458a6d622bb48ca7dea0cc49b97881f33927fbde172cdd14f4bfc230972e0f5d
Opcode Fuzzy Hash: 9c0dd3f57aa263e004977511f6666228699639096475cb50a595aa9a023108a1
Instruction Fuzzy Hash: C5F0AB3670020957CB159F7ADC066BABF94EFC1B20F0A4059FE858B240C232D942E7D0

Function 00F47E28 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,00000022,00000000,00000002,?,?,00F45D32,00000000,?,00000004,00F44946,?,00000004,00F44D77,00000000,00000000), ref: 00F47E40

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: c1f06274abcda356fe35698dacc3218e43fad5b90dc7ddfb88b91ede44f3dbfd
Instruction ID: f72c6bd3adc570adf2cb512fbd6c85e7d246a4e3b68c36c30f0c7a7ae07e6cbd
Opcode Fuzzy Hash: c1f06274abcda356fe35698dacc3218e43fad5b90dc7ddfb88b91ede44f3dbfd
Instruction Fuzzy Hash: 80E01232A54304EAEB15ABB89E1FFBB7A98970171AF504391A902E42E1D7A5CF10B191

Function 00F645DA Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00F60C61,?,20001004,00000000,00000002,?,?,00F6024C), ref: 00F6460E

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: a65b0db8f4836f6582f1a686928f9bd50fbb609fe0f5eb40008f69afa74954bc
Instruction ID: 4f4d63f1192dd5e670aa84ea4023d18b354e518fa5d379f1c8f57b838e265196
Opcode Fuzzy Hash: a65b0db8f4836f6582f1a686928f9bd50fbb609fe0f5eb40008f69afa74954bc
Instruction Fuzzy Hash: 17E01A32500128BBCF123F61EC04EEE7E19AF46B61F014010F915661618B76A920BBD4

Function 00F1E610 Relevance: 1.5, APIs: 1, Instructions: 6encryptionCOMMON

Download Yara Rule

APIs

CryptMsgClose.CRYPT32 ref: 00F1E617

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: CloseCrypt
String ID:
API String ID: 1563465135-0
Opcode ID: ed26ad20ccf053b329e46be32285530aa7dffabedc8b07fa2e0a54fbe27879e7
Instruction ID: 209bd25e82c09e2f2b03d51e502e34a45c3386b4da7bc1e44d6dad0f3c175228
Opcode Fuzzy Hash: ed26ad20ccf053b329e46be32285530aa7dffabedc8b07fa2e0a54fbe27879e7
Instruction Fuzzy Hash: 26B011B0A002008BAF00AB328A0CC0232A8AAA03023A80088A800C2020EAA0C800EA28

Function 00F49586 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000895A0,00F48A95), ref: 00F4958B

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 494a7cd34f120a499dfb2c1cee31b2773458a79805bf309e0ae09fe216e5bef2
Instruction ID: 3a3f828ef11b3e0f6605cc368e3bed50e2a2b3f52c0eb07ecdee0ae53b8ca9dd
Opcode Fuzzy Hash: 494a7cd34f120a499dfb2c1cee31b2773458a79805bf309e0ae09fe216e5bef2
Instruction Fuzzy Hash:

Function 00ED463F Relevance: 1.3, APIs: 1, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F488FA: EnterCriticalSection.KERNEL32(00FC742C,?,?,?,00EE402B,00FC827C,87CF6CF3,?,00EE1171,?), ref: 00F48905
Part of subcall function 00F488FA: LeaveCriticalSection.KERNEL32(00FC742C,?,?,?,00EE402B,00FC827C,87CF6CF3,?,00EE1171,?), ref: 00F48942

GetProcessHeap.KERNEL32(?,?,?,00EDE97C,87CF6CF3,?,?,?,?,00F79590,000000FF), ref: 00ED4676

Part of subcall function 00F488B0: EnterCriticalSection.KERNEL32(00FC742C,?,?,00EE4086,00FC827C,00F868E0,?), ref: 00F488BA
Part of subcall function 00F488B0: LeaveCriticalSection.KERNEL32(00FC742C,?,?,00EE4086,00FC827C,00F868E0,?), ref: 00F488ED
Part of subcall function 00F488B0: RtlWakeAllConditionVariable.NTDLL ref: 00F48964

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionHeapProcessVariableWake
String ID:
API String ID: 325507722-0
Opcode ID: fdb574d9f97a55ebf8081f397a3c0950fd689df5ce1a28971317e4bc341676d4
Instruction ID: 84f7690e407f935bd3673a8bb8fb995d9c763ff5d30aa66f31cb9881a9130f94
Opcode Fuzzy Hash: fdb574d9f97a55ebf8081f397a3c0950fd689df5ce1a28971317e4bc341676d4
Instruction Fuzzy Hash: 7611D072584609DFD750AB28EE07F4637A0B7403A4F15002AEA18832A2DF38684FBB14

Function 00F64619 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

GetSystemTimePreciseAsFileTime, xrefs: 00F64629

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID:
String ID: GetSystemTimePreciseAsFileTime
API String ID: 0-595813830
Opcode ID: 4ea0cb3c2a9ce70031a1e824e6dfe4bfc17df9361d62e67e10215477d03dfce5
Instruction ID: 04c072d3749d985209afc39c2445bf8eb2993dde65c2fbe133f424f9ae8e195c
Opcode Fuzzy Hash: 4ea0cb3c2a9ce70031a1e824e6dfe4bfc17df9361d62e67e10215477d03dfce5
Instruction Fuzzy Hash: F3E0C232B8022873862036D4AC06EBABF14CB52BB1F040062FA0866141C565A810A7DA

Function 00F67D23 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d6ddecfb8a4370acc9962cf0ca12f2d55add910477d6cab05f17c27bbd7655
Instruction ID: c51bd739d5a1099c6b76a9aa4a118441276a3b5063b38a0ec072da9f5228d0cb
Opcode Fuzzy Hash: a3d6ddecfb8a4370acc9962cf0ca12f2d55add910477d6cab05f17c27bbd7655
Instruction Fuzzy Hash: 4BF09672A487209BC726EA5CCA19FB97798EF45B54F110555F601D7360C6A1DE00F7C0

Function 00F67CAE Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28a00d5818734d71ecd76fa30cb239bbbab511f0cd29894e5aef6bc64752bb2c
Instruction ID: 734c067fa757dc3bd777cfadf4327a10aa868d0ac8dcc2ef1f9fb0e09128412e
Opcode Fuzzy Hash: 28a00d5818734d71ecd76fa30cb239bbbab511f0cd29894e5aef6bc64752bb2c
Instruction Fuzzy Hash: 90F03932A54324AFCB26EB4CC905B8973ACEB49B68F210096F401E7251CAB4EE40E7C0

Function 00F67C6A Relevance: .0, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 323438df6efe252dcc720b1c37f9aa091fb95049eb557d901b51cbfc2111bdf1
Instruction ID: 013603a9f68cb8fbd83d7ccfb4b826abfd6f75d3f5ce3d4f74940a165f2261ba
Opcode Fuzzy Hash: 323438df6efe252dcc720b1c37f9aa091fb95049eb557d901b51cbfc2111bdf1
Instruction Fuzzy Hash: 0AF0E531A25324EFCB22D74CD906F4873ACEB44BA5F110056F000EB240C670ED41E7D0

Function 00F67CF2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e987def8769bcac00432ddd4e9e7791ba2548d1561dedc4a3590fd0733c09369
Instruction ID: fb819a297a9b99f113ffeb0043b5812ed337026746fdcb192763770d8a14a4be
Opcode Fuzzy Hash: e987def8769bcac00432ddd4e9e7791ba2548d1561dedc4a3590fd0733c09369
Instruction Fuzzy Hash: 55E08C32915228EBCB14EB8CC94499AF3ECEB49B14B210896B501D3250C274DE00E7D0

Function 00F36AB0 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 167libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00F36AB6
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00F36AC4
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00F36AD5
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00F36AE6
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00F36AF7
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00F36B08
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 00F36B19
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00F36B2A
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 00F36B3B
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00F36B4C
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00F36B5D
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00F36B6E
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00F36B7F
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00F36B90
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00F36BA1
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00F36BB2
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00F36BC3
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00F36BD4
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 00F36BE5
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 00F36BF6
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 00F36C07
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00F36C18
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 00F36C29
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 00F36C3A
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 00F36C4B
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00F36C5C
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00F36C6D
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 00F36C7E
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00F36C8F
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00F36CA0
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 00F36CB1
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00F36CC2
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 00F36CD3
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00F36CE4
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 00F36CF5
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 00F36D06
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 00F36D17
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 00F36D28
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 00F36D39
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 00F36D4A
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 00F36D5B

Strings

CloseThreadpoolWork, xrefs: 00F36D1D
AcquireSRWLockExclusive, xrefs: 00F36CB7
InitializeSRWLock, xrefs: 00F36CA6
GetSystemTimePreciseAsFileTime, xrefs: 00F36C51
CloseThreadpoolTimer, xrefs: 00F36B85
GetCurrentProcessorNumber, xrefs: 00F36BEB
CompareStringEx, xrefs: 00F36D2E
kernel32.dll, xrefs: 00F36AB1
CreateThreadpoolWait, xrefs: 00F36B96
WakeConditionVariable, xrefs: 00F36C73
InitOnceExecuteOnce, xrefs: 00F36B0E
CreateSymbolicLinkW, xrefs: 00F36C01
GetTickCount64, xrefs: 00F36C1E
CreateSemaphoreExW, xrefs: 00F36B41
CloseThreadpoolWait, xrefs: 00F36BB8
SetThreadpoolWait, xrefs: 00F36BA7
GetCurrentPackageId, xrefs: 00F36C0D
InitializeConditionVariable, xrefs: 00F36C62
SetThreadpoolTimer, xrefs: 00F36B63
FlsSetValue, xrefs: 00F36AEC
TryAcquireSRWLockExclusive, xrefs: 00F36CC8
SleepConditionVariableCS, xrefs: 00F36C95
LCMapStringEx, xrefs: 00F36D50
FlsAlloc, xrefs: 00F36ABE
InitializeCriticalSectionEx, xrefs: 00F36AFD
FlsFree, xrefs: 00F36ACA
WakeAllConditionVariable, xrefs: 00F36C84
GetLocaleInfoEx, xrefs: 00F36D3F
GetFileInformationByHandleEx, xrefs: 00F36C2F
FreeLibraryWhenCallbackReturns, xrefs: 00F36BDA
CreateSemaphoreW, xrefs: 00F36B30
CreateEventExW, xrefs: 00F36B1F
SetFileInformationByHandle, xrefs: 00F36C40
FlushProcessWriteBuffers, xrefs: 00F36BC9
WaitForThreadpoolTimerCallbacks, xrefs: 00F36B74
SubmitThreadpoolWork, xrefs: 00F36D0C
SleepConditionVariableSRW, xrefs: 00F36CEA
ReleaseSRWLockExclusive, xrefs: 00F36CD9
CreateThreadpoolTimer, xrefs: 00F36B52
FlsGetValue, xrefs: 00F36ADB
CreateThreadpoolWork, xrefs: 00F36CFB

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: 42599a1a984b67301caca933708be0eaead7640c2005864846e273aa30d134a5
Instruction ID: 3d192668b0116d0fa0cc0ad4fcc99527c5ee6b224cdf1a5e862c3cd278577215
Opcode Fuzzy Hash: 42599a1a984b67301caca933708be0eaead7640c2005864846e273aa30d134a5
Instruction Fuzzy Hash: 39611671996319ABEB40AFB5AD4EDE63FA8BE1A7023140D2AF511D3161D7F48040FF52

Function 00F3E7FF Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 415COMMON

Download Yara Rule

APIs

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

ctype.LIBCPMT ref: 00F3E830

Part of subcall function 00ED3055: __Getctype.LIBCPMT ref: 00ED3064

Part of subcall function 00F37D5B: __EH_prolog3.LIBCMT ref: 00F37D62
Part of subcall function 00F37D5B: std::_Lockit::_Lockit.LIBCPMT ref: 00F37D6C
Part of subcall function 00F37D5B: std::_Lockit::~_Lockit.LIBCPMT ref: 00F37DDD

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F3E83E
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F3E855
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F3E89C
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F3E8CF
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F3E921
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F3E936
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F3E955
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F3E974
collate.LIBCPMT ref: 00F3E97E
__Getcoll.LIBCPMT ref: 00F3E9C0
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F3E9D4
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F3EABD
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F3EB18
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F3EB74
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F3EB89

Part of subcall function 00F3816E: __EH_prolog3.LIBCMT ref: 00F38175
Part of subcall function 00F3816E: std::_Lockit::_Lockit.LIBCPMT ref: 00F3817F
Part of subcall function 00F3816E: std::_Lockit::~_Lockit.LIBCPMT ref: 00F381F0

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F3EBA8

Part of subcall function 00F383C2: __EH_prolog3.LIBCMT ref: 00F383C9
Part of subcall function 00F383C2: std::_Lockit::_Lockit.LIBCPMT ref: 00F383D3
Part of subcall function 00F383C2: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38444

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F3EBC7

Part of subcall function 00F3832D: __EH_prolog3.LIBCMT ref: 00F38334
Part of subcall function 00F3832D: std::_Lockit::_Lockit.LIBCPMT ref: 00F3833E
Part of subcall function 00F3832D: std::_Lockit::~_Lockit.LIBCPMT ref: 00F383AF

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F3EBE6
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F3EC38
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F3EC7D

Part of subcall function 00F3DDD2: __EH_prolog3.LIBCMT ref: 00F3DDD9
Part of subcall function 00F3DDD2: _Getvals.LIBCPMT ref: 00F3DE2B
Part of subcall function 00F3DDD2: _Mpunct.LIBCPMT ref: 00F3DE66
Part of subcall function 00F3DDD2: _Mpunct.LIBCPMT ref: 00F3DE80

Part of subcall function 00F38044: __EH_prolog3.LIBCMT ref: 00F3804B
Part of subcall function 00F38044: std::_Lockit::_Lockit.LIBCPMT ref: 00F38055
Part of subcall function 00F38044: std::_Lockit::~_Lockit.LIBCPMT ref: 00F380C6

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F3EA41

Part of subcall function 00F35688: Concurrency::cancel_current_task.LIBCPMT ref: 00F35748
Part of subcall function 00F35688: __EH_prolog3.LIBCMT ref: 00F35755
Part of subcall function 00F35688: std::locale::_Locimp::_Makeloc.LIBCPMT ref: 00F35781
Part of subcall function 00F35688: std::_Locinfo::~_Locinfo.LIBCPMT ref: 00F3578C

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F3E9EB

Part of subcall function 00F35688: __EH_prolog3.LIBCMT ref: 00F3568F
Part of subcall function 00F35688: std::_Lockit::_Lockit.LIBCPMT ref: 00F35699
Part of subcall function 00F35688: std::_Lockit::~_Lockit.LIBCPMT ref: 00F3573D

Part of subcall function 00F37F1A: __EH_prolog3.LIBCMT ref: 00F37F21
Part of subcall function 00F37F1A: std::_Lockit::_Lockit.LIBCPMT ref: 00F37F2B
Part of subcall function 00F37F1A: std::_Lockit::~_Lockit.LIBCPMT ref: 00F37F9C

std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F3EA2C
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F3EA8A

Strings

u{jD, xrefs: 00F3EC0A

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Locimp::_std::locale::_$AddfacLocimp_$std::_$Lockit$H_prolog3$Lockit::_Lockit::~_$Mpunct$Concurrency::cancel_current_taskGetcollGetctypeGetvalsLocinfoLocinfo::~_Makeloccollatectype
String ID: u{jD
API String ID: 207879573-4045313965
Opcode ID: f0c1b4114d2bb2fb419ff0fca3ac74861d15f820efc8ac6d39c2dd2e4abc84b3
Instruction ID: c6c3a1c95bc6783080d59e96c3be3549fe7aeecbae31e10d1d16a09ed0698638
Opcode Fuzzy Hash: f0c1b4114d2bb2fb419ff0fca3ac74861d15f820efc8ac6d39c2dd2e4abc84b3
Instruction Fuzzy Hash: A7D1B1B1C05216AEDB21AF648C06ABE7EA5EF417B0F14442DF9446B3C2DB394D01B7E2

Function 00F45D66 Relevance: 30.3, APIs: 20, Instructions: 287COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F45D6D
collate.LIBCPMT ref: 00F45D76

Part of subcall function 00F44A42: __EH_prolog3_GS.LIBCMT ref: 00F44A49
Part of subcall function 00F44A42: __Getcoll.LIBCPMT ref: 00F44AAD
Part of subcall function 00F44A42: std::_Locinfo::~_Locinfo.LIBCPMT ref: 00F44AC9

__Getcoll.LIBCPMT ref: 00F45DBC
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F45DD0
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F45DE5
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F45E23
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F45E36
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F45E7C
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F45EB0
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F45F6B
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F45F7E
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F45F9B
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F45FB8
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F45FD5
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F45F0D

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

numpunct.LIBCPMT ref: 00F46014
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F46024
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F46068
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F4607B
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F46098

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AddfacLocimp::_Locimp_std::locale::_$std::_$GetcollLockit$H_prolog3H_prolog3_LocinfoLocinfo::~_Lockit::_Lockit::~_collatenumpunct
String ID:
API String ID: 2009638416-0
Opcode ID: c2abeb88109a05b6d91f952a66d8e122908c448862e058086961f51c17eb09b6
Instruction ID: f861e8438c5236ee86cabf38300824b90aaf45e07cf65db1dc0e05a396e739ac
Opcode Fuzzy Hash: c2abeb88109a05b6d91f952a66d8e122908c448862e058086961f51c17eb09b6
Instruction Fuzzy Hash: E991E5B1D05711ABEB247B748C46B7F7EA8DF51B60F14442DFC05AB283EB784901B6A2

Function 00F20780 Relevance: 30.0, APIs: 2, Strings: 15, Instructions: 250COMMON

Download Yara Rule

Strings

Source, xrefs: 00F207D1
DeleteFile, xrefs: 00F2086B
Unable to create destination directory (%d), xrefs: 00F2099B
Failed to parse DeleteFile as a boolean - default to false, xrefs: 00F208D9
Unable to substitute DeleteFile attribute, xrefs: 00F208BC
DestDir, xrefs: 00F20813
Unable to read Source and/or DestDir attribute of EXTRACT_CAB_LOCAL command, xrefs: 00F20A3D, 00F20A42
NWebAdvisor::NXmlUpdater::CExtractCabLocalCommand::ExecuteExtractCabLocalCommand, xrefs: 00F2095D, 00F209A2, 00F209D9, 00F20A14
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\ExtractCabLocalCommand.cpp, xrefs: 00F208E5, 00F20962, 00F209A7, 00F209DE, 00F20A19, 00F20A49
Failed to delete src cab (%d), xrefs: 00F20A0D
Failed to extract cab (%s), xrefs: 00F209D2
Unable to verify signature for file: %s, xrefs: 00F20956
Unable to substitute variables for the EXTRACT_CAB_LOCAL command, xrefs: 00F20A31
invalid substitutor, xrefs: 00F207C5
NWebAdvisor::NXmlUpdater::CExtractCabLocalCommand::Execute, xrefs: 00F208E0, 00F20A44

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID:
String ID: DeleteFile$DestDir$Failed to delete src cab (%d)$Failed to extract cab (%s)$Failed to parse DeleteFile as a boolean - default to false$NWebAdvisor::NXmlUpdater::CExtractCabLocalCommand::Execute$NWebAdvisor::NXmlUpdater::CExtractCabLocalCommand::ExecuteExtractCabLocalCommand$Source$Unable to create destination directory (%d)$Unable to read Source and/or DestDir attribute of EXTRACT_CAB_LOCAL command$Unable to substitute DeleteFile attribute$Unable to substitute variables for the EXTRACT_CAB_LOCAL command$Unable to verify signature for file: %s$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\ExtractCabLocalCommand.cpp$invalid substitutor
API String ID: 0-2605792675
Opcode ID: d35444ed6ae49ff8480af22c1f495a22bd0ac7a9febed23030b72b34848e5379
Instruction ID: 28aeb08db670dd9d5c1c987b183d63420a8e9b79fbe8838a5dcbb8eba49fdfb2
Opcode Fuzzy Hash: d35444ed6ae49ff8480af22c1f495a22bd0ac7a9febed23030b72b34848e5379
Instruction Fuzzy Hash: 0A910272E40304ABEF10DF94EC52BAEB775AF14714F400019F405672C2DFB9A949EBA2

Function 00EEA118 Relevance: 28.3, APIs: 10, Strings: 6, Instructions: 273COMMON

Download Yara Rule

APIs

Part of subcall function 00EEDE80: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEDF0C

__Mtx_unlock.LIBCPMT ref: 00EEA143
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEA1AA

Part of subcall function 00EEE0D0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEE161

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000), ref: 00EEA1C1
CloseHandle.KERNEL32(?), ref: 00EEA1DD
CreateSemaphoreW.KERNEL32(00000000,00000000,000003E8,00000000), ref: 00EEA24C
CloseHandle.KERNEL32(?), ref: 00EEA268
ReleaseSemaphore.KERNEL32(?,00000001,00000000,?,00000000), ref: 00EEA410
GetLastError.KERNEL32(?,00000001), ref: 00EEA46F

Strings

E, xrefs: 00EEA29C
Failed to release semaphore. Error: , xrefs: 00EEA44F
Failed to initialize event sender, xrefs: 00EEA180
V, xrefs: 00EEA443
Failed to create event semaphore, xrefs: 00EEA2A8
Failed to create stop event, xrefs: 00EEA21D

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$CloseCreateHandleSemaphore$ErrorEventLastMtx_unlockRelease
String ID: E$Failed to create event semaphore$Failed to create stop event$Failed to initialize event sender$Failed to release semaphore. Error: $V
API String ID: 1380281556-3274429967
Opcode ID: 7ca2daa9a3c912c1476baaa772669750fe8e096295e42a65cb6d2e42c874ca37
Instruction ID: c25112ac13cbaf4e41316bb2c76b0dd6c3154169a0c24803dca02e7088f4ed7d
Opcode Fuzzy Hash: 7ca2daa9a3c912c1476baaa772669750fe8e096295e42a65cb6d2e42c874ca37
Instruction Fuzzy Hash: 3AB1C0B0A00249DBDB14EFA0CC56BEDB7B5FF44304F04426EE81977281EB756A49DB92

Function 00F20FA0 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 141filelibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,87CF6CF3,000000FF,00000000,00000000,00F7DF30,000000FF), ref: 00F20FE8
GetProcAddress.KERNEL32(00000000,CreateFileTransactedW), ref: 00F20FF8
CreateFileW.KERNEL32(000000FF,00000001,00000001,00000000,00000003,00000080,00000000,87CF6CF3,000000FF,00000000,00000000,00F7DF30,000000FF), ref: 00F21037
GetLastError.KERNEL32 ref: 00F21058
GetFileSize.KERNEL32(?,?), ref: 00F21088
CreateFileMappingW.KERNEL32(?,00000000,00000002,?,00000000,00000000), ref: 00F2109C
MapViewOfFileEx.KERNEL32(00000000,00000004,00000000,00000000,?,00000000), ref: 00F210D9
CloseHandle.KERNEL32(?), ref: 00F210F0

Strings

NWebAdvisor::CFileMemMap::Init, xrefs: 00F21066, 00F21108
CreateFileTransactedW, xrefs: 00F20FF2
Failed to map file to memory, xrefs: 00F21101
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\FileMemMap.h, xrefs: 00F2106B, 00F2110D
Failed to open the file: %d, xrefs: 00F2105F
kernel32.dll, xrefs: 00F20FE3

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: File$CreateHandle$AddressCloseErrorLastMappingModuleProcSizeView
String ID: CreateFileTransactedW$Failed to map file to memory$Failed to open the file: %d$NWebAdvisor::CFileMemMap::Init$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\FileMemMap.h$kernel32.dll
API String ID: 2423579280-2843467768
Opcode ID: b6eef1b0f24e7efa0ff50b0f262504decb5c7bdd8b639b5138c1b070751ad8b9
Instruction ID: f4a67bfb44fb768f38d33b5729df570a0d4e4dd848332c58a36ea005b471fa29
Opcode Fuzzy Hash: b6eef1b0f24e7efa0ff50b0f262504decb5c7bdd8b639b5138c1b070751ad8b9
Instruction Fuzzy Hash: BD411971B40715BBEB209F64DC06F6A77A8FB14B20F100618FA11E62C0D7F5A940AB99

Function 00F22FD0 Relevance: 22.9, APIs: 3, Strings: 10, Instructions: 177registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,00000000,00000000,?,00000000,00000028,00000028,00000000,00000000,Name,00000004,00000000,00000000,Key,00000003,87CF6CF3), ref: 00F230F1
RegCloseKey.ADVAPI32(00000008), ref: 00F2317C

Strings

Unable to read Key or Name for DEL_REG_VALUE command, xrefs: 00F231C5
Unable to substitute variables for the DEL_REG_VALUE command, xrefs: 00F231BC
Error opening HKLM registry key: %d, xrefs: 00F230FC
Invalid substitutor, xrefs: 00F23005
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\delete_registry_value_command.cpp, xrefs: 00F23108, 00F23163, 00F231A9, 00F231D1
Name, xrefs: 00F23055
NWebAdvisor::NXmlUpdater::parse_and_execute, xrefs: 00F23103, 00F2315E, 00F231A4, 00F231CC
Key, xrefs: 00F23013
Cannnot delete registry value. Key or value not found. Key: %s Value: %s, xrefs: 00F23157
Error (%d) deleting registry value (%s) in key: %s, xrefs: 00F2319D

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: CloseOpen
String ID: Cannnot delete registry value. Key or value not found. Key: %s Value: %s$Error (%d) deleting registry value (%s) in key: %s$Error opening HKLM registry key: %d$Invalid substitutor$Key$NWebAdvisor::NXmlUpdater::parse_and_execute$Name$Unable to read Key or Name for DEL_REG_VALUE command$Unable to substitute variables for the DEL_REG_VALUE command$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\delete_registry_value_command.cpp
API String ID: 47109696-1081640057
Opcode ID: faaca42f8c54e1575a9838be70e8b867cf72a528abc920ec8006d96a24a85d90
Instruction ID: 940b9ecfca794ee0abf15a455635d767697dc11bfb62e9305e8bae9629639a4f
Opcode Fuzzy Hash: faaca42f8c54e1575a9838be70e8b867cf72a528abc920ec8006d96a24a85d90
Instruction Fuzzy Hash: F151D5B0E41218ABEF14DF50ED46FAE77B9EB05B04F140518F500772C1DB79AA15EBA2

Function 00F08400 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,00FBF278,00000023,00000001,00000004,00000000,00000000), ref: 00F08462
CreateDirectoryW.KERNEL32(00FBF278,00000000,00FBF278,00000104,\McAfee\), ref: 00F08491
GetLastError.KERNEL32 ref: 00F0849D
CreateDirectoryW.KERNEL32(00FBF278,00000000,00FBF278,00000104,00FBF070), ref: 00F084C5
GetLastError.KERNEL32 ref: 00F084CB
GetModuleFileNameW.KERNEL32(?,00000104), ref: 00F084FC
StrRChrW.SHLWAPI(?,00000000,0000005C), ref: 00F08511
CreateDirectoryW.KERNEL32(00FBF278,00000000,00FBF278,00000104,00000000), ref: 00F0852E
GetLastError.KERNEL32 ref: 00F08534
GetTickCount.KERNEL32 ref: 00F085B9

Strings

\log.txt, xrefs: 00F08556
%uFile:%sFunction:%sLine:%d, xrefs: 00F085C5
\McAfee\, xrefs: 00F08470

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: CreateDirectoryErrorLast$CountFileFolderModuleNamePathSpecialTick
String ID: %uFile:%sFunction:%sLine:%d$\McAfee\$\log.txt
API String ID: 922589859-3713371193
Opcode ID: e162854ddb2b22e2928121e1727e6e9636166029856e53d24ef817d9fb6716e3
Instruction ID: f94bcdc67358a8ec9e3b59624a9eb4d01a3ee37d6bbe5fdd4e8a992b03e2fab3
Opcode Fuzzy Hash: e162854ddb2b22e2928121e1727e6e9636166029856e53d24ef817d9fb6716e3
Instruction Fuzzy Hash: 5251F9B5A8030CABEF20AB65DC86FE977B4AB14750F1405A0F948B71D1CAB09D85BF91

Function 00F5CE60 Relevance: 22.9, APIs: 15, Instructions: 357COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F5CECF
_free.LIBCMT ref: 00F5CEE5
_free.LIBCMT ref: 00F5CEF8
_free.LIBCMT ref: 00F5CF0D
_free.LIBCMT ref: 00F5CF22
GetCPInfo.KERNEL32(?,?), ref: 00F5CF6C

Part of subcall function 00F6826E: _free.LIBCMT ref: 00F682D9

_free.LIBCMT ref: 00F5D1D7
_free.LIBCMT ref: 00F5D1EA
_free.LIBCMT ref: 00F5D1F8
_free.LIBCMT ref: 00F5D203
_free.LIBCMT ref: 00F5D245
_free.LIBCMT ref: 00F5D24D
_free.LIBCMT ref: 00F5D253
_free.LIBCMT ref: 00F5D25B
_free.LIBCMT ref: 00F5D269

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 854b98adf252ad5a8097c51927b2083e1693e1b1746bdb76ef94ecf14cce6fb5
Instruction ID: b7a240c5477afcabfb4f132ec3c3d047978fafd95f90699f9d8276c5e88c2568
Opcode Fuzzy Hash: 854b98adf252ad5a8097c51927b2083e1693e1b1746bdb76ef94ecf14cce6fb5
Instruction Fuzzy Hash: 01D1AD71D01705AFDB21CFB8C881BEEBBF5BF48310F144129E995A7282D774A849EB60

Function 00EEB090 Relevance: 21.4, APIs: 6, Strings: 6, Instructions: 434COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEB311
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEB3AA
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEB43B
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEB21A

Part of subcall function 00ED9BB0: InitOnceBeginInitialize.KERNEL32(00FC80C4,00000000,87CF6CF3,00000000,87CF6CF3,00EDA219,00FC80CC,?,?,?,?,?,?,00EDA219,?,?), ref: 00ED9BE5
Part of subcall function 00ED9BB0: InitOnceComplete.KERNEL32(00FC80C4,00000000,00000000), ref: 00ED9C1D

Part of subcall function 00ED9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00ED9A12

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEB64F
Concurrency::cancel_current_task.LIBCPMT ref: 00EEB67C

Part of subcall function 00EF1230: InitOnceBeginInitialize.KERNEL32(00FC823C,00000000,?,00000000,?,?,?,?,00000000,00000000,?,87CF6CF3,?,?), ref: 00EF125A
Part of subcall function 00EF1230: InitOnceComplete.KERNEL32(00FC823C,00000000,00000000), ref: 00EF1278

Strings

HMAC creator initialization failed, xrefs: 00EEB17D
Failed to allocate HMAC buffer, xrefs: 00EEB276
Failed to allocate HMAC base64 buffer, xrefs: 00EEB37A
Error unable to encode the hash in Base64, xrefs: 00EEB40B
HMAC failed to get digest size, xrefs: 00EEB1EA
Invalid arguments supplied to HMACSha256 hash., xrefs: 00EEB61C

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$InitOnce$BeginCompleteInitialize$Concurrency::cancel_current_task
String ID: Error unable to encode the hash in Base64$Failed to allocate HMAC base64 buffer$Failed to allocate HMAC buffer$HMAC creator initialization failed$HMAC failed to get digest size$Invalid arguments supplied to HMACSha256 hash.
API String ID: 1609125544-1991084185
Opcode ID: 7c07b92d7a55c78e43cd70699d72049656adb02f2ae15e67938c2ab1f7070317
Instruction ID: 0f903a6a74c7c83d37456fc2c75258b0de693477610fdb09d06d2fef4650ea40
Opcode Fuzzy Hash: 7c07b92d7a55c78e43cd70699d72049656adb02f2ae15e67938c2ab1f7070317
Instruction Fuzzy Hash: B6F1CD70D002989FCF14DBA4CC55BEEBBB5EF58304F104199E805BB382EB749A89DB51

Function 00F55A69 Relevance: 21.4, APIs: 2, Strings: 10, Instructions: 403COMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000006,?,?,?,?,?,?,?,?,?,?,?,00000003,?,?), ref: 00F55B0F
GetModuleFileNameW.KERNEL32(?,?,00000105,?,?,?,?,?,?,?,?,?,00000003,?,?), ref: 00F55B33

Strings

Expression: , xrefs: 00F55DC9
(Press Retry to debug the application - JIT must be enabled), xrefs: 00F55E9C
Line: , xrefs: 00F55D4F
Program: , xrefs: 00F55AD1
<program name unknown>, xrefs: 00F55B3D
File: , xrefs: 00F55BD9
For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts, xrefs: 00F55E72
..., xrefs: 00F55B8E, 00F55CAD, 00F55CFF, 00F55E43, 00F55EC6, 00F55EF9
Assertion failed!, xrefs: 00F55A8D
\, xrefs: 00F55C30

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Module$FileHandleName
String ID: (Press Retry to debug the application - JIT must be enabled)$...$<program name unknown>$Assertion failed!$Expression: $File: $For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts$Line: $Program: $\
API String ID: 4146042529-3261600717
Opcode ID: fde046222edc5d8fda749227a8f67296dd6f09afd0f1cf3dc50479ac341d8c62
Instruction ID: 4d849476485bb83b341af4364aeed84ed774595324b3cf9e39fe3974bbb3551f
Opcode Fuzzy Hash: fde046222edc5d8fda749227a8f67296dd6f09afd0f1cf3dc50479ac341d8c62
Instruction Fuzzy Hash: 4DC18F71E0060A66DB246A248C5AFFB33BCEFA5F12F050168FE09D5202F734DE5AE565

Function 00EEE843 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 319COMMON

Download Yara Rule

APIs

Part of subcall function 00ED9BB0: InitOnceBeginInitialize.KERNEL32(00FC80C4,00000000,87CF6CF3,00000000,87CF6CF3,00EDA219,00FC80CC,?,?,?,?,?,?,00EDA219,?,?), ref: 00ED9BE5
Part of subcall function 00ED9BB0: InitOnceComplete.KERNEL32(00FC80C4,00000000,00000000), ref: 00ED9C1D

Part of subcall function 00ED9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00ED9A12

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEE8A8

Strings

Failed to create access token, xrefs: 00EEE881
Authorization: , xrefs: 00EEE8EB
HTTP status error for Azure: , xrefs: 00EEEA71
HTTP receive response failed for Azure: , xrefs: 00EEEAE7
`aco, xrefs: 00EEED4B, 00EEEDF6
HTTP send request failed for Azure: , xrefs: 00EEEB62

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: InitIos_base_dtorOncestd::ios_base::_$BeginCompleteInitialize
String ID: Authorization: $Failed to create access token$HTTP receive response failed for Azure: $HTTP send request failed for Azure: $HTTP status error for Azure: $`aco
API String ID: 539357862-482850755
Opcode ID: 19fc2a9c99add1a129abfab23114eb977ccce48a3cb1611051fa081c983812fa
Instruction ID: 27408e565919cdeb3830356588128091021d22ea03fc6a04e78526561493d7ed
Opcode Fuzzy Hash: 19fc2a9c99add1a129abfab23114eb977ccce48a3cb1611051fa081c983812fa
Instruction Fuzzy Hash: 0ED16B70A0025D9BDB24DB60CD59BEDB3B4EF45304F5054E9E509B7382EB70AA88DFA1

Function 00F23300 Relevance: 21.2, APIs: 3, Strings: 9, Instructions: 217registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000), ref: 00F23545

Strings

Cannnot delete registry key. Not found: %s, xrefs: 00F23520
Error (%d) deleting registry key tree: %s, xrefs: 00F23577
Unable to substitute variables for the DEL_REG_TREE command, xrefs: 00F23494
Error opening HKLM registry key: %d, xrefs: 00F234DF
Invalid substitutor, xrefs: 00F23335
Unable to read Key for DEL_REG_TREE command, xrefs: 00F23462
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\delete_registry_tree_command.cpp, xrefs: 00F23341, 00F2346E, 00F234A0, 00F234EB, 00F2352C, 00F23583
NWebAdvisor::NXmlUpdater::parse_and_execute, xrefs: 00F2333C, 00F23469, 00F2349B, 00F234E6, 00F23527, 00F2357E
Key, xrefs: 00F23359

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Close
String ID: Cannnot delete registry key. Not found: %s$Error (%d) deleting registry key tree: %s$Error opening HKLM registry key: %d$Invalid substitutor$Key$NWebAdvisor::NXmlUpdater::parse_and_execute$Unable to read Key for DEL_REG_TREE command$Unable to substitute variables for the DEL_REG_TREE command$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\delete_registry_tree_command.cpp
API String ID: 3535843008-3762851336
Opcode ID: 8e5832bb879cff6bc51e4831fcabd21e1f94bed2f079e764c023545613cbe935
Instruction ID: e04bcba783cb6df3b903f044f2706d52c4ad4815f44db2e5d71bbe1f8e202914
Opcode Fuzzy Hash: 8e5832bb879cff6bc51e4831fcabd21e1f94bed2f079e764c023545613cbe935
Instruction Fuzzy Hash: 077112B1E40225ABDF10DF54E842BADB7B5EF04B10F544555E8047B2C1CB79EE05EBA2

Function 00F487E7 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 58libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00FC742C,00000FA0,?,?,00F487C5), ref: 00F487F3
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00F487C5), ref: 00F487FE
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00F487C5), ref: 00F4880F
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00F48821
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00F4882F
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00F487C5), ref: 00F48852
DeleteCriticalSection.KERNEL32(00FC742C,00000007,?,?,00F487C5), ref: 00F48875
CloseHandle.KERNEL32(00000000,?,?,00F487C5), ref: 00F48885

Strings

WakeAllConditionVariable, xrefs: 00F48827
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00F487F9
kernel32.dll, xrefs: 00F4880A
SleepConditionVariableCS, xrefs: 00F4881B

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: b0d7ec959f45c6d915c7a8a14ac44dda5da179c1d3d67505119528b0fda9077d
Instruction ID: 4c79076e80474dc6a66b870973c39c3dc7c5ca2778c1f8a7a07454ddd5c5b7d9
Opcode Fuzzy Hash: b0d7ec959f45c6d915c7a8a14ac44dda5da179c1d3d67505119528b0fda9077d
Instruction Fuzzy Hash: BE018431F44715ABDB20AB75AD0EFBA3E5CAB81BA1B540824FD05E3150DEB0C841BB62

Function 00F6BC3F Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00F6BC83

Part of subcall function 00F6AFC7: _free.LIBCMT ref: 00F6AFE4
Part of subcall function 00F6AFC7: _free.LIBCMT ref: 00F6AFF6
Part of subcall function 00F6AFC7: _free.LIBCMT ref: 00F6B008
Part of subcall function 00F6AFC7: _free.LIBCMT ref: 00F6B01A
Part of subcall function 00F6AFC7: _free.LIBCMT ref: 00F6B02C
Part of subcall function 00F6AFC7: _free.LIBCMT ref: 00F6B03E
Part of subcall function 00F6AFC7: _free.LIBCMT ref: 00F6B050
Part of subcall function 00F6AFC7: _free.LIBCMT ref: 00F6B062
Part of subcall function 00F6AFC7: _free.LIBCMT ref: 00F6B074
Part of subcall function 00F6AFC7: _free.LIBCMT ref: 00F6B086
Part of subcall function 00F6AFC7: _free.LIBCMT ref: 00F6B098
Part of subcall function 00F6AFC7: _free.LIBCMT ref: 00F6B0AA
Part of subcall function 00F6AFC7: _free.LIBCMT ref: 00F6B0BC

_free.LIBCMT ref: 00F6BC78

Part of subcall function 00F62098: RtlFreeHeap.NTDLL(00000000,00000000,?,00F6B729,?,00000000,?,?,?,00F6B9CC,?,00000007,?,?,00F6BDD6,?), ref: 00F620AE
Part of subcall function 00F62098: GetLastError.KERNEL32(?,?,00F6B729,?,00000000,?,?,?,00F6B9CC,?,00000007,?,?,00F6BDD6,?,?), ref: 00F620C0

_free.LIBCMT ref: 00F6BC9A
_free.LIBCMT ref: 00F6BCAF
_free.LIBCMT ref: 00F6BCBA
_free.LIBCMT ref: 00F6BCDC
_free.LIBCMT ref: 00F6BCEF
_free.LIBCMT ref: 00F6BCFD
_free.LIBCMT ref: 00F6BD08
_free.LIBCMT ref: 00F6BD40
_free.LIBCMT ref: 00F6BD47
_free.LIBCMT ref: 00F6BD64
_free.LIBCMT ref: 00F6BD7C

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: cdd30458dd65d74ceda62bafc6f3a072fc860f832963b3db51537a51f69b9347
Instruction ID: d5e5eb3a148038f6e07c66ccf8818af1819205352cf4e30b4489c889fea543ff
Opcode Fuzzy Hash: cdd30458dd65d74ceda62bafc6f3a072fc860f832963b3db51537a51f69b9347
Instruction Fuzzy Hash: 95315E31E00B05AFDB31AA39DC45B5A77E8EF10360F105829E45ADB292DF75ED84EB10

Function 00F10950 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 244fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F10490: CreateDirectoryW.KERNEL32(?,00000000,?), ref: 00F104AA
Part of subcall function 00F10490: GetLastError.KERNEL32 ref: 00F104B8

CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000000,00000000,00000000,0000005C,00000001,00000000), ref: 00F10BB5
GetLastError.KERNEL32 ref: 00F10BC2

Strings

WriteFile failed: %d, xrefs: 00F10C31
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\FileUtils.cpp, xrefs: 00F109A3, 00F10BE4, 00F10C40
CreateFile failed for %s: %d, xrefs: 00F10BD5
CreateDir failed for %s, xrefs: 00F10994
\, xrefs: 00F10AF1
NWebAdvisor::NUtils::StoreBufferInFile, xrefs: 00F1099E, 00F10BDF, 00F10C3B

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: CreateErrorLast$DirectoryFile
String ID: CreateDir failed for %s$CreateFile failed for %s: %d$NWebAdvisor::NUtils::StoreBufferInFile$WriteFile failed: %d$\$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\FileUtils.cpp
API String ID: 1552088572-2321083101
Opcode ID: 3eb64ff31bd3d6bcc8dddf204cd2346d2695c20a13b2cd3ff15fa64231c164bb
Instruction ID: acbad33a3cf314ee70717b058b8a63cd230dde0d5091e209d35d0f336832275c
Opcode Fuzzy Hash: 3eb64ff31bd3d6bcc8dddf204cd2346d2695c20a13b2cd3ff15fa64231c164bb
Instruction Fuzzy Hash: 89A18D71E003089EDF00DFA4CC55BEEBBB4EF58314F14421AE905BB281DBB06A85DBA1

Function 00EFBDF0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00EFBE2F
std::_Lockit::_Lockit.LIBCPMT ref: 00EFBE51
std::_Lockit::~_Lockit.LIBCPMT ref: 00EFBE71
std::_Locinfo::~_Locinfo.LIBCPMT ref: 00EFBFCD
std::_Facet_Register.LIBCPMT ref: 00EFBFDA
std::_Lockit::~_Lockit.LIBCPMT ref: 00EFBFFC
Concurrency::cancel_current_task.LIBCPMT ref: 00EFC01E
Concurrency::cancel_current_task.LIBCPMT ref: 00EFC023
Concurrency::cancel_current_task.LIBCPMT ref: 00EFC028

Strings

false, xrefs: 00EFBF85
true, xrefs: 00EFBFAB

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Concurrency::cancel_current_task$Lockit::_Lockit::~_$Facet_LocinfoLocinfo::~_Register
String ID: false$true
API String ID: 2461315636-2658103896
Opcode ID: eef64d655d22b0e77922f478006949e5eed968bdd313a1393cb78dd023bc3e1d
Instruction ID: 873d09c4f2300daf853b9d47bf9b036dfa7baa21d3e40e19358efbd470f466ec
Opcode Fuzzy Hash: eef64d655d22b0e77922f478006949e5eed968bdd313a1393cb78dd023bc3e1d
Instruction Fuzzy Hash: 0361C070A0020DDFDB14DFA4CD41BAEBBB0FF45314F148159EA05AB391DBB9AA09DB91

Function 00F6B0D0 Relevance: 18.4, APIs: 12, Instructions: 374COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F6B118
_free.LIBCMT ref: 00F6B13C
_free.LIBCMT ref: 00F6B149
_free.LIBCMT ref: 00F6B16E
_free.LIBCMT ref: 00F6B17B
_free.LIBCMT ref: 00F6B184
_free.LIBCMT ref: 00F6B45F
_free.LIBCMT ref: 00F6B467

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 2492037a43dfd91018a28847f34f2f8d2d92c73dbf57524471b1dbb69ba7b1ce
Instruction ID: 864dd1cf07df4a442c98159c7b47f776a2d467103bdcdade0b09acd20ffd2499
Opcode Fuzzy Hash: 2492037a43dfd91018a28847f34f2f8d2d92c73dbf57524471b1dbb69ba7b1ce
Instruction Fuzzy Hash: 66C12576E40604BFDB20DBA8DC83FEE77F8AF09750F144165FA05EB282D6749981AB50

Function 00EED972 Relevance: 17.9, APIs: 3, Strings: 7, Instructions: 374COMMON

Download Yara Rule

APIs

Part of subcall function 00EDBA20: Concurrency::cancel_current_task.LIBCPMT ref: 00EDBB9D

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEDBE9

Part of subcall function 00EED740: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EED7E7

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEDB35

Part of subcall function 00ED9BB0: InitOnceBeginInitialize.KERNEL32(00FC80C4,00000000,87CF6CF3,00000000,87CF6CF3,00EDA219,00FC80CC,?,?,?,?,?,?,00EDA219,?,?), ref: 00ED9BE5
Part of subcall function 00ED9BB0: InitOnceComplete.KERNEL32(00FC80C4,00000000,00000000), ref: 00ED9C1D

Part of subcall function 00ED9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00ED9A12

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEDF0C

Strings

&skn=, xrefs: 00EEDC7E
Failed to create HMACSha256 Hash, xrefs: 00EEDB05
SharedAccessSignature sr=, xrefs: 00EEDC2A
&sig=, xrefs: 00EEDC4D
Event Sender already initialized for Azure, xrefs: 00EEDEE2
Failed to escape hash, xrefs: 00EEDBB9
&se=, xrefs: 00EEDC70

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$InitOnce$BeginCompleteConcurrency::cancel_current_taskInitialize
String ID: &se=$&sig=$&skn=$Event Sender already initialized for Azure$Failed to create HMACSha256 Hash$Failed to escape hash$SharedAccessSignature sr=
API String ID: 3638550806-2007429668
Opcode ID: c5b921e94d4b37144e1eae979465946b2f011a38cedc60d00c0c445ccae6ceb1
Instruction ID: c5f3673ae8d3c1066d8b6aeb408af45be4cd4809f51d21241bcd0c8ab41d620b
Opcode Fuzzy Hash: c5b921e94d4b37144e1eae979465946b2f011a38cedc60d00c0c445ccae6ceb1
Instruction Fuzzy Hash: 52E1D070D00298ABDF18DB64DC89BDDB7B5EF45304F108299E808B7292EB75AB85CF51

Function 00F091A0 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00FAA536,00000003), ref: 00F091C9
FindResourceW.KERNEL32(00000000,00000001,00000010), ref: 00F091DE
LoadResource.KERNEL32(00000000,00000000), ref: 00F091EE
LockResource.KERNEL32(00000000), ref: 00F091FD

Strings

%d.%d.%d.%d, xrefs: 00F0925E
Failed to retrieve kernel verison, xrefs: 00F0932C
NWebAdvisor::NXmlUpdater::CSubstitutionManager::GetOsVersion, xrefs: 00F0927F, 00F09336
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\SubstitutionManager.cpp, xrefs: 00F09284, 00F0933B
kernel32.dll, xrefs: 00F091B8
Failed to format version, xrefs: 00F09275

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Resource$FindHandleLoadLockModule
String ID: %d.%d.%d.%d$Failed to format version$Failed to retrieve kernel verison$NWebAdvisor::NXmlUpdater::CSubstitutionManager::GetOsVersion$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\SubstitutionManager.cpp$kernel32.dll
API String ID: 3968257194-3470154288
Opcode ID: f8a903a8aff2dc5fb5de91f9536c4f9800e4a81ea9b20a6081cc8d215383c03f
Instruction ID: 214af727a668f73e95b6f707d151745ec3953b82286b5b46e44b4763691e247f
Opcode Fuzzy Hash: f8a903a8aff2dc5fb5de91f9536c4f9800e4a81ea9b20a6081cc8d215383c03f
Instruction Fuzzy Hash: A351FB70A003149BDF24AF24DC45BABB7B8EF04704F50069DE945AB2C2E7B5DE45EB91

Function 00EE9C10 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 369COMMON

Download Yara Rule

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 00EE9C1A

Strings

Wait timeout. Should not have gotten this..., xrefs: 00EEA86F
Wait failed: , xrefs: 00EEA93F

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Mtx_destroy_in_situ
String ID: Wait failed: $Wait timeout. Should not have gotten this...
API String ID: 3543493169-4232610396
Opcode ID: aaa360aea4023831160550cd11265c864a6121703de233cc439ef354e449e407
Instruction ID: c6a5a0bab45c67baf84bc6b4f3cf23b70211ca9a5e27ceaa7b89e63efcaab268
Opcode Fuzzy Hash: aaa360aea4023831160550cd11265c864a6121703de233cc439ef354e449e407
Instruction Fuzzy Hash: F7E1BEB0910A489EDB24CF75CC84BEAB7E5FF44314F04052DE55AA7281DB78B948CB56

Function 00F4C338 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00F4C435
type_info::operator==.LIBVCRUNTIME ref: 00F4C457
___TypeMatch.LIBVCRUNTIME ref: 00F4C566
IsInExceptionSpec.LIBVCRUNTIME ref: 00F4C638
_UnwindNestedFrames.LIBCMT ref: 00F4C6BC
CallUnexpected.LIBVCRUNTIME ref: 00F4C6D7

Strings

csm, xrefs: 00F4C3E2
csm, xrefs: 00F4C48E
csm, xrefs: 00F4C375

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: f1d7a739cf3cffcd39611a17577f6959bf7e466da09cb5e1ae62eb87d5a576f0
Instruction ID: 9b02e2da2a2d876ad156fc8df92dddc5a508101a88f0c84fdf7f497bdb12a62f
Opcode Fuzzy Hash: f1d7a739cf3cffcd39611a17577f6959bf7e466da09cb5e1ae62eb87d5a576f0
Instruction Fuzzy Hash: 6CB18771C02209EFCF54DFA4C9819AEBFB5AF04320B15A159EC196B212D734DA51EFE1

Function 00EE69A0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 114libraryloaderCOMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32(87CF6CF3,9EDBA51C,00000000,00000000,00000000,00000000,?,00000000), ref: 00EE69E9
CloseHandle.KERNEL32(87CF6CF3,?,?,00000000), ref: 00EE69FB
DeviceIoControl.KERNEL32(00000000,9EDB651C,00000000,00000000,00000000,00000000,?,00000000), ref: 00EE6A2A
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 00EE6A3D
GetModuleHandleExW.KERNEL32(00000000,mfeaaca.dll,?), ref: 00EE6A8B
GetProcAddress.KERNEL32(?,NotComDllUnload), ref: 00EE6A9E
FreeLibrary.KERNEL32(00000000), ref: 00EE6AB8

Strings

NotComDllUnload, xrefs: 00EE6A95
mfeaaca.dll, xrefs: 00EE6A84

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Handle$CloseControlDevice$AddressFreeLibraryModuleProc
String ID: NotComDllUnload$mfeaaca.dll
API String ID: 2321898493-1077453148
Opcode ID: dbf5a88f4dc68b010c0e6abf1329657ce9a5b1a45cebe36d6cbf6286f38399a8
Instruction ID: 93461cf9a621a8d9c3b3131fbe57c92648dfbce2810b503770202c0645f5f88d
Opcode Fuzzy Hash: dbf5a88f4dc68b010c0e6abf1329657ce9a5b1a45cebe36d6cbf6286f38399a8
Instruction Fuzzy Hash: 4631B1717003489BDB209F25DC89F7A7BA8AF54B54F144A28F919BB2D1DB70EC04CB92

Function 00F24280 Relevance: 15.1, APIs: 3, Strings: 7, Instructions: 133COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00F2431B
GetLastError.KERNEL32 ref: 00F2437E
GetLastError.KERNEL32 ref: 00F243CB

Strings

NWebAdvisor::CHttpTransaction::SetAutoProxyUrl, xrefs: 00F24388
# SetAutoProxy: Can't get proxy. Err: %d, xrefs: 00F2431E
Unable to set proxy option, error: %d, xrefs: 00F243CE
c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpTransaction_sacore.cpp, xrefs: 00F2432A, 00F2438D, 00F243DD
NWebAdvisor::CHttpTransaction::Connect, xrefs: 00F243D8
NWebAdvisor::CHttpTransaction::SetAutoProxy, xrefs: 00F24325
# SetAutoProxyUrl: Can't get proxy. Err: %d, xrefs: 00F24381

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ErrorLast
String ID: # SetAutoProxy: Can't get proxy. Err: %d$# SetAutoProxyUrl: Can't get proxy. Err: %d$NWebAdvisor::CHttpTransaction::Connect$NWebAdvisor::CHttpTransaction::SetAutoProxy$NWebAdvisor::CHttpTransaction::SetAutoProxyUrl$Unable to set proxy option, error: %d$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\HttpTransaction_sacore.cpp
API String ID: 1452528299-2881327693
Opcode ID: 5e3276b83713fee2e72009911f6389c5473e28f1d464c56477629baf39c77d41
Instruction ID: 25e6b4d2bc8c8439b6ffaa1bdb7e1f47e5beb4e33f1ceee4ed175a53b6801fee
Opcode Fuzzy Hash: 5e3276b83713fee2e72009911f6389c5473e28f1d464c56477629baf39c77d41
Instruction Fuzzy Hash: 79415F71E40319AFEF10DFA4DD45FAEB7F4EF08714F00811AE914A6280D7B5A944EB65

Function 00F61B91 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F61BA7

Part of subcall function 00F62098: RtlFreeHeap.NTDLL(00000000,00000000,?,00F6B729,?,00000000,?,?,?,00F6B9CC,?,00000007,?,?,00F6BDD6,?), ref: 00F620AE
Part of subcall function 00F62098: GetLastError.KERNEL32(?,?,00F6B729,?,00000000,?,?,?,00F6B9CC,?,00000007,?,?,00F6BDD6,?,?), ref: 00F620C0

_free.LIBCMT ref: 00F61BB3
_free.LIBCMT ref: 00F61BBE
_free.LIBCMT ref: 00F61BC9
_free.LIBCMT ref: 00F61BD4
_free.LIBCMT ref: 00F61BDF
_free.LIBCMT ref: 00F61BEA
_free.LIBCMT ref: 00F61BF5
_free.LIBCMT ref: 00F61C00
_free.LIBCMT ref: 00F61C0E

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d3a0a0e9dd867e33651efadbea2e0b3ea3e96699fdca0367e143b4e022bc3eac
Instruction ID: e74f6da3f1646fd44f8aa3fa4b0b024c40293a641d6f1c6cdd0edb17cf7b41e3
Opcode Fuzzy Hash: d3a0a0e9dd867e33651efadbea2e0b3ea3e96699fdca0367e143b4e022bc3eac
Instruction Fuzzy Hash: C221AB76900108BFCB41EFA4CC41DDE7BB9BF09380F4555A5F515AB222EB35EA48DB80

Function 00F4E00A Relevance: 14.5, APIs: 1, Strings: 7, Instructions: 496COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 00F4E3E7

Strings

f, xrefs: 00F4E157
p, xrefs: 00F4E118
p, xrefs: 00F4E0FC
f, xrefs: 00F4E111
:, xrefs: 00F4E0CC
f, xrefs: 00F4E0F5
p, xrefs: 00F4E15E

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: __aulldvrm
String ID: :$f$f$f$p$p$p
API String ID: 1302938615-1434680307
Opcode ID: cea7733dabf86bc5c6ea0c60d40b02c71f29b3b5f468f1def6264aa648266a2d
Instruction ID: 5dba20f2afa431cd0e0949405dc5b19fc7667cbd9d545281da0b9e2aa937c78d
Opcode Fuzzy Hash: cea7733dabf86bc5c6ea0c60d40b02c71f29b3b5f468f1def6264aa648266a2d
Instruction Fuzzy Hash: 6F028079E00219DAEF20CFA4D8446EDBFB6FB04B24FA84155EC15BB280D7745E88EB15

Function 00F41610 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F41617

Part of subcall function 00F37DF0: __EH_prolog3.LIBCMT ref: 00F37DF7
Part of subcall function 00F37DF0: std::_Lockit::_Lockit.LIBCPMT ref: 00F37E01
Part of subcall function 00F37DF0: std::_Lockit::~_Lockit.LIBCPMT ref: 00F37E72

Strings

%b %d %H : %M : %S %Y, xrefs: 00F418A5
%H : %M : %S, xrefs: 00F417B0
%H : %M, xrefs: 00F41756
%I : %M : %S %p, xrefs: 00F41972
:AM:am:PM:pm, xrefs: 00F4197D
%m / %d / %y, xrefs: 00F4170E
%d / %m / %y, xrefs: 00F4194D

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: H_prolog3Lockitstd::_$Lockit::_Lockit::~_
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1538362411-2891247106
Opcode ID: b79c3106bc66dea57d8c96a2598f0de0b5a592ccdbf31405917eeee3568a4921
Instruction ID: 49229761fc10bde9b0c35ef0bcd2b9657809c3d74576d86c03096345fdd71ef8
Opcode Fuzzy Hash: b79c3106bc66dea57d8c96a2598f0de0b5a592ccdbf31405917eeee3568a4921
Instruction Fuzzy Hash: 1BB18B7294020AABDF19DF68CD65EBE3FB9FF05350F044219FE06A6251D231DA90EB61

Function 00F419E0 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F419E7

Part of subcall function 00ED32DE: __EH_prolog3_GS.LIBCMT ref: 00ED32E5
Part of subcall function 00ED32DE: std::_Lockit::_Lockit.LIBCPMT ref: 00ED32F2
Part of subcall function 00ED32DE: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED3360

Strings

%b %d %H : %M : %S %Y, xrefs: 00F41C75
%H : %M : %S, xrefs: 00F41B80
%H : %M, xrefs: 00F41B26
%I : %M : %S %p, xrefs: 00F41D42
:AM:am:PM:pm, xrefs: 00F41D4D
%m / %d / %y, xrefs: 00F41ADE
%d / %m / %y, xrefs: 00F41D1D

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Lockitstd::_$H_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 2728201062-2891247106
Opcode ID: bd96e787672ef424d9aa7775e31ab91a272ae50a76feb74f74d7da8c1e6ea9d7
Instruction ID: 5acab8291fbd130c677356d96cc428a7a7733f51eea8a7881b29abed2649b092
Opcode Fuzzy Hash: bd96e787672ef424d9aa7775e31ab91a272ae50a76feb74f74d7da8c1e6ea9d7
Instruction Fuzzy Hash: B6B17CB694010AABDF19DE68CDA5EFE3FB9FF05310F044119FE12A6251D231DA90EB51

Function 00F46940 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 325COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F46947

Part of subcall function 00EFC960: std::_Lockit::_Lockit.LIBCPMT ref: 00EFC995
Part of subcall function 00EFC960: std::_Lockit::_Lockit.LIBCPMT ref: 00EFC9B7
Part of subcall function 00EFC960: std::_Lockit::~_Lockit.LIBCPMT ref: 00EFC9D7
Part of subcall function 00EFC960: std::_Lockit::~_Lockit.LIBCPMT ref: 00EFCAB1

Strings

%b %d %H : %M : %S %Y, xrefs: 00F46BD5
%H : %M : %S, xrefs: 00F46AE0
%H : %M, xrefs: 00F46A86
%I : %M : %S %p, xrefs: 00F46CA2
:AM:am:PM:pm, xrefs: 00F46CAD
%m / %d / %y, xrefs: 00F46A3E
%d / %m / %y, xrefs: 00F46C7D

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3
String ID: %H : %M$%H : %M : %S$%I : %M : %S %p$%b %d %H : %M : %S %Y$%d / %m / %y$%m / %d / %y$:AM:am:PM:pm
API String ID: 1383202999-2891247106
Opcode ID: 4ee11287d6966c5a80d46a8cd180e93cee7ae2712eaa7ae52a77075169f7d056
Instruction ID: 546be55011fe5bdbdcb56249e3a9c917c543a7d71f2e984cfc67c1417893ea7e
Opcode Fuzzy Hash: 4ee11287d6966c5a80d46a8cd180e93cee7ae2712eaa7ae52a77075169f7d056
Instruction Fuzzy Hash: 00B1AC7290010AABDF19DF68CD95EFE3FB9EB4A314F044119FE42E6251D235DA10EB62

Function 00F20C80 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 244fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,00000000,?,?,87CF6CF3,00000000), ref: 00F20E20
GetLastError.KERNEL32 ref: 00F20E2E

Part of subcall function 00F20FA0: GetModuleHandleW.KERNEL32(kernel32.dll,87CF6CF3,000000FF,00000000,00000000,00F7DF30,000000FF), ref: 00F20FE8
Part of subcall function 00F20FA0: GetProcAddress.KERNEL32(00000000,CreateFileTransactedW), ref: 00F20FF8
Part of subcall function 00F20FA0: GetLastError.KERNEL32 ref: 00F21058

Part of subcall function 00F08650: std::locale::_Init.LIBCPMT ref: 00F0882F

Strings

c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\CabParser.h, xrefs: 00F20DA0, 00F20E41, 00F20F11
Failed to load cab %s, xrefs: 00F20F05
Unable to create destination directory (%d), xrefs: 00F20D94
CreateFile failed: %d, xrefs: 00F20E35
NWebAdvisor::CCabParser::GetContentFile, xrefs: 00F20D9B, 00F20E3C
NWebAdvisor::CCabParser::LoadCabFile, xrefs: 00F20F0C

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ErrorLast$AddressCreateFileHandleInitModuleProcstd::locale::_
String ID: CreateFile failed: %d$Failed to load cab %s$NWebAdvisor::CCabParser::GetContentFile$NWebAdvisor::CCabParser::LoadCabFile$Unable to create destination directory (%d)$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\CabParser.h
API String ID: 1808632809-3418505487
Opcode ID: 537819773922e7a93357b601ebfec7532e0db408708f3433fd36a02d2ea3e5e1
Instruction ID: 5f77425e16e0aa3328cab0fa4d5b59016e1e9a55c008cd46609b880ae735b18e
Opcode Fuzzy Hash: 537819773922e7a93357b601ebfec7532e0db408708f3433fd36a02d2ea3e5e1
Instruction Fuzzy Hash: 88919071A00208AFDF14DFA8DD96BEEB7B4EF04704F20812DF415A7282DB75AA06DB51

Function 00F31B90 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 192encryptionCOMMON

Download Yara Rule

APIs

CertGetCertificateContextProperty.CRYPT32(00000000,00000003,00000000,?), ref: 00F31CB1
CertGetCertificateContextProperty.CRYPT32(00000000,00000003,00000000,?), ref: 00F31CE5

Strings

1.2.840.10045.4.1, xrefs: 00F31C08
1.2.840.10045.4.3.2, xrefs: 00F31C1C
1.2.840.10045.4.3.4, xrefs: 00F31C44
1.2.840.10045.4.3, xrefs: 00F31C58
1.2.840.10045.4.3.3, xrefs: 00F31C30
MUSARUBRA US LLC, xrefs: 00F31D49

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: CertCertificateContextProperty
String ID: 1.2.840.10045.4.1$1.2.840.10045.4.3$1.2.840.10045.4.3.2$1.2.840.10045.4.3.3$1.2.840.10045.4.3.4$MUSARUBRA US LLC
API String ID: 665277682-2910604786
Opcode ID: e57b5f4e469d902be74351ed063d243c46bdc92652a8e495639caef74b98ca97
Instruction ID: 443a7c66300d9cee906d3a1992a6c61182c88a8d69677176615a3bda526120c2
Opcode Fuzzy Hash: e57b5f4e469d902be74351ed063d243c46bdc92652a8e495639caef74b98ca97
Instruction Fuzzy Hash: 0F513871A003018FDB24DF28DC81AAAB7A1BF51770F49466DE86687352D721EC19E7A2

Function 00F3DE9D Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F3DEA4
_Maklocstr.LIBCPMT ref: 00F3DF0D
_Maklocstr.LIBCPMT ref: 00F3DF1F
_Maklocchr.LIBCPMT ref: 00F3DF37
_Maklocchr.LIBCPMT ref: 00F3DF47
_Getvals.LIBCPMT ref: 00F3DF69

Part of subcall function 00F3760B: _Maklocchr.LIBCPMT ref: 00F3763A
Part of subcall function 00F3760B: _Maklocchr.LIBCPMT ref: 00F37650

Strings

false, xrefs: 00F3DF08
true, xrefs: 00F3DF1A

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Maklocchr$Maklocstr$GetvalsH_prolog3_
String ID: false$true
API String ID: 3549167292-2658103896
Opcode ID: bcbe912d725308ddb72fe8ad07240ef10fd24a4b065d59581ee185571e0a13d4
Instruction ID: f51f9c5355671f088dbde8332a4ee416e37e93b6997f5d11b2ba3c88f43a35b6
Opcode Fuzzy Hash: bcbe912d725308ddb72fe8ad07240ef10fd24a4b065d59581ee185571e0a13d4
Instruction Fuzzy Hash: 092165B2D04308AADF14EFB4DC86ADF7B68EF05720F00815AF9199F242EB749544DBA1

Function 00F6F5F9 Relevance: 13.8, APIs: 9, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78fb4d91b5bc865243fb3bbd7fdcdbfa9def72930f1ba8281a29a8d2cd30a53a
Instruction ID: 80a654e7532d519162f40266d5f3f9d927d10cec137640fe2356a3b337cba8ad
Opcode Fuzzy Hash: 78fb4d91b5bc865243fb3bbd7fdcdbfa9def72930f1ba8281a29a8d2cd30a53a
Instruction Fuzzy Hash: 73C10371E04249AFDF15DFA9EC81BADBBB0AF49310F0441A9E8149B392C7359D49EF60

Function 00F6B4F0 Relevance: 13.7, APIs: 9, Instructions: 200COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F6B55E
_free.LIBCMT ref: 00F6B56A
_free.LIBCMT ref: 00F6B693
_free.LIBCMT ref: 00F6B69E

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: e7153bf23aad8d6d9ccc35a5ae809c8f6271d3018799e958e7de92c56d65ad7e
Instruction ID: 7213ce029e45db272e1328fae6da0631da0f8cabace78007a31cc4fe6309928c
Opcode Fuzzy Hash: e7153bf23aad8d6d9ccc35a5ae809c8f6271d3018799e958e7de92c56d65ad7e
Instruction Fuzzy Hash: 4061D572D00704AFDB20DF74CC41BAA77F8AF45360F2445A9E956EB282EB719D80EB50

Function 00F3394B Relevance: 13.6, APIs: 9, Instructions: 139threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00F33973
GetCurrentThreadId.KERNEL32 ref: 00F33990
GetCurrentThreadId.KERNEL32 ref: 00F339A5
_xtime_get.LIBCPMT ref: 00F33A2B
GetCurrentThreadId.KERNEL32 ref: 00F33A55
__Xtime_diff_to_millis2.LIBCPMT ref: 00F33A71
_xtime_get.LIBCPMT ref: 00F33A94
GetCurrentThreadId.KERNEL32 ref: 00F33A9E
GetCurrentThreadId.KERNEL32 ref: 00F33AD5

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: CurrentThread$_xtime_get$Xtime_diff_to_millis2
String ID:
API String ID: 3943753294-0
Opcode ID: cd78e8f36eff89a88bc018ca04484987e9a8c96af2a66e081ff22989fb7edf27
Instruction ID: 0dbea4e23c2054d2a90c57373612fcd8da5970e1195c7eb79296279bbb472487
Opcode Fuzzy Hash: cd78e8f36eff89a88bc018ca04484987e9a8c96af2a66e081ff22989fb7edf27
Instruction Fuzzy Hash: 0D514C35900209CFCF10DF65C985AA977B5FF04330F254459E846AB265D774EE40EBA1

Function 00F1E760 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 191encryptionCOMMON

Download Yara Rule

APIs

CertGetCertificateContextProperty.CRYPT32(?,00000003,00000000,00000000), ref: 00F1E877
CertGetCertificateContextProperty.CRYPT32(?,00000003,00000000,00000014), ref: 00F1E8A9

Strings

1.2.840.10045.4.1, xrefs: 00F1E7CB
1.2.840.10045.4.3.2, xrefs: 00F1E7DF
1.2.840.10045.4.3.4, xrefs: 00F1E807
1.2.840.10045.4.3.3, xrefs: 00F1E7F3
1.2.840.10045.4.3, xrefs: 00F1E81B

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: CertCertificateContextProperty
String ID: 1.2.840.10045.4.1$1.2.840.10045.4.3$1.2.840.10045.4.3.2$1.2.840.10045.4.3.3$1.2.840.10045.4.3.4
API String ID: 665277682-3196566809
Opcode ID: aa133ddced7611fd6f1f0cfac66c0dab6d8100f3403247b1834cfe092b873cd8
Instruction ID: bee3bdbde8faca24e1754ee36969a888c1a5054be2c0b60d7ff0b7e811055bbd
Opcode Fuzzy Hash: aa133ddced7611fd6f1f0cfac66c0dab6d8100f3403247b1834cfe092b873cd8
Instruction Fuzzy Hash: 19511871E002059BDF209F28DC91BEABBA5AF11334F4842ADDC1A97292D731ED84E751

Function 00EFE2C0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 168COMMON

Download Yara Rule

Strings

z, xrefs: 00EFE369

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID:
String ID: z
API String ID: 0-1657960367
Opcode ID: 8dbe0240b49be21bd81be7eeedbfca6c476b0d226bc6adb6724abed4e76dfd3b
Instruction ID: 3a04281ab58ed60220358cbbb9689c79d96a3c606ff32b1c1740d4b06ed9a56f
Opcode Fuzzy Hash: 8dbe0240b49be21bd81be7eeedbfca6c476b0d226bc6adb6724abed4e76dfd3b
Instruction Fuzzy Hash: E9516071A0121D9BEB10DF94CC84FFEB7B8EB44724F104169EA15B3390DB74AA04DBA4

Function 00EE7107 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 163COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EE7D3D
__Mtx_unlock.LIBCPMT ref: 00EE7DC8

Part of subcall function 00ED9BB0: InitOnceBeginInitialize.KERNEL32(00FC80C4,00000000,87CF6CF3,00000000,87CF6CF3,00EDA219,00FC80CC,?,?,?,?,?,?,00EDA219,?,?), ref: 00ED9BE5
Part of subcall function 00ED9BB0: InitOnceComplete.KERNEL32(00FC80C4,00000000,00000000), ref: 00ED9C1D

Part of subcall function 00ED9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00ED9A12

Concurrency::cancel_current_task.LIBCPMT ref: 00EE7DFC
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EE7EBB

Part of subcall function 00EF4B40: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EF521E

Strings

Failed to add event category (, xrefs: 00EE71F0
V, xrefs: 00EE71E4
Service has not been initialized, xrefs: 00EE7E88

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$InitOnce$BeginCompleteConcurrency::cancel_current_taskInitializeMtx_unlock
String ID: Failed to add event category ($Service has not been initialized$V
API String ID: 342047005-375236208
Opcode ID: bb9475605608d409bd60ca2d71bc505703f4f180d4a4875fe99f2e83de3158a1
Instruction ID: 6bd626bb34f46bad5b59acc24c8e3a141d61d339bbdb4faae02fe4fe34ec07a1
Opcode Fuzzy Hash: bb9475605608d409bd60ca2d71bc505703f4f180d4a4875fe99f2e83de3158a1
Instruction Fuzzy Hash: 0C51D171904288DFDB14EF60DC55BEE7BB4FF48304F5041AAE846A7382EB359A09DB61

Function 00EFBBB0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00EFBBE6
std::_Lockit::_Lockit.LIBCPMT ref: 00EFBC06
std::_Lockit::~_Lockit.LIBCPMT ref: 00EFBC26
std::_Locinfo::~_Locinfo.LIBCPMT ref: 00EFBCB4
std::_Facet_Register.LIBCPMT ref: 00EFBCC1
std::_Lockit::~_Lockit.LIBCPMT ref: 00EFBCE3

Strings

ios_base::badbit set, xrefs: 00EFBBCF

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_LocinfoLocinfo::~_Register
String ID: ios_base::badbit set
API String ID: 2966223926-3882152299
Opcode ID: cf5e40a1be8d5526958776e875ee246b646ad8df47d411f0d3afe48f5cb09fe2
Instruction ID: ceab1c899c77b2f43b9aee3e33825675882b4cda2974c5cd98877fc216869a44
Opcode Fuzzy Hash: cf5e40a1be8d5526958776e875ee246b646ad8df47d411f0d3afe48f5cb09fe2
Instruction Fuzzy Hash: C4419A71A00208CFDB14DF54D982ABEFBB4FB50714F144159E906AB251DF35AA06EB81

Function 00F6A764 Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00F6A78E
_free.LIBCMT ref: 00F6A867
_free.LIBCMT ref: 00F6A894

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: abb92d30f9809e1c51581fa46c3904a12e80b506f70589d771acc4fc0d3a2cf8
Instruction ID: 458e41d2cfda2758547105355af9049284bd06a0f8dead3be9b865e88d19a7ac
Opcode Fuzzy Hash: abb92d30f9809e1c51581fa46c3904a12e80b506f70589d771acc4fc0d3a2cf8
Instruction Fuzzy Hash: A251FA71D04305AFDB20AFB48C42A6D7BB4AF01360F1581AEE551B7282EB399945FF52

Function 00EF8690 Relevance: 12.2, APIs: 8, Instructions: 172COMMON

Download Yara Rule

APIs

Part of subcall function 00F4987E: EnterCriticalSection.KERNEL32(00FC77A0,?,00000001,?,00EF86A7,00000000,?,00000001,?,00000000,?,?,00EFC338,-00000010), ref: 00F49889
Part of subcall function 00F4987E: LeaveCriticalSection.KERNEL32(00FC77A0,?,00EF86A7,00000000,?,00000001,?,00000000,?,?,00EFC338,-00000010,?,?,?,87CF6CF3), ref: 00F498B5

FindResourceExW.KERNEL32(00000000,00000006,?,00000000,00000000), ref: 00EF86D6
LoadResource.KERNEL32(00000000,00000000), ref: 00EF86E4
LockResource.KERNEL32(00000000), ref: 00EF86EF
SizeofResource.KERNEL32(00000000,00000000), ref: 00EF86FD
FindResourceW.KERNEL32(00000000,?,00000006), ref: 00EF8764
LoadResource.KERNEL32(00000000,00000000), ref: 00EF8776
LockResource.KERNEL32(00000000), ref: 00EF8785
SizeofResource.KERNEL32(00000000,00000000), ref: 00EF8797

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Resource$CriticalFindLoadLockSectionSizeof$EnterLeave
String ID:
API String ID: 506522749-0
Opcode ID: 17844dd84273a74eb64d0e4af4f8d759b865f961a61340e1f35a595cfa9e2bfd
Instruction ID: 31131ce6dd80c4dbb7ae4f988634e75060b65851c83b6c95b46edb10ca16cb62
Opcode Fuzzy Hash: 17844dd84273a74eb64d0e4af4f8d759b865f961a61340e1f35a595cfa9e2bfd
Instruction Fuzzy Hash: B641473160421A9BC728AF18DD85A7BB3E8EF90344F50192EFE55E7281EF74DC0497A1

Function 00F6087D Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 264COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F61CA9: GetLastError.KERNEL32(00000008,00000016,00000000,00F64E01), ref: 00F61CAE
Part of subcall function 00F61CA9: SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00F61D4C

_free.LIBCMT ref: 00F60B8A
_free.LIBCMT ref: 00F60BA3
_free.LIBCMT ref: 00F60BE1
_free.LIBCMT ref: 00F60BEA
_free.LIBCMT ref: 00F60BF6

Strings

C, xrefs: 00F609D9

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: _free$ErrorLast
String ID: C
API String ID: 3291180501-1037565863
Opcode ID: e5879d2b3365f4e26233378414d0c6bfd54528a0b2d0e005715dbc41d69ea8ec
Instruction ID: ad3a09e4b7b4f8f6b8ace4a04c9ec42d3664d9ecb7e6b8185bad614ece4ad40d
Opcode Fuzzy Hash: e5879d2b3365f4e26233378414d0c6bfd54528a0b2d0e005715dbc41d69ea8ec
Instruction Fuzzy Hash: 84B12975A016199BDB24DF18CC84AAEB7B4FF58314F2085EAE849A7351DB34AE80DF40

Function 00EF1230 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 202COMMON

Download Yara Rule

APIs

InitOnceBeginInitialize.KERNEL32(00FC823C,00000000,?,00000000,?,?,?,?,00000000,00000000,?,87CF6CF3,?,?), ref: 00EF125A
InitOnceComplete.KERNEL32(00FC823C,00000000,00000000), ref: 00EF1278

Strings

McCryptoLib::CMcCryptoHMACWin::Initialize, xrefs: 00EF12EC, 00EF13D7
[%S:(%d)][%S] Failed to create HMAC traits., xrefs: 00EF12F8
[%S:(%d)][%S] Error trying to BCryptOpenAlgorithmProvider: %ls, xrefs: 00EF13E3
C:\non_system\Code\McCryptoLib\src\windows\win_hmac.cpp, xrefs: 00EF12F3, 00EF13DE

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: InitOnce$BeginCompleteInitialize
String ID: C:\non_system\Code\McCryptoLib\src\windows\win_hmac.cpp$McCryptoLib::CMcCryptoHMACWin::Initialize$[%S:(%d)][%S] Error trying to BCryptOpenAlgorithmProvider: %ls$[%S:(%d)][%S] Failed to create HMAC traits.
API String ID: 51270584-3897904871
Opcode ID: 1251e71204ca456ba99d0a01abb3ea44488b1065f5180ae1d6c961cf918c1e3f
Instruction ID: 7388e65754ce4ed82f24c41118f56399bae2b94d99c4554501606c836bd21efc
Opcode Fuzzy Hash: 1251e71204ca456ba99d0a01abb3ea44488b1065f5180ae1d6c961cf918c1e3f
Instruction Fuzzy Hash: 3151BE7174430A9BEB10EF68DC82F7E7BA4BF98744F01056DFA05A7291DA31E904DB92

Function 00F11D9A Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F11DBB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00F11E03
std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00F11E38
std::_Lockit::~_Lockit.LIBCPMT ref: 00F11ECD
std::_Lockit::_Lockit.LIBCPMT ref: 00F11F1B
std::_Lockit::~_Lockit.LIBCPMT ref: 00F11F3C
std::locale::_Locimp::_Locimp_Addfac.LIBCPMT ref: 00F11F4B

Part of subcall function 00F4E960: _free.LIBCMT ref: 00F4E973

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Lockit::_Lockit::~_$AddfacLocimp::_Locimp_Locinfo_ctorLocinfo_dtor_freestd::locale::_
String ID:
API String ID: 2317827675-0
Opcode ID: 92072012798dd952bc0b2e82eadbe365182b5a14e93b0e54d61a0670955f3d95
Instruction ID: a886af86a9f5e4bf810590c2eff924e5818095436108a144d344c59ff1a4fae2
Opcode Fuzzy Hash: 92072012798dd952bc0b2e82eadbe365182b5a14e93b0e54d61a0670955f3d95
Instruction Fuzzy Hash: A471B0B0E002499FEB10DFA4D845BAEBBF4BF04314F044159E905E7352EB79EA85EB91

Function 00EF52D0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 173COMMON

Download Yara Rule

Strings

0.0.0.0, xrefs: 00EF5816
UUID, xrefs: 00EF5AC8
UUID, xrefs: 00EF5ADA, 00EF5AE2
Version, xrefs: 00EF5911
kernel32.dll, xrefs: 00EF57A8

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID:
String ID: 0.0.0.0$UUID$UUID$Version$kernel32.dll
API String ID: 0-1483847951
Opcode ID: c341b15d4a6ea4a767ae7f3063371b6d725bb6e9f8d17a0be0922d1efacda35a
Instruction ID: a36bb32337990560ab06e79738f0bb8de17bcdbf0cb392e8727b7f8932b2d6df
Opcode Fuzzy Hash: c341b15d4a6ea4a767ae7f3063371b6d725bb6e9f8d17a0be0922d1efacda35a
Instruction Fuzzy Hash: 4C8167B090478CCBEB24DFA8C9487EDBBF2AF55314F208259D524BB392D7784A44DB51

Function 00EEA6B6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,87CF6CF3,?,?), ref: 00EEA531
__Mtx_unlock.LIBCPMT ref: 00EEA73D
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEA7AC
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEA989

Strings

Event string is empty, xrefs: 00EEA77C
Unexpected return value: , xrefs: 00EEA8CC

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$Mtx_unlockMultipleObjectsWait
String ID: Event string is empty$Unexpected return value:
API String ID: 1703231451-1331613497
Opcode ID: b0e54ed9274d72beb850d85f3d37f756194654ace9185a6cdd2f3117cac53852
Instruction ID: d38aa496b2ee5e9627dc87b4fa49492648cf67292db5b410538efe0d096dbf1e
Opcode Fuzzy Hash: b0e54ed9274d72beb850d85f3d37f756194654ace9185a6cdd2f3117cac53852
Instruction Fuzzy Hash: 4751E070900288ABDB18DFA4CC89BECB775EF50314F1452ADE4156B2C2DB74AA85DB62

Function 00F4BE00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00F4BE37
___except_validate_context_record.LIBVCRUNTIME ref: 00F4BE3F
_ValidateLocalCookies.LIBCMT ref: 00F4BEC8
__IsNonwritableInCurrentImage.LIBCMT ref: 00F4BEF3
_ValidateLocalCookies.LIBCMT ref: 00F4BF48

Strings

csm, xrefs: 00F4BEDD

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: cfec108b505321a737c992f1f5f1d8f1e2da00e5f9a03a9a16d2a221dee4a860
Instruction ID: a720f187006c3a4c49b65af0c8ce276a9caeca5179bbdf7c7812f71937b0d28c
Opcode Fuzzy Hash: cfec108b505321a737c992f1f5f1d8f1e2da00e5f9a03a9a16d2a221dee4a860
Instruction Fuzzy Hash: A6416C34E002099BCF10DF68CC84A9EBFB5AF85324F148166ED189B292D775DA19EF91

Function 00EFC960 Relevance: 10.6, APIs: 7, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00EFC995
std::_Lockit::_Lockit.LIBCPMT ref: 00EFC9B7
std::_Lockit::~_Lockit.LIBCPMT ref: 00EFC9D7
__Getctype.LIBCPMT ref: 00EFCA70
std::_Locinfo::~_Locinfo.LIBCPMT ref: 00EFCA82
std::_Facet_Register.LIBCPMT ref: 00EFCA8F
std::_Lockit::~_Lockit.LIBCPMT ref: 00EFCAB1

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeLocinfoLocinfo::~_Register
String ID:
API String ID: 3947131827-0
Opcode ID: 6f292c537eed34d9a90f2e13c97d560f8916e92d9cecba3d809275567e2f713f
Instruction ID: 32516face4cf3c70365c98b03df0423942bbd6a2260a8399e7663b66a9087bb6
Opcode Fuzzy Hash: 6f292c537eed34d9a90f2e13c97d560f8916e92d9cecba3d809275567e2f713f
Instruction Fuzzy Hash: 7141AC7190060C9FCB15DF58DA41ABEB7B4EF54314F209159E81ABB351EB34BA06EB81

Function 00EEA550 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

Part of subcall function 00ED9BB0: InitOnceBeginInitialize.KERNEL32(00FC80C4,00000000,87CF6CF3,00000000,87CF6CF3,00EDA219,00FC80CC,?,?,?,?,?,?,00EDA219,?,?), ref: 00ED9BE5
Part of subcall function 00ED9BB0: InitOnceComplete.KERNEL32(00FC80C4,00000000,00000000), ref: 00ED9C1D

Part of subcall function 00ED9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00ED9A12

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,87CF6CF3,?,?), ref: 00EEA531
__Mtx_unlock.LIBCPMT ref: 00EEA58B
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEA989
__Mtx_unlock.LIBCPMT ref: 00EEA99D

Strings

Thread signalled when event queue is empty, xrefs: 00EEA614
Unexpected return value: , xrefs: 00EEA8CC

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: InitIos_base_dtorMtx_unlockOncestd::ios_base::_$BeginCompleteInitializeMultipleObjectsWait
String ID: Thread signalled when event queue is empty$Unexpected return value:
API String ID: 3324347728-3645029203
Opcode ID: 9f2bd06af00dd9a1c09dac8308fdec4d4a3d3f7d13c6111b16260f9bfe253d95
Instruction ID: a6afce51a6af1a3326afb1bbaa933aed1441f57dcfa862073c6087818f38edbf
Opcode Fuzzy Hash: 9f2bd06af00dd9a1c09dac8308fdec4d4a3d3f7d13c6111b16260f9bfe253d95
Instruction Fuzzy Hash: 8741D0B0D0028CAADF18DBA0CC497DDB7B5EF40314F1452ADE41577282EB746B8ADB52

Function 00F6416A Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 00F641C1
ext-ms-, xrefs: 00F641D5

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 155a2eedbc0cc810fcae243aa40ed5e546a742357a3f2e00bfcec6974d861443
Instruction ID: c9ce5a3e1fe3c328657d76c061cb7731a86108bfd048d710103696cb1c83be13
Opcode Fuzzy Hash: 155a2eedbc0cc810fcae243aa40ed5e546a742357a3f2e00bfcec6974d861443
Instruction Fuzzy Hash: DB21E772E41215ABCB22AB649D95B6A3798AF16B70F250510FD15E72D1D630FC01FAE0

Function 00F6B9B3 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F6B6FF: _free.LIBCMT ref: 00F6B724

_free.LIBCMT ref: 00F6BA01

Part of subcall function 00F62098: RtlFreeHeap.NTDLL(00000000,00000000,?,00F6B729,?,00000000,?,?,?,00F6B9CC,?,00000007,?,?,00F6BDD6,?), ref: 00F620AE
Part of subcall function 00F62098: GetLastError.KERNEL32(?,?,00F6B729,?,00000000,?,?,?,00F6B9CC,?,00000007,?,?,00F6BDD6,?,?), ref: 00F620C0

_free.LIBCMT ref: 00F6BA0C
_free.LIBCMT ref: 00F6BA17
_free.LIBCMT ref: 00F6BA6B
_free.LIBCMT ref: 00F6BA76
_free.LIBCMT ref: 00F6BA81
_free.LIBCMT ref: 00F6BA8C

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c22744a6882dbffdb4525d9527ade6ae6b6bf27445b1f441715d8059192af9a9
Instruction ID: 6ba020bd7d6d2462d2104f1eea6f696922882d26ad6bd4a8842072dc09472323
Opcode Fuzzy Hash: c22744a6882dbffdb4525d9527ade6ae6b6bf27445b1f441715d8059192af9a9
Instruction Fuzzy Hash: 8C113A71941F08BAD630BBB1CC07FCB779DAF00741F400815B2AEA7152EB6AA549E650

Function 00F6576D Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00F0860A,00000000), ref: 00F657B5
__fassign.LIBCMT ref: 00F65994
__fassign.LIBCMT ref: 00F659B1
WriteFile.KERNEL32(?,00F0860A,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00F659F9
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00F65A39
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00F65AE5

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: aab912858f36b2bfc41a01c46f7a7404c170494fe10a15de4f0f567f52b5234b
Instruction ID: 23ba8d5e932e50591f9cb34a77d70037ac96b5719591cc6b10357253272a8206
Opcode Fuzzy Hash: aab912858f36b2bfc41a01c46f7a7404c170494fe10a15de4f0f567f52b5234b
Instruction Fuzzy Hash: 0ED1A971D006599FCF15CFE8C9809EDBBB5BF48714F28016AE856FB242D634AE06EB50

Function 00F4809D Relevance: 9.2, APIs: 6, Instructions: 224COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?,?,?,?), ref: 00F48128
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00F481B6
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00F48228
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000), ref: 00F48242
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00F482A5
CompareStringEx.KERNEL32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00F482C2

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ByteCharMultiWide$CompareInfoString
String ID:
API String ID: 2984826149-0
Opcode ID: 64210ce7c74f3358e3e1f90dbb5dbf8f7f1bd889035411529eaeffdca9e355a9
Instruction ID: 3431a7010165c7fad356caae81a7f1f9c8e895d3fe0837854038fe69fbdf54c3
Opcode Fuzzy Hash: 64210ce7c74f3358e3e1f90dbb5dbf8f7f1bd889035411529eaeffdca9e355a9
Instruction Fuzzy Hash: 88719232D0060AAFDF219FA4CC45AEF7FB6AF897A0F14011AED05A7250DF758946E760

Function 00F368B8 Relevance: 9.2, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00F36901
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00F3696C
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F36989
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00F369C8
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F36A27
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00F36A4A

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 67a8990f5bfeb6fa2a5545bbcbc85f33fc4de1820537336918a644f9998b0918
Instruction ID: 723262b0bd313099412c847254e10d2b0ca45202d8351c579d2052413d699db9
Opcode Fuzzy Hash: 67a8990f5bfeb6fa2a5545bbcbc85f33fc4de1820537336918a644f9998b0918
Instruction Fuzzy Hash: DE518E7290021ABFEF209F64CC45FAA7BA9EF44B70F15C525F914E6190E7389D14EB60

Function 00EFDF80 Relevance: 9.2, APIs: 6, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,87CF6CF3), ref: 00EFE00F
LocalAlloc.KERNEL32(00000040,00000014,00000001,?,?,?,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00EFE073
LocalFree.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,00000001), ref: 00EFE104
LocalFree.KERNEL32(?,00000001,?,?,?,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00EFE112
FreeSid.ADVAPI32(00000000,00000001,?,?,?,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00EFE11D

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: FreeLocal$AllocErrorLast
String ID:
API String ID: 3195132385-0
Opcode ID: 397caa8483d3eafcd0b4bdcd3b69a410472ae069c667b47bd45c6c18bfc0763a
Instruction ID: 5aa66f4f6d390ccaf341c6ffdfaecf6dda3ed374bc96e3bf8aaeab7d8aa50027
Opcode Fuzzy Hash: 397caa8483d3eafcd0b4bdcd3b69a410472ae069c667b47bd45c6c18bfc0763a
Instruction Fuzzy Hash: DD510971E0021CABDB10DF94DC85BEEBBB9EF48714F10412AEA11B7391D775A9049BA1

Function 00EDE790 Relevance: 9.1, APIs: 6, Instructions: 130COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000001,?,00000000), ref: 00EDE7D7
GetSecurityDescriptorDacl.ADVAPI32(00000000,00000000,00000000,?), ref: 00EDE811
SetNamedSecurityInfoW.ADVAPI32(00000000,00000001,00000004,00000000,00000000,00000000,00000000,?), ref: 00EDE86D
LocalFree.KERNEL32(00000000), ref: 00EDE8C7
LocalFree.KERNEL32(00000000), ref: 00EDE8DC
LocalFree.KERNEL32(00000000), ref: 00EDE917

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Security$DescriptorFreeLocal$ConvertDaclInfoNamedString
String ID:
API String ID: 2792426717-0
Opcode ID: 06615b1d10cfa564dbd9aaa4c7d6e2afca7cc7c2572aedfdd09fb1ddfe71a27a
Instruction ID: cad8aab32ede7010ea91dd3df215fa17e72a68e4298a16e50c73cd3d4c37c38c
Opcode Fuzzy Hash: 06615b1d10cfa564dbd9aaa4c7d6e2afca7cc7c2572aedfdd09fb1ddfe71a27a
Instruction Fuzzy Hash: 8F417B75E01208ABEF14DFA4DD49BEEBBB9EF04704F24012AF911B6390D7799A05DB60

Function 00ED8D10 Relevance: 9.1, APIs: 6, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00ED8D46
std::_Lockit::_Lockit.LIBCPMT ref: 00ED8D66
std::_Lockit::~_Lockit.LIBCPMT ref: 00ED8D86
std::_Locinfo::~_Locinfo.LIBCPMT ref: 00ED8E57
std::_Facet_Register.LIBCPMT ref: 00ED8E64
std::_Lockit::~_Lockit.LIBCPMT ref: 00ED8E86

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_LocinfoLocinfo::~_Register
String ID:
API String ID: 2966223926-0
Opcode ID: 057cf7c5a2b29a0a9dbf3618d2fe5ea82c9a1eb70db1ccb9a65e7fbaa724aaf0
Instruction ID: 19a78d1986da750d2a5290997950de50ccc03d0a2a4368f6e3b5dd623ab6db58
Opcode Fuzzy Hash: 057cf7c5a2b29a0a9dbf3618d2fe5ea82c9a1eb70db1ccb9a65e7fbaa724aaf0
Instruction Fuzzy Hash: 8941BF719002199FCB11DF54DD81BAEBBB5FF50314F14415AE806AB391DF34AE0ADB81

Function 00EE3400 Relevance: 9.1, APIs: 6, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00EE3435
std::_Lockit::_Lockit.LIBCPMT ref: 00EE3457
std::_Lockit::~_Lockit.LIBCPMT ref: 00EE3477
std::_Locinfo::~_Locinfo.LIBCPMT ref: 00EE353A
std::_Facet_Register.LIBCPMT ref: 00EE3547
std::_Lockit::~_Lockit.LIBCPMT ref: 00EE3569

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_LocinfoLocinfo::~_Register
String ID:
API String ID: 2966223926-0
Opcode ID: 128bd925424bddb783e307f5187ba4bcf20d1c3b2aadbc99b6097a849d1d219b
Instruction ID: d2e844336618ed270367215a8c4f68d8029e33d98d9840a45eca0a1d68f17340
Opcode Fuzzy Hash: 128bd925424bddb783e307f5187ba4bcf20d1c3b2aadbc99b6097a849d1d219b
Instruction Fuzzy Hash: 0541FF709042498FCB01DF69D945AAEB7B0FF54314F10825EE809AB392EB34EB09DB81

Function 00ED32DE Relevance: 9.1, APIs: 6, Instructions: 70COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00ED32E5
std::_Lockit::_Lockit.LIBCPMT ref: 00ED32F2

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

std::_Facet_Register.LIBCPMT ref: 00ED3340
std::_Lockit::~_Lockit.LIBCPMT ref: 00ED3360
Concurrency::cancel_current_task.LIBCPMT ref: 00ED336D
__Towlower.LIBCPMT ref: 00ED3388

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3_RegisterTowlower
String ID:
API String ID: 2111902878-0
Opcode ID: eb867d3c74e29c716a3db8d6dbabbaf300c6647f420ec40e4984089d4e2ea9d1
Instruction ID: 0c856e794483894244e390cb6f07d1634db454272fb51cc1430fcabf7606fec1
Opcode Fuzzy Hash: eb867d3c74e29c716a3db8d6dbabbaf300c6647f420ec40e4984089d4e2ea9d1
Instruction Fuzzy Hash: 5F11C6319011099FCB04EBB4DA42ABE77A5EF94724F24011AF915A7392DF349F03E752

Function 00F4BFCA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00F4BFC1,00F4A1CC,00F495E4), ref: 00F4BFD8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00F4BFE6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00F4BFFF
SetLastError.KERNEL32(00000000,00F4BFC1,00F4A1CC,00F495E4), ref: 00F4C051

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 75bd178b1a9a0fd0fd2c32eb64bdf66a84f7b13da765a09b8d200a9f27e12faf
Instruction ID: 0a57c49c151d8572c177768954e2fc8b26e8f84d74596836a8bacb209473e28c
Opcode Fuzzy Hash: 75bd178b1a9a0fd0fd2c32eb64bdf66a84f7b13da765a09b8d200a9f27e12faf
Instruction Fuzzy Hash: BF01B136B0A319AEA7642ABC7C8567A3F45EB42774B20033AFD10D50F5EE554C45B684

Function 00F38298 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F3829F
std::_Lockit::_Lockit.LIBCPMT ref: 00F382A9

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

moneypunct.LIBCPMT ref: 00F382E3
std::_Facet_Register.LIBCPMT ref: 00F382FA
std::_Lockit::~_Lockit.LIBCPMT ref: 00F3831A
Concurrency::cancel_current_task.LIBCPMT ref: 00F38327

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
String ID:
API String ID: 3376033448-0
Opcode ID: ae0e0b82f18104704585ec5e970e064faf9197b50e44a1a76dcba8754adca3cf
Instruction ID: d7943dba65e2b6e909874636d8f4d39ff9f889f01b5cdb04a5291720c04d21f9
Opcode Fuzzy Hash: ae0e0b82f18104704585ec5e970e064faf9197b50e44a1a76dcba8754adca3cf
Instruction Fuzzy Hash: 74018E319002599BCB05EBA4C842AAE7BB1AF84B20F24400AF81167391CF789E06AB91

Function 00F38203 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F3820A
std::_Lockit::_Lockit.LIBCPMT ref: 00F38214

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

moneypunct.LIBCPMT ref: 00F3824E
std::_Facet_Register.LIBCPMT ref: 00F38265
std::_Lockit::~_Lockit.LIBCPMT ref: 00F38285
Concurrency::cancel_current_task.LIBCPMT ref: 00F38292

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
String ID:
API String ID: 3376033448-0
Opcode ID: 2d319d2ebf1f5490f11f368a4a400abc5065c36bcf6951b5a9a79407642829a1
Instruction ID: 5bf72597fa40578c6ec6b7f7d08c09e2c361a4fc9bd61faa4717a97266799297
Opcode Fuzzy Hash: 2d319d2ebf1f5490f11f368a4a400abc5065c36bcf6951b5a9a79407642829a1
Instruction Fuzzy Hash: 0A01C031D042599BCB05EBA4CC42AAE77B1FF80370F244509F911AB391DF789E02BB91

Function 00F383C2 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F383C9
std::_Lockit::_Lockit.LIBCPMT ref: 00F383D3

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

moneypunct.LIBCPMT ref: 00F3840D
std::_Facet_Register.LIBCPMT ref: 00F38424
std::_Lockit::~_Lockit.LIBCPMT ref: 00F38444
Concurrency::cancel_current_task.LIBCPMT ref: 00F38451

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
String ID:
API String ID: 3376033448-0
Opcode ID: 6668b535797be89759698de4e3148f39cea0eebadc2eaacfa926cb3fdc2fb374
Instruction ID: dedbf61f4f5c1dbd1eb1b0531cfe4be816540caedec236f2b74b4e59b1f2bcd6
Opcode Fuzzy Hash: 6668b535797be89759698de4e3148f39cea0eebadc2eaacfa926cb3fdc2fb374
Instruction Fuzzy Hash: B501C431D0421A9BCB05FB64C841ABDB7B5BF80320F24010AF91567391DF789E06BB91

Function 00F3435B Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F34362
std::_Lockit::_Lockit.LIBCPMT ref: 00F3436C

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

codecvt.LIBCPMT ref: 00F343A6
std::_Facet_Register.LIBCPMT ref: 00F343BD
std::_Lockit::~_Lockit.LIBCPMT ref: 00F343DD
Concurrency::cancel_current_task.LIBCPMT ref: 00F343EA

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: 6e29a8e2acd2ca3379fc490912103c5bcf00369b75c509209ea1d65ae3899ec7
Instruction ID: 50d3a4bfd57436f2f31badc8a5d84b493841e3cb69ff9e5522d980838656c6fd
Opcode Fuzzy Hash: 6e29a8e2acd2ca3379fc490912103c5bcf00369b75c509209ea1d65ae3899ec7
Instruction Fuzzy Hash: E401AD319002199BCB05FBA4C942AAD77B1FF50320F244109E814AB3D1DF78AA05BB91

Function 00F3832D Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F38334
std::_Lockit::_Lockit.LIBCPMT ref: 00F3833E

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

moneypunct.LIBCPMT ref: 00F38378
std::_Facet_Register.LIBCPMT ref: 00F3838F
std::_Lockit::~_Lockit.LIBCPMT ref: 00F383AF
Concurrency::cancel_current_task.LIBCPMT ref: 00F383BC

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
String ID:
API String ID: 3376033448-0
Opcode ID: 88c0348594ea45c1a56f6aa9f842a552a085dbf675d14b745be2a64b1555c38b
Instruction ID: 67b89ba759f82d9b04750fe89f829b0ca5e24a855286b602598fd9e07b206f67
Opcode Fuzzy Hash: 88c0348594ea45c1a56f6aa9f842a552a085dbf675d14b745be2a64b1555c38b
Instruction Fuzzy Hash: C801C471D002199BCB05FB64CD02ABD7BB1AF80760F24000AF810673D1DF789E06BB91

Function 00F44475 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F4447C
std::_Lockit::_Lockit.LIBCPMT ref: 00F44486

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

collate.LIBCPMT ref: 00F444C0
std::_Facet_Register.LIBCPMT ref: 00F444D7
std::_Lockit::~_Lockit.LIBCPMT ref: 00F444F7
Concurrency::cancel_current_task.LIBCPMT ref: 00F44504

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercollate
String ID:
API String ID: 1767075461-0
Opcode ID: 04d4526f9ef8e6534de42b3ec25171f4a81205408c8259efd0e722069a1dc999
Instruction ID: 21fb8f54e6bbd14d783854d4479ca00217024b5d9198b25d2cb76aff7db245d9
Opcode Fuzzy Hash: 04d4526f9ef8e6534de42b3ec25171f4a81205408c8259efd0e722069a1dc999
Instruction Fuzzy Hash: 7301A1319002599BCB05EBA4C842BAD7BB1BF54320F24450AFC10773D2DF38AA01AB81

Function 00F4450A Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F44511
std::_Lockit::_Lockit.LIBCPMT ref: 00F4451B

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

messages.LIBCPMT ref: 00F44555
std::_Facet_Register.LIBCPMT ref: 00F4456C
std::_Lockit::~_Lockit.LIBCPMT ref: 00F4458C
Concurrency::cancel_current_task.LIBCPMT ref: 00F44599

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermessages
String ID:
API String ID: 958335874-0
Opcode ID: 5caa0953277374dbc80f869bc6049d3ec039d18b697462176ecd4191377c212d
Instruction ID: 212eac059932a4b662314feab29a380fbedfe0d4cb2607b7ae04369aeed6ec9b
Opcode Fuzzy Hash: 5caa0953277374dbc80f869bc6049d3ec039d18b697462176ecd4191377c212d
Instruction Fuzzy Hash: E901A1759001199BCB05EBA4C942AAD7BB5BF44320F28050AF910BB391CF34AA01AB81

Function 00F446C9 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F446D0
std::_Lockit::_Lockit.LIBCPMT ref: 00F446DA

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

moneypunct.LIBCPMT ref: 00F44714
std::_Facet_Register.LIBCPMT ref: 00F4472B
std::_Lockit::~_Lockit.LIBCPMT ref: 00F4474B
Concurrency::cancel_current_task.LIBCPMT ref: 00F44758

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
String ID:
API String ID: 3376033448-0
Opcode ID: fff3bf14ac15b8f1dd710e2e1b9759bf960a703f3e723914c4e41fb0ada90710
Instruction ID: 146b91b8143f0926bf48878c8b401f724fe8e3e15f298b9d9c38b68d5c8f1e19
Opcode Fuzzy Hash: fff3bf14ac15b8f1dd710e2e1b9759bf960a703f3e723914c4e41fb0ada90710
Instruction Fuzzy Hash: 0001C435D002599BCB05EBA4C941ABD7BB5EF50320F250049F920BB391CF78AE02BB81

Function 00F38616 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F3861D
numpunct.LIBCPMT ref: 00F38661
std::_Facet_Register.LIBCPMT ref: 00F38678
std::_Lockit::~_Lockit.LIBCPMT ref: 00F38698
Concurrency::cancel_current_task.LIBCPMT ref: 00F386A5
std::_Lockit::_Lockit.LIBCPMT ref: 00F38627

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registernumpunct
String ID:
API String ID: 3064348918-0
Opcode ID: 8df164d6decab5a31f91c2e5195ac8f1660e0485bac481ec0eb0e762481b97cf
Instruction ID: 94e417385497bab6b124595415c18ca33cddf9a3793aeafea23ad076c93a1fc5
Opcode Fuzzy Hash: 8df164d6decab5a31f91c2e5195ac8f1660e0485bac481ec0eb0e762481b97cf
Instruction Fuzzy Hash: 3301C071D003199BCB05EBA4CD56AAD7BB1AF80734F240109F914AB3D1DF789E02BB81

Function 00F4475E Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F44765
std::_Lockit::_Lockit.LIBCPMT ref: 00F4476F

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

moneypunct.LIBCPMT ref: 00F447A9
std::_Facet_Register.LIBCPMT ref: 00F447C0
std::_Lockit::~_Lockit.LIBCPMT ref: 00F447E0
Concurrency::cancel_current_task.LIBCPMT ref: 00F447ED

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermoneypunct
String ID:
API String ID: 3376033448-0
Opcode ID: feb47f651bcd3e37af6a74382d799db3c12b85bd6bd3d456ede8e1afe02076b0
Instruction ID: 76ce28f96d32bc221bd8037278f614cd29e4c30ff203cfc9f9af689c56b86257
Opcode Fuzzy Hash: feb47f651bcd3e37af6a74382d799db3c12b85bd6bd3d456ede8e1afe02076b0
Instruction Fuzzy Hash: F501A1759002199BCB05EBA4D941AAD7BB1BF90724F244109F91077391CF78AA02AB91

Function 00F37CC6 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F37CCD
std::_Lockit::_Lockit.LIBCPMT ref: 00F37CD7

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

collate.LIBCPMT ref: 00F37D11
std::_Facet_Register.LIBCPMT ref: 00F37D28
std::_Lockit::~_Lockit.LIBCPMT ref: 00F37D48
Concurrency::cancel_current_task.LIBCPMT ref: 00F37D55

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercollate
String ID:
API String ID: 1767075461-0
Opcode ID: dee2e08d5049b36bfb4ae32527be65d883de7e4725d9b65bbf123b0fac05981b
Instruction ID: 30104a95ea97293ea5d0f63d6beb7b8defe3083ccfcf69bd95d8ca6e8b636c6a
Opcode Fuzzy Hash: dee2e08d5049b36bfb4ae32527be65d883de7e4725d9b65bbf123b0fac05981b
Instruction Fuzzy Hash: 8701C471D042199BCB05FB64CC42ABD77B5AF84330F244009E815AB391DF749E05BB91

Function 00F37C31 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F37C38
std::_Lockit::_Lockit.LIBCPMT ref: 00F37C42

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

codecvt.LIBCPMT ref: 00F37C7C
std::_Facet_Register.LIBCPMT ref: 00F37C93
std::_Lockit::~_Lockit.LIBCPMT ref: 00F37CB3
Concurrency::cancel_current_task.LIBCPMT ref: 00F37CC0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: f92c6d578be85cff9acedf71e735be2f5d868a20af7b450c1a2f0400541e8f36
Instruction ID: 9d0d559b78841cc8b005a95161e668052982695646f4803b3db626e181964365
Opcode Fuzzy Hash: f92c6d578be85cff9acedf71e735be2f5d868a20af7b450c1a2f0400541e8f36
Instruction Fuzzy Hash: 6B01C471D082199BCB15FB64CC01AAEB7B5AF90770F24440DF810AB391DF749E01AB91

Function 00F37DF0 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F37DF7
std::_Lockit::_Lockit.LIBCPMT ref: 00F37E01

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

ctype.LIBCPMT ref: 00F37E3B
std::_Facet_Register.LIBCPMT ref: 00F37E52
std::_Lockit::~_Lockit.LIBCPMT ref: 00F37E72
Concurrency::cancel_current_task.LIBCPMT ref: 00F37E7F

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registerctype
String ID:
API String ID: 2958136301-0
Opcode ID: 725a04c10e37fd8d89f78fc630e4fa53d57b690e810e9fb162fc6d91ccd59e26
Instruction ID: c7f7aa5c39de169ed42b4647dd3d0124824819067eac7a659aa0c67d6ff47c71
Opcode Fuzzy Hash: 725a04c10e37fd8d89f78fc630e4fa53d57b690e810e9fb162fc6d91ccd59e26
Instruction Fuzzy Hash: 1801C071D042199BCB05FBA4DC02ABEB7B1AF94320F24404AE810AB3D1DF749E06FB91

Function 00F37D5B Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F37D62
std::_Lockit::_Lockit.LIBCPMT ref: 00F37D6C

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

collate.LIBCPMT ref: 00F37DA6
std::_Facet_Register.LIBCPMT ref: 00F37DBD
std::_Lockit::~_Lockit.LIBCPMT ref: 00F37DDD
Concurrency::cancel_current_task.LIBCPMT ref: 00F37DEA

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercollate
String ID:
API String ID: 1767075461-0
Opcode ID: d4df75b134eeda796e2ffebcab991b9d87cb98582d9e5e21a02883664d228c8b
Instruction ID: d271f2c2adb14830e767c90ab08d546e72a090edf175f0f669bf60b62f094535
Opcode Fuzzy Hash: d4df75b134eeda796e2ffebcab991b9d87cb98582d9e5e21a02883664d228c8b
Instruction Fuzzy Hash: D401AD719082199BCB05FBA4C942ABD77B5BF90320F244109F811AB3D1DF789E02AB91

Function 00F37E85 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F37E8C
std::_Lockit::_Lockit.LIBCPMT ref: 00F37E96

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

messages.LIBCPMT ref: 00F37ED0
std::_Facet_Register.LIBCPMT ref: 00F37EE7
std::_Lockit::~_Lockit.LIBCPMT ref: 00F37F07
Concurrency::cancel_current_task.LIBCPMT ref: 00F37F14

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermessages
String ID:
API String ID: 958335874-0
Opcode ID: 43d6a9f82ffc630d1ba3a5d6d876be474c2bb3678d2151e83efe0b8e294fd731
Instruction ID: 48dc9353f69a43c9d4b04174a168a4727ece630119f8562b4f576987b9231303
Opcode Fuzzy Hash: 43d6a9f82ffc630d1ba3a5d6d876be474c2bb3678d2151e83efe0b8e294fd731
Instruction Fuzzy Hash: 08018B719082199BCB05FBA4C802ABE77A1BF80330F24454AF810AB391DF789E01EB91

Function 00F37F1A Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F37F21
std::_Lockit::_Lockit.LIBCPMT ref: 00F37F2B

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

messages.LIBCPMT ref: 00F37F65
std::_Facet_Register.LIBCPMT ref: 00F37F7C
std::_Lockit::~_Lockit.LIBCPMT ref: 00F37F9C
Concurrency::cancel_current_task.LIBCPMT ref: 00F37FA9

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registermessages
String ID:
API String ID: 958335874-0
Opcode ID: cd371440e4c00cb53f32e2a3575ae0c18ebd98e933e8db903b5276d8e91e8b79
Instruction ID: e22aec7676059a69cd70c601150595c23c35e4d5f2161267304844c17982b065
Opcode Fuzzy Hash: cd371440e4c00cb53f32e2a3575ae0c18ebd98e933e8db903b5276d8e91e8b79
Instruction Fuzzy Hash: 2C01C471D0421A9BCB15FBA4C941ABD77B1BF84730F244109F8146B391CF749E01BB81

Function 00EFC410 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00EFC546
Concurrency::cancel_current_task.LIBCPMT ref: 00EFC54B
Concurrency::cancel_current_task.LIBCPMT ref: 00EFC550

Part of subcall function 00F4E960: _free.LIBCMT ref: 00F4E973

Strings

false, xrefs: 00EFC4D9
true, xrefs: 00EFC503

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Concurrency::cancel_current_task$_free
String ID: false$true
API String ID: 149343396-2658103896
Opcode ID: 726c4a6933ea7ce9eca6f3b29d5ef775176d9c3fc95ab2713776ecfa26ee46d1
Instruction ID: 2d09793fb3c14973c1ab96cce606932d12fb649b31be191803cd038382537e69
Opcode Fuzzy Hash: 726c4a6933ea7ce9eca6f3b29d5ef775176d9c3fc95ab2713776ecfa26ee46d1
Instruction Fuzzy Hash: C64156759003489FCB20DF74DD41BAABBF4AF06304F24855DE916AB342D77AE908DBA1

Function 00EED87D Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 110COMMON

Download Yara Rule

APIs

Part of subcall function 00ED9BB0: InitOnceBeginInitialize.KERNEL32(00FC80C4,00000000,87CF6CF3,00000000,87CF6CF3,00EDA219,00FC80CC,?,?,?,?,?,?,00EDA219,?,?), ref: 00ED9BE5
Part of subcall function 00ED9BB0: InitOnceComplete.KERNEL32(00FC80C4,00000000,00000000), ref: 00ED9C1D

Part of subcall function 00ED9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00ED9A12

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EED8F5
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEDF0C

Strings

Event Sender already initialized for Azure, xrefs: 00EEDEE2
~, xrefs: 00EED8B6
Failed to encode url, xrefs: 00EED8C5

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$InitOnce$BeginCompleteInitialize
String ID: Event Sender already initialized for Azure$Failed to encode url$~
API String ID: 1656330964-1958975516
Opcode ID: 1ddee2d78a149fe2df2caa6e79aea2e32840ad05d072fb9dffa348543cbfdac5
Instruction ID: 51fe5d0a1dc086f6593654d0deb43af1f0215993f9a173212cd04c098d2f297c
Opcode Fuzzy Hash: 1ddee2d78a149fe2df2caa6e79aea2e32840ad05d072fb9dffa348543cbfdac5
Instruction Fuzzy Hash: EA410270D0425CAFDB18EB60CC55BDDB7B9EB45314F0042DAE80977392EB746A48CB51

Function 00F3DDD2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F3DDD9
_Getvals.LIBCPMT ref: 00F3DE2B
_Mpunct.LIBCPMT ref: 00F3DE66
_Mpunct.LIBCPMT ref: 00F3DE80

Strings

$+xv, xrefs: 00F3DE8B

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Mpunct$GetvalsH_prolog3
String ID: $+xv
API String ID: 2204710431-1686923651
Opcode ID: e9f74a686b3cfbbdcee46ba3c630503faa3f4be19fd1b03e5993785b982c7b8b
Instruction ID: 97102fd4cc90c1762406aefcc1391b0e131cb8d7690ae98c42dccdf8b84130b9
Opcode Fuzzy Hash: e9f74a686b3cfbbdcee46ba3c630503faa3f4be19fd1b03e5993785b982c7b8b
Instruction Fuzzy Hash: 2B2190B1904A526FDB21DF74C89073BBEF8AB08710F044A5AE459CBA41D734E645DB90

Function 00F55FF6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,?,?), ref: 00F56016
GetFileType.KERNEL32(00000000), ref: 00F56028
swprintf.LIBCMT ref: 00F56049
WriteConsoleW.KERNEL32(00000000,?,?,?,00000000), ref: 00F56086

Strings

Assertion failed: %Ts, file %Ts, line %d, xrefs: 00F5603E

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ConsoleFileHandleTypeWriteswprintf
String ID: Assertion failed: %Ts, file %Ts, line %d
API String ID: 2943507729-1719349581
Opcode ID: c0b841be6168b054c89698ab0f827439699acbf29d1564a4a8d987d58469ef15
Instruction ID: e8ae1dc082f3567e1163457bd3f973a7ab821b58c06824a62b10b8d2955e0238
Opcode Fuzzy Hash: c0b841be6168b054c89698ab0f827439699acbf29d1564a4a8d987d58469ef15
Instruction Fuzzy Hash: C3110471900118ABDB209B28CC45AEF77ADEF85321F90465DFE26D31C1EA30AD499B64

Function 00F4D1B7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,00F4D278,?,?,00FC77FC,00000000,?,00F4D3A3,00000004,InitializeCriticalSectionEx,00FA013C,00FA0144,00000000), ref: 00F4D247

Strings

api-ms-, xrefs: 00F4D207

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 448ad82940e1d1d72cb3a9e31dee486f155fec9410ef7fdd0a03142f9e01cfe8
Instruction ID: a71d4d4683c09a850c9c446be1f1bc9f40c96e39d5bfa0f702e67895a69383c8
Opcode Fuzzy Hash: 448ad82940e1d1d72cb3a9e31dee486f155fec9410ef7fdd0a03142f9e01cfe8
Instruction Fuzzy Hash: 1B11A932E41625BBDB229B68AC45B5A7BA4AF42770F250551FD11E72C0D7B0EE00FBD1

Function 00EFE150 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 00EFE172
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00EFE182
RegDeleteKeyW.ADVAPI32(00000000,?), ref: 00EFE1C2

Strings

Advapi32.dll, xrefs: 00EFE16D
RegDeleteKeyExW, xrefs: 00EFE17C

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AddressDeleteHandleModuleProc
String ID: Advapi32.dll$RegDeleteKeyExW
API String ID: 588496660-2191092095
Opcode ID: 0f91712cc5c0ec7118f68702a7b5a7a867b7a7f9da3ae6e8e2aacae48bdbf991
Instruction ID: e02416ea58a021c706841bd04c364cb5ebfcc4dabafccef20002f4bbf422b700
Opcode Fuzzy Hash: 0f91712cc5c0ec7118f68702a7b5a7a867b7a7f9da3ae6e8e2aacae48bdbf991
Instruction Fuzzy Hash: 2101757524920C9AE7214B5AFD05FB27BA9A791B25F04443BE204E3270C7B2E450EB65

Function 00EFF980 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,87CF6CF3), ref: 00EFF989
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00EFF9A9

Strings

IsWow64Process, xrefs: 00EFF9A3
kernel32, xrefs: 00EFF984

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsWow64Process$kernel32
API String ID: 1646373207-3789238822
Opcode ID: 3b3d7054f48dc67fc0d49fd56055c635f5d82db25a55bf26226d78188bb7e7e6
Instruction ID: 21478c6f4aa1b16128d53501bd1061df728fa41f8a4da231b923f5a8fed4a173
Opcode Fuzzy Hash: 3b3d7054f48dc67fc0d49fd56055c635f5d82db25a55bf26226d78188bb7e7e6
Instruction Fuzzy Hash: DCF0A4B2A4021CAFC710DF94DC09BAA7BA8EF56751F104566FD04D7240D6B1DD10DBE1

Function 00F211F0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00F21210
GetLastError.KERNEL32 ref: 00F2121A

Strings

c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\CabParser.h, xrefs: 00F2122D
WriteFile failed: %d, xrefs: 00F21221
NWebAdvisor::CCabParser::Write, xrefs: 00F21228

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: NWebAdvisor::CCabParser::Write$WriteFile failed: %d$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\CabParser.h
API String ID: 442123175-2264278858
Opcode ID: 760d50f44061dfc2da41f49b2cbb6e72240106314582c344e741b379953d5eb2
Instruction ID: 85498ed64d0f6f6780b85b13f283fec47fb0de03406e0fa305a0fde9d6452eb1
Opcode Fuzzy Hash: 760d50f44061dfc2da41f49b2cbb6e72240106314582c344e741b379953d5eb2
Instruction Fuzzy Hash: 15F08C31700108BFEB00EFA89C46F7EBBA4AB18B04F400159BD09AA281EA719A15EB51

Function 00F008A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 00F008A9
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00F008C0
GetCurrentProcess.KERNEL32(?), ref: 00F008D7

Strings

IsWow64Process, xrefs: 00F008BA
kernel32, xrefs: 00F008A4

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$kernel32
API String ID: 4190356694-3789238822
Opcode ID: f0b033fc879841a85cbeab645b3af30d9db74b9bc69393cc6c307f240b8b0d73
Instruction ID: d7fb98f96447a35eaf665a488a318fa848cf3518614a88af7602356a97dae0ea
Opcode Fuzzy Hash: f0b033fc879841a85cbeab645b3af30d9db74b9bc69393cc6c307f240b8b0d73
Instruction Fuzzy Hash: 18F08272D4131CABDF109AA06C09BEA779CAB02765F104A95EC0893240EA71CD14B6D1

Function 00F5E940 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00F5E935,?,?,00F5E8FD,00000002,00000002,?), ref: 00F5E955
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00F5E968
FreeLibrary.KERNEL32(00000000,?,?,00F5E935,?,?,00F5E8FD,00000002,00000002,?), ref: 00F5E98B

Strings

CorExitProcess, xrefs: 00F5E960
mscoree.dll, xrefs: 00F5E94E

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e709f7e6ec63960d478137c2c4b09a5e8372725edcc00cdfdea423add609accd
Instruction ID: 52eaad8490989def8bde2cfac12fbd0c7439e5b8fcd949e321b840922b3d9e12
Opcode Fuzzy Hash: e709f7e6ec63960d478137c2c4b09a5e8372725edcc00cdfdea423add609accd
Instruction Fuzzy Hash: 46F05831A50218BBDB119B91DD0ABEDBA78AF01B66F110060E904A20A0CBB08F04FBA1

Function 00F603F2 Relevance: 7.7, APIs: 5, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00F62174: RtlAllocateHeap.NTDLL(00000000,?,?,?,00F4872D,?,?,00EDA1ED,0000002C,87CF6CF3), ref: 00F621A6

_free.LIBCMT ref: 00F60501
_free.LIBCMT ref: 00F60518
_free.LIBCMT ref: 00F60535
_free.LIBCMT ref: 00F60550
_free.LIBCMT ref: 00F60567

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: 024e88389896dc00b6b6b0aae5c2e1dc14d900ff17dc9d3e3926c20df9ad7cb1
Instruction ID: 8dc9a73b21f2d8008b1b034286130006f123e8f1261730e9b32129e1e81ba5de
Opcode Fuzzy Hash: 024e88389896dc00b6b6b0aae5c2e1dc14d900ff17dc9d3e3926c20df9ad7cb1
Instruction Fuzzy Hash: F7518C72A00705AFDB21DF29DC41B6BB7F5EF49720B240969E90AD7251EB35EE01EB40

Function 00EF9D60 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,00FBCFC4,00FBCFC6,?,00FBCFC6,?,00FBCFC4,ios_base::failbit set,00000000), ref: 00EF9DB0
GetLastError.KERNEL32(?,00FBCFC6,?,00FBCFC4,ios_base::failbit set,00000000), ref: 00EF9DC1
MultiByteToWideChar.KERNEL32(?,00000000,00FBCFC4,00FBCFC6,00000000,00000000,?,00FBCFC6,?,00FBCFC4,ios_base::failbit set,00000000), ref: 00EF9DD9
MultiByteToWideChar.KERNEL32(?,00000000,00FBCFC4,?,?,00000000,?,?,?,00FBCFC6,?,00FBCFC4,ios_base::failbit set,00000000), ref: 00EF9DFF

Strings

ios_base::failbit set, xrefs: 00EF9D88

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ios_base::failbit set
API String ID: 1717984340-3924258884
Opcode ID: 3720fae01edec2195a143635af2d12c9a99a28d14a420de500a49d8c391f7794
Instruction ID: b1be19bca63762ef1f5f20ac261e9f3d5efba89c67a7fadc087c516ea9eac394
Opcode Fuzzy Hash: 3720fae01edec2195a143635af2d12c9a99a28d14a420de500a49d8c391f7794
Instruction Fuzzy Hash: 0A21237620130DBFE3205F60CC49FB7BB9CEF46348F204519F78566092DB72A4158BA1

Function 00EE9B0D Relevance: 7.6, APIs: 5, Instructions: 78threadCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 00EE9B16
GetCurrentThreadId.KERNEL32 ref: 00EE9B29

Part of subcall function 00F366B6: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000), ref: 00F366C1
Part of subcall function 00F366B6: GetExitCodeThread.KERNEL32(?,?), ref: 00F366D3
Part of subcall function 00F366B6: CloseHandle.KERNEL32(?), ref: 00F366EC

CloseHandle.KERNEL32(?), ref: 00EE9B81
CloseHandle.KERNEL32(?), ref: 00EE9B97
__Mtx_destroy_in_situ.LIBCPMT ref: 00EE9BAF

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: CloseHandle$Thread$CodeCurrentEventExitMtx_destroy_in_situObjectSingleWait
String ID:
API String ID: 2780651522-0
Opcode ID: b83795d154f2f5e0d87622c5999e6b7dc104b24f52a861a1d7da3a6c7a59b9ca
Instruction ID: 89b9f93787d983aec3320311cc952e75bbc618a4dee7e2ed9145dca0d68e34c1
Opcode Fuzzy Hash: b83795d154f2f5e0d87622c5999e6b7dc104b24f52a861a1d7da3a6c7a59b9ca
Instruction Fuzzy Hash: D9217F30500B889BD730FB72AC4EB9AB7E59F54724F00192DF959A21C2DF36B920CB95

Function 00F33EA7 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

___std_fs_open_handle@16.LIBCPMT ref: 00F33EC0

Part of subcall function 00F33E73: CreateFileW.KERNEL32(02200000,00010000,00000007,00000000,00000003,?,00000000,00000000,?,00F33EC5,?,?,00010000,02200000,?,00000000), ref: 00F33E88
Part of subcall function 00F33E73: GetLastError.KERNEL32(?,00F33EC5,?,?,00010000,02200000,?,00000000), ref: 00F33E98

SetFileInformationByHandle.KERNEL32(?,00000015,00000000,00000004,?,?,00010000,02200000,?,00000000), ref: 00F33EFC
GetLastError.KERNEL32 ref: 00F33F0C
SetFileInformationByHandle.KERNEL32(?,00000004,?,00000001), ref: 00F33F38
GetLastError.KERNEL32 ref: 00F33F45

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ErrorFileLast$HandleInformation$Create___std_fs_open_handle@16
String ID:
API String ID: 1118473077-0
Opcode ID: d80aa55c14b7074f038daa31231af65e4ac90a42c957812002829ec6bc7de61d
Instruction ID: b93987c7799ab9f27318ce42f01fd0fe6eead9c5bee99f2cb085d3ab1523b8ad
Opcode Fuzzy Hash: d80aa55c14b7074f038daa31231af65e4ac90a42c957812002829ec6bc7de61d
Instruction Fuzzy Hash: 70113631D08148EADB19DBB88D1CBFE7F74AB41730F450054F502A2251D7B1CB48E311

Function 00F343F0 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F343F7
std::_Lockit::_Lockit.LIBCPMT ref: 00F34401

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

std::_Facet_Register.LIBCPMT ref: 00F34452
std::_Lockit::~_Lockit.LIBCPMT ref: 00F34472
Concurrency::cancel_current_task.LIBCPMT ref: 00F3447F

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 59e9039d7a3270597fd4379e7520d18063fc6912e9a8b4782e5e6226b384423b
Instruction ID: 049a6fbda052e4d3fd03014b5e5427c22df1d8c859c28353ae4018b312872aed
Opcode Fuzzy Hash: 59e9039d7a3270597fd4379e7520d18063fc6912e9a8b4782e5e6226b384423b
Instruction Fuzzy Hash: 6301C431D002199BCB05FB64CC01AAEB7B1AF90720F244019F910A7391DF38AE06AB91

Function 00F37579 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

_Maklocstr.LIBCPMT ref: 00F37599
_Maklocstr.LIBCPMT ref: 00F375B6
_Maklocstr.LIBCPMT ref: 00F375D3
_Maklocchr.LIBCPMT ref: 00F375E5
_Maklocchr.LIBCPMT ref: 00F375F8

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Maklocstr$Maklocchr
String ID:
API String ID: 2020259771-0
Opcode ID: e1d24b4230776c974971a9eb3fa0e8b26f80f6f03532f7a3ea8f0dec227e2e8b
Instruction ID: 0aac1b9083f7f83d676bdf949409c75622ca9c2a411081ee87acfeff3137eba9
Opcode Fuzzy Hash: e1d24b4230776c974971a9eb3fa0e8b26f80f6f03532f7a3ea8f0dec227e2e8b
Instruction Fuzzy Hash: 08114FF1508744BBE720EBA58C85F12B7ACAB09720F084619F145CBA41D369FD5497A5

Function 00ED77FD Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00ED7804
std::_Lockit::_Lockit.LIBCPMT ref: 00ED7811

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

std::_Facet_Register.LIBCPMT ref: 00ED785F
std::_Lockit::~_Lockit.LIBCPMT ref: 00ED787F
Concurrency::cancel_current_task.LIBCPMT ref: 00ED788C

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3_Register
String ID:
API String ID: 3498242614-0
Opcode ID: a4a9b0a5c5d84cc8c3222243fc0725eb3744a80677403317255621a986d1301a
Instruction ID: 61cd268f068b39db160c61b9ce1825123280c66dc3d449d26a37b72b675d5992
Opcode Fuzzy Hash: a4a9b0a5c5d84cc8c3222243fc0725eb3744a80677403317255621a986d1301a
Instruction Fuzzy Hash: 260100319041198BCB08EBA4D846ABD7BA5EF84324F20000BE904B7382DF349E03EBA1

Function 00ED7892 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00ED7899
std::_Lockit::_Lockit.LIBCPMT ref: 00ED78A6

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

std::_Facet_Register.LIBCPMT ref: 00ED78F4
std::_Lockit::~_Lockit.LIBCPMT ref: 00ED7914
Concurrency::cancel_current_task.LIBCPMT ref: 00ED7921

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3_Register
String ID:
API String ID: 3498242614-0
Opcode ID: 3e9527ec99e0dda6ff29600e7e27f508f157c42d80d0bf3c7c9b64ce35e3dac4
Instruction ID: a126e2a3deb416939399ed16885bc27623fb06a2c113c87f10774abe895e333c
Opcode Fuzzy Hash: 3e9527ec99e0dda6ff29600e7e27f508f157c42d80d0bf3c7c9b64ce35e3dac4
Instruction Fuzzy Hash: 4B0122329081199FCB04EBA4C952ABE77A1EF80720F21000AF904B73C2DF349E07A791

Function 00F380D9 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F380E0
std::_Lockit::_Lockit.LIBCPMT ref: 00F380EA

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

std::_Facet_Register.LIBCPMT ref: 00F3813B
std::_Lockit::~_Lockit.LIBCPMT ref: 00F3815B
Concurrency::cancel_current_task.LIBCPMT ref: 00F38168

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 8ec63fe9bbb7594df00c9f891fa6e551488118905dfc87dd3536af00278fab85
Instruction ID: 59d00f1c81613689703107440fd06e3f1ec045209de1ac14ec660419c3b078d1
Opcode Fuzzy Hash: 8ec63fe9bbb7594df00c9f891fa6e551488118905dfc87dd3536af00278fab85
Instruction Fuzzy Hash: 1F01C031D002599FCB05FBA4CC42AAE7BB1AF90770F240409F810AB391CF789E02BB81

Function 00F38044 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F3804B
std::_Lockit::_Lockit.LIBCPMT ref: 00F38055

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

std::_Facet_Register.LIBCPMT ref: 00F380A6
std::_Lockit::~_Lockit.LIBCPMT ref: 00F380C6
Concurrency::cancel_current_task.LIBCPMT ref: 00F380D3

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: d28669b1db2503a48d8341c73d7392a0afd78f132e2b0fed7ce56c3a7325a667
Instruction ID: c0704d97c1b931be27177491a97c625c546e94fa51b4745fbc3a1e5711a4849c
Opcode Fuzzy Hash: d28669b1db2503a48d8341c73d7392a0afd78f132e2b0fed7ce56c3a7325a667
Instruction Fuzzy Hash: 1301C471D042199BCB09EB74D941AAE77B1AF84730F240109F810AB391DF789E06BB91

Function 00F3816E Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F38175
std::_Lockit::_Lockit.LIBCPMT ref: 00F3817F

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

std::_Facet_Register.LIBCPMT ref: 00F381D0
std::_Lockit::~_Lockit.LIBCPMT ref: 00F381F0
Concurrency::cancel_current_task.LIBCPMT ref: 00F381FD

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: c810663ddd6ae45aaa099f36486399c4aa4cece25952260eb9188fe81da63b25
Instruction ID: bf590bddc04446d0d774a819d79d1e1de338a609f2ad369525a8ce51e7ed3569
Opcode Fuzzy Hash: c810663ddd6ae45aaa099f36486399c4aa4cece25952260eb9188fe81da63b25
Instruction Fuzzy Hash: 7801A1319002199BCB05FB64CD42AAD77B5BF84360F244109F810A7391CF789E02AB81

Function 00F384EC Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F384F3
std::_Lockit::_Lockit.LIBCPMT ref: 00F384FD

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

std::_Facet_Register.LIBCPMT ref: 00F3854E
std::_Lockit::~_Lockit.LIBCPMT ref: 00F3856E
Concurrency::cancel_current_task.LIBCPMT ref: 00F3857B

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 5cabf9fc259f47328c56ed371bdce14b480abc8880ad765f1a54298427a7a0b6
Instruction ID: 7f54bd82dbd7e0c0e832c735aa5acc47716347f1d4f1b209d3b22f94ade62b68
Opcode Fuzzy Hash: 5cabf9fc259f47328c56ed371bdce14b480abc8880ad765f1a54298427a7a0b6
Instruction Fuzzy Hash: C501C431D002199BCB05EB64CC42AAE77B1BF84370F244509F811A7391DF789E02BB81

Function 00F38457 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F3845E
std::_Lockit::_Lockit.LIBCPMT ref: 00F38468

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

std::_Facet_Register.LIBCPMT ref: 00F384B9
std::_Lockit::~_Lockit.LIBCPMT ref: 00F384D9
Concurrency::cancel_current_task.LIBCPMT ref: 00F384E6

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 5d2fa7f663c587ec083b5bbde001653184a6f20cfd4b3da1e39b0a504abaf6bc
Instruction ID: 91fdb3db5d9a42d32e5ebbe143dc2f827fc4da66ca9d6879d6fea63ba645b1f9
Opcode Fuzzy Hash: 5d2fa7f663c587ec083b5bbde001653184a6f20cfd4b3da1e39b0a504abaf6bc
Instruction Fuzzy Hash: A301C431D0421A9BCB05FB64C842AAE77B1BF50770F240509F815A7391DF789E06FB91

Function 00F4459F Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F445A6
std::_Lockit::_Lockit.LIBCPMT ref: 00F445B0

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

std::_Facet_Register.LIBCPMT ref: 00F44601
std::_Lockit::~_Lockit.LIBCPMT ref: 00F44621
Concurrency::cancel_current_task.LIBCPMT ref: 00F4462E

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 2f58fa5854efb0620902627b0f0730130694b74ebe67581efc31559dafe70621
Instruction ID: 81cba53cb99fbe87de97c508b4af729a84143c6a4ab79c678b34a56f554801b5
Opcode Fuzzy Hash: 2f58fa5854efb0620902627b0f0730130694b74ebe67581efc31559dafe70621
Instruction Fuzzy Hash: 45016135D042199BCB05EBA4C951BADBBB5BF54720F250109EC14B7391DF74AE01EB91

Function 00F38581 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F38588
std::_Lockit::_Lockit.LIBCPMT ref: 00F38592

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

std::_Facet_Register.LIBCPMT ref: 00F385E3
std::_Lockit::~_Lockit.LIBCPMT ref: 00F38603
Concurrency::cancel_current_task.LIBCPMT ref: 00F38610

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 2fa91824b1c2c0a1e740c81d8d708462196ffae70008a19b14e347c5ae18b0a9
Instruction ID: d314ea1b125b944babb1f7fe7108188178759ed8eb1d50131a9fcc6a14973236
Opcode Fuzzy Hash: 2fa91824b1c2c0a1e740c81d8d708462196ffae70008a19b14e347c5ae18b0a9
Instruction Fuzzy Hash: 6701C071D042199BCB05EBA4C942AAE7BB1BF40730F24044AF914AB391DF789E02BB91

Function 00F386AB Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F386B2
std::_Lockit::_Lockit.LIBCPMT ref: 00F386BC

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

std::_Facet_Register.LIBCPMT ref: 00F3870D
std::_Lockit::~_Lockit.LIBCPMT ref: 00F3872D
Concurrency::cancel_current_task.LIBCPMT ref: 00F3873A

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 513eeb5107ac90c7f561df991ad1c31d772088e5fa9b55a367d4fafab909b408
Instruction ID: 4dfb5bbc6106b70390e06e986800a413590fe31c3e75f37524850b599a6fdfd6
Opcode Fuzzy Hash: 513eeb5107ac90c7f561df991ad1c31d772088e5fa9b55a367d4fafab909b408
Instruction Fuzzy Hash: 1D01C031D042199BCB05FBA4C942AAEB7B6FF54360F240149F910AB391DF789E02BB91

Function 00F44634 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F4463B
std::_Lockit::_Lockit.LIBCPMT ref: 00F44645

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

std::_Facet_Register.LIBCPMT ref: 00F44696
std::_Lockit::~_Lockit.LIBCPMT ref: 00F446B6
Concurrency::cancel_current_task.LIBCPMT ref: 00F446C3

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 7031af92a89129a937a70e2e9b8873e16cac01c4b713f6d89f459d4e537d96c3
Instruction ID: cee536e28a7a55b770a88c6b5475a706a216e2107ae6c4e6c7148a9890413481
Opcode Fuzzy Hash: 7031af92a89129a937a70e2e9b8873e16cac01c4b713f6d89f459d4e537d96c3
Instruction Fuzzy Hash: 6D01C431D001599BCB05EB64CD42BADBBB5BF84320F25410AEC1077391CF74AE01BB81

Function 00F447F3 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F447FA
std::_Lockit::_Lockit.LIBCPMT ref: 00F44804

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

std::_Facet_Register.LIBCPMT ref: 00F44855
std::_Lockit::~_Lockit.LIBCPMT ref: 00F44875
Concurrency::cancel_current_task.LIBCPMT ref: 00F44882

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 85bac5c9891af98f8821f486c9f25885085aa56f3f8d9f679597928a356db899
Instruction ID: 0727a8db60fa2e9a89e330d141a91f78f3b617b64bc336e0a77270568c9fab00
Opcode Fuzzy Hash: 85bac5c9891af98f8821f486c9f25885085aa56f3f8d9f679597928a356db899
Instruction Fuzzy Hash: B101A131D002599BCB05EBA4CC51AADBBB5FF90720F244009ED1077391CF74AE01AB81

Function 00F387D5 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F387DC
std::_Lockit::_Lockit.LIBCPMT ref: 00F387E6

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

std::_Facet_Register.LIBCPMT ref: 00F38837
std::_Lockit::~_Lockit.LIBCPMT ref: 00F38857
Concurrency::cancel_current_task.LIBCPMT ref: 00F38864

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 241ab7fd18a331b4e5d2477d1d0386d4eea271e999f868fd9073a56187d04b17
Instruction ID: 09c4cba2d6cb962f37580f7ce82018dc22e569f4001d57df28d80db75f47c2d9
Opcode Fuzzy Hash: 241ab7fd18a331b4e5d2477d1d0386d4eea271e999f868fd9073a56187d04b17
Instruction Fuzzy Hash: 1C01A171D043199BCB05EBA4C841AAD77B1BF44720F244409F91067391DF789A06EB91

Function 00F44888 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F4488F
std::_Lockit::_Lockit.LIBCPMT ref: 00F44899

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

std::_Facet_Register.LIBCPMT ref: 00F448EA
std::_Lockit::~_Lockit.LIBCPMT ref: 00F4490A
Concurrency::cancel_current_task.LIBCPMT ref: 00F44917

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: d2f7aec49ff211e2bbea00b1fc5e965558a021840a035e6883dd8a09679c7461
Instruction ID: e60c083c79dd3112ad0daedfe424ba7cc984978ac55751f33f72bad11b948c49
Opcode Fuzzy Hash: d2f7aec49ff211e2bbea00b1fc5e965558a021840a035e6883dd8a09679c7461
Instruction Fuzzy Hash: 4C01C431D0025A9BCB05EBA4CC41ABE7BB1EF94320F244149E810B7391DF74AE05FB81

Function 00F37FAF Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F37FB6
std::_Lockit::_Lockit.LIBCPMT ref: 00F37FC0

Part of subcall function 00ED2D14: std::_Lockit::_Lockit.LIBCPMT ref: 00ED2D30
Part of subcall function 00ED2D14: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED2D4C

std::_Facet_Register.LIBCPMT ref: 00F38011
std::_Lockit::~_Lockit.LIBCPMT ref: 00F38031
Concurrency::cancel_current_task.LIBCPMT ref: 00F3803E

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Register
String ID:
API String ID: 55977855-0
Opcode ID: 9498feaa281bef793f267c2c32a93fc31e6c68ea8cd92e151c1d5e4b4da9c519
Instruction ID: a749c9743d11caa7446ba7241db40f339f10d92935b0a9d234e4bc071050d25b
Opcode Fuzzy Hash: 9498feaa281bef793f267c2c32a93fc31e6c68ea8cd92e151c1d5e4b4da9c519
Instruction Fuzzy Hash: 2B01C475D042199FCB05FBA4C902AAD7BB1BF44770F240109F8206B392DFB89E06BB81

Function 00F6B487 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F6B49F

Part of subcall function 00F62098: RtlFreeHeap.NTDLL(00000000,00000000,?,00F6B729,?,00000000,?,?,?,00F6B9CC,?,00000007,?,?,00F6BDD6,?), ref: 00F620AE
Part of subcall function 00F62098: GetLastError.KERNEL32(?,?,00F6B729,?,00000000,?,?,?,00F6B9CC,?,00000007,?,?,00F6BDD6,?,?), ref: 00F620C0

_free.LIBCMT ref: 00F6B4B1
_free.LIBCMT ref: 00F6B4C3
_free.LIBCMT ref: 00F6B4D5
_free.LIBCMT ref: 00F6B4E7

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 98c1eeb38efe9fa38f1ca374bcc0e9dac141939d1da37327484db9a9a99ebfbb
Instruction ID: bfb84fd2103b9d93047900a7627b24c33dff6fbc15cdd2a57e2900565a9d30bd
Opcode Fuzzy Hash: 98c1eeb38efe9fa38f1ca374bcc0e9dac141939d1da37327484db9a9a99ebfbb
Instruction Fuzzy Hash: FDF0F432944A08BB8670EF78EDC6C1A73EDEA007607B45959F149D7602CF28FCC5AA60

Function 00F488B0 Relevance: 7.5, APIs: 5, Instructions: 37COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00FC742C,?,?,00EE4086,00FC827C,00F868E0,?), ref: 00F488BA
LeaveCriticalSection.KERNEL32(00FC742C,?,?,00EE4086,00FC827C,00F868E0,?), ref: 00F488ED
RtlWakeAllConditionVariable.NTDLL ref: 00F48964
SetEvent.KERNEL32(?,00EE4086,00FC827C,00F868E0,?), ref: 00F4896E
ResetEvent.KERNEL32(?,00EE4086,00FC827C,00F868E0,?), ref: 00F4897A

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: CriticalEventSection$ConditionEnterLeaveResetVariableWake
String ID:
API String ID: 3916383385-0
Opcode ID: 64265e27b1e31b9abd3d185e85b57980677c64f573a5f5529cb4ae5bff27fe33
Instruction ID: 568b4f289894eff46e9c2e58cc089141f14bbba57b8f3cbe0f896573ae906f05
Opcode Fuzzy Hash: 64265e27b1e31b9abd3d185e85b57980677c64f573a5f5529cb4ae5bff27fe33
Instruction Fuzzy Hash: 06012472A08628DBC708EF28FD49DA87FA9EB09B11700416AEC0193321CA315801FF91

Function 00F20720 Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 19COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00F20726
GetLastError.KERNEL32 ref: 00F20730

Strings

c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\CabParser.h, xrefs: 00F20743
CloseHandle failed: %d, xrefs: 00F20737
NWebAdvisor::CCabParser::Close, xrefs: 00F2073E

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID: CloseHandle failed: %d$NWebAdvisor::CCabParser::Close$c:\jenkins\workspace\mer_WebAdvisor_XMLUpdater_master\src\XmlUpdater\CabParser.h
API String ID: 918212764-1823807987
Opcode ID: b05eafe5123ae0b60804aa7db5532edf5eae71596f4541c9303034d6ac8dfbdf
Instruction ID: 1a14c11b6903d565e2a1d566ef663e1859de984e90c681d3ea33074d701ce0df
Opcode Fuzzy Hash: b05eafe5123ae0b60804aa7db5532edf5eae71596f4541c9303034d6ac8dfbdf
Instruction Fuzzy Hash: 08D05B317447246EFF202B6CFC0FFA639549B05B24F420A1DBA51910E1E5E2E8517757

Function 00F122F0 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 446COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 00F12319
FreeLibrary.KERNEL32(00000000), ref: 00F12369

Strings

XML hound handler failed., xrefs: 00F126FD
_=nil}, xrefs: 00F125ED

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: FreeLibrary
String ID: XML hound handler failed.$_=nil}
API String ID: 3664257935-979112626
Opcode ID: 70fb485941530a07687b1e078050c36724a317a8f7f53d963b83d5d54a690afe
Instruction ID: 388a6256806519bcf67a3200933612dde77999c38786231a73edb20b65f548e5
Opcode Fuzzy Hash: 70fb485941530a07687b1e078050c36724a317a8f7f53d963b83d5d54a690afe
Instruction Fuzzy Hash: 95F1D471900209AFDB24DFA8DC85BEEBBF5FF04314F048559E409A7292DB74EA94DB90

Function 00F53207 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 375COMMON

Download Yara Rule

APIs

__freea.LIBCMT ref: 00F5338D
__freea.LIBCMT ref: 00F533A9

Strings

a/p, xrefs: 00F53471
am/pm, xrefs: 00F5340D

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: __freea
String ID: a/p$am/pm
API String ID: 240046367-3206640213
Opcode ID: ce1ca44df7df8ebc39af4692646dc8d776403bb711d06871798efebb0b70c5b6
Instruction ID: b8613524e7ff2a09c95f34db6ecad7a77be6cce85477eae705a64806962ea428
Opcode Fuzzy Hash: ce1ca44df7df8ebc39af4692646dc8d776403bb711d06871798efebb0b70c5b6
Instruction Fuzzy Hash: 72C1E435D00216DACB148F6CC885BBABBB1FF057A2F294149EE01AB350E7359F49EB51

Function 00EE9C2D Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 317COMMON

Download Yara Rule

Strings

`aco, xrefs: 00EE9DA1, 00EE9DBC, 00EE9DD7, 00EE9FB1, 00EE9FC6, 00EE9FDB
1, xrefs: 00EEA0A2
Async event sender already initialized, xrefs: 00EEA0AE

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID:
String ID: 1$Async event sender already initialized$`aco
API String ID: 0-1279716160
Opcode ID: 13dedd93b85621a99c94998d1ffb0cfc1fcef7524c0859066032713a7426f018
Instruction ID: a05078cdc98b7743ccebe5575f8889df3b5f84fb8e9f2433acd579138cbace6a
Opcode Fuzzy Hash: 13dedd93b85621a99c94998d1ffb0cfc1fcef7524c0859066032713a7426f018
Instruction Fuzzy Hash: 5DC1CBB0210A848FDB18CF34CC98BABB7E5EF40315F544A1CE55AD76A1EB39B985CB14

Function 00EEB6E0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 219COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEB886

Part of subcall function 00ED9BB0: InitOnceBeginInitialize.KERNEL32(00FC80C4,00000000,87CF6CF3,00000000,87CF6CF3,00EDA219,00FC80CC,?,?,?,?,?,?,00EDA219,?,?), ref: 00ED9BE5
Part of subcall function 00ED9BB0: InitOnceComplete.KERNEL32(00FC80C4,00000000,00000000), ref: 00ED9C1D

Part of subcall function 00ED9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00ED9A12

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEB93D

Strings

Failed to convert wide to byte, xrefs: 00EEB90D
Failed to convert byte to wide, xrefs: 00EEB856

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$InitOnce$BeginCompleteInitialize
String ID: Failed to convert byte to wide$Failed to convert wide to byte
API String ID: 1656330964-1708777540
Opcode ID: 555a663b43cc60a1ef9afe9dd88efa0d8276303a8747967dd0672db7fc5d6aab
Instruction ID: 6ccbb6e4e0e7304121107db882d447f169ab96f2a2a13f423481214e5b55a40c
Opcode Fuzzy Hash: 555a663b43cc60a1ef9afe9dd88efa0d8276303a8747967dd0672db7fc5d6aab
Instruction Fuzzy Hash: E781FF70D0024C9BDF18DFA4C995BEEBBB5EF41304F108199E9057B382D7359A4ACB61

Function 00F751F0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

\\?\, xrefs: 00F753C0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID:
String ID: \\?\
API String ID: 0-4282027825
Opcode ID: aecb17570c293a7648c207cfd87349e50ffea881d7b9bb30b254ace18a11f3f9
Instruction ID: 79a625e62cfff124972c17d1ffaf6f71c19b7949487a4f669191ce415de76cf0
Opcode Fuzzy Hash: aecb17570c293a7648c207cfd87349e50ffea881d7b9bb30b254ace18a11f3f9
Instruction Fuzzy Hash: 0C717D71D006189BCF14DFA8CC84AAEB7FAFF45710F14462AE419F7290E770A941DBA2

Function 00EDB420 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EDB64C

Strings

ios_base::eofbit set, xrefs: 00EDB5DE
ios_base::failbit set, xrefs: 00EDB5D9
ios_base::badbit set, xrefs: 00EDB5CF, 00EDB5F8, 00EDB621

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 323602529-1866435925
Opcode ID: ee8c1cd9e1e0f3021ea1b66640289da0df1d03ffb4a9e1e167cd87ea83f90fd9
Instruction ID: 704600ca1b3e56e149fea9fa96d781cae3b118a41726da3efdd95e615ab0dc7a
Opcode Fuzzy Hash: ee8c1cd9e1e0f3021ea1b66640289da0df1d03ffb4a9e1e167cd87ea83f90fd9
Instruction Fuzzy Hash: 5E71ABB1A00209DFDB14CF58C984B99FBF5FF48318F15816AE9149B381E775E906CB80

Function 00F74620 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

WritePrivateProfileStructW.KERNEL32(?,00000000,4752434D,00000024,00000000), ref: 00F746E4
GetLastError.KERNEL32 ref: 00F74728
WritePrivateProfileStructW.KERNEL32(?,00000000,?,00000004,00000000), ref: 00F74768

Strings

MCRG, xrefs: 00F7466F

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: PrivateProfileStructWrite$ErrorLast
String ID: MCRG
API String ID: 3778923442-1523812224
Opcode ID: 43d02c5749319f46cfa1be9217f8ec1787b9f68d38f4b66b8995777a68073f9e
Instruction ID: 2b57a25bb09c0475ec8e3000689e26bd10b5431f2a18429e46f620c8ea2a16cf
Opcode Fuzzy Hash: 43d02c5749319f46cfa1be9217f8ec1787b9f68d38f4b66b8995777a68073f9e
Instruction Fuzzy Hash: F051BF75900608AFDB14CFA8D845B9EFBF9EF05320F14825AF815AB2A1DB70A905DF91

Function 00EE0490 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00F33D98: FormatMessageA.KERNEL32(00001300,00000000,?,00000000,?,00000000,00000000,?,?,00EE04D5,?,?,87CF6CF3), ref: 00F33DAE

LocalFree.KERNEL32(00000000), ref: 00EE05CC
Concurrency::cancel_current_task.LIBCPMT ref: 00EE05F6

Strings

unknown error, xrefs: 00EE04FE
generic, xrefs: 00EE0610

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Concurrency::cancel_current_taskFormatFreeLocalMessage
String ID: generic$unknown error
API String ID: 3868770561-3628847473
Opcode ID: 8f7a052171db704eb030fb0f37761fb2022d4d0e518cc7c73e5cf4de7cd78f5e
Instruction ID: 2a0e3858b063a9b72c711a2e1dfcbf8f390311af252bbd9cc2fbaaec93d41663
Opcode Fuzzy Hash: 8f7a052171db704eb030fb0f37761fb2022d4d0e518cc7c73e5cf4de7cd78f5e
Instruction Fuzzy Hash: 0441D3B19003499FDB309F69C845BAFBBF8EF44314F10062EF856A7381D7B895489BA1

Function 00F5EA12 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe, xrefs: 00F5EA50, 00F5EA57, 00F5EA8B

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\is-H908U.tmp\prod1_extract\saBSI.exe
API String ID: 0-4232830181
Opcode ID: 1f29b5a1810b4a53dcfd8656164e4265e7f8357ab0418fa18677a125f9369a1f
Instruction ID: 2a51f2dc8d08d27529c2e700b65067f3e958c787aa822b76812673c4dd8cead2
Opcode Fuzzy Hash: 1f29b5a1810b4a53dcfd8656164e4265e7f8357ab0418fa18677a125f9369a1f
Instruction Fuzzy Hash: 2131B171E40618BFCB29DFA9DD86D9EBBB8EBD4311B100066EA01D7211E7748B08EB50

Function 00ED4A4A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 109COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00ED4A51

Strings

affid, xrefs: 00ED4AEE, 00ED4B44
MSAD_Subinfo, xrefs: 00ED4AF3
/affid, xrefs: 00ED4A7B

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: H_prolog3_
String ID: /affid$MSAD_Subinfo$affid
API String ID: 2427045233-3897642808
Opcode ID: 4401c9af42446dc26c75f11843688b68a79fea6d6cf402fe57d961e6816d43f4
Instruction ID: f25cac1e456f5e5e0489b035d45c68ab5150064405bf0db558d29812aaf5c403
Opcode Fuzzy Hash: 4401c9af42446dc26c75f11843688b68a79fea6d6cf402fe57d961e6816d43f4
Instruction Fuzzy Hash: 2A416AB4D04208DFCB08DFA4D895AEDBBB4EF29314F14506EE805B7381D7309A4ADB65

Function 00F42F50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F42F57

Part of subcall function 00F37DF0: __EH_prolog3.LIBCMT ref: 00F37DF7
Part of subcall function 00F37DF0: std::_Lockit::_Lockit.LIBCPMT ref: 00F37E01
Part of subcall function 00F37DF0: std::_Lockit::~_Lockit.LIBCPMT ref: 00F37E72

_Find_elem.LIBCPMT ref: 00F42FF3

Strings

%.0Lf, xrefs: 00F42F9E
0123456789-, xrefs: 00F42FA3

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: %.0Lf$0123456789-
API String ID: 2544715827-3094241602
Opcode ID: d6159a294d93089070e9b6ec5406468840bea007acdda0d2f98ca95abc4bfb61
Instruction ID: 10362766d7a5de1d41fe99c668b26011ad2c1ef6c2f7570f8ec75c2e503fc4b9
Opcode Fuzzy Hash: d6159a294d93089070e9b6ec5406468840bea007acdda0d2f98ca95abc4bfb61
Instruction Fuzzy Hash: 20415931900218DFCF15DFA8C880AEDBFB5BF14324F500169F911AB255DB34DA5AEBA1

Function 00F43200 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F43207

Part of subcall function 00ED32DE: __EH_prolog3_GS.LIBCMT ref: 00ED32E5
Part of subcall function 00ED32DE: std::_Lockit::_Lockit.LIBCPMT ref: 00ED32F2
Part of subcall function 00ED32DE: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED3360

_Find_elem.LIBCPMT ref: 00F432A3

Strings

0123456789-, xrefs: 00F43253
0123456789-, xrefs: 00F4324E

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: H_prolog3_Lockitstd::_$Find_elemLockit::_Lockit::~_
String ID: 0123456789-$0123456789-
API String ID: 3328206922-2494171821
Opcode ID: 9df8f44a00fa4eea4ab4bf4b58fa623ad4478a7abef39c58646885760df97a8d
Instruction ID: f25da1967cf4c4e4d7db2f306e8fbbc86cbe4ec4b69dbadd7f998e685fbbea02
Opcode Fuzzy Hash: 9df8f44a00fa4eea4ab4bf4b58fa623ad4478a7abef39c58646885760df97a8d
Instruction Fuzzy Hash: 04416C31900218DFCF05DFE4C8849EDBBB5FF08310F10016AE911AB265DB709A5ADBA2

Function 00F47470 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F47477

Part of subcall function 00EFC960: std::_Lockit::_Lockit.LIBCPMT ref: 00EFC995
Part of subcall function 00EFC960: std::_Lockit::_Lockit.LIBCPMT ref: 00EFC9B7
Part of subcall function 00EFC960: std::_Lockit::~_Lockit.LIBCPMT ref: 00EFC9D7
Part of subcall function 00EFC960: std::_Lockit::~_Lockit.LIBCPMT ref: 00EFCAB1

_Find_elem.LIBCPMT ref: 00F47511

Strings

0123456789-, xrefs: 00F474BE
0123456789-, xrefs: 00F474C3

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Find_elemH_prolog3_
String ID: 0123456789-$0123456789-
API String ID: 3042121994-2494171821
Opcode ID: 09c3208257c6d8f5a43c6eb1074910e934b375bfeaddc654a6b820015fa57833
Instruction ID: a050118ecbb20bdc3950099c6c419b27af9859c3dbe78b0211e6fa23302444a0
Opcode Fuzzy Hash: 09c3208257c6d8f5a43c6eb1074910e934b375bfeaddc654a6b820015fa57833
Instruction Fuzzy Hash: 89415B31900209DFCF15EFA8D881AAEBFB5FF14310F50405AF911AB262DB759A16EB51

Function 00EFD700 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(00F9D7E8,00000000,00000000,?,87CF6CF3), ref: 00EFD75C
CoTaskMemFree.OLE32(00000000), ref: 00EFD7D4

Strings

%s\%s, xrefs: 00EFD77B

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: FolderFreeKnownPathTask
String ID: %s\%s
API String ID: 969438705-4073750446
Opcode ID: 63660ca81a40971b87423883e56860b219c1c37cee0312738cdbd499d62f02dd
Instruction ID: bc5d166308653e887a5e4abcfcf472f5888d94208fe0586a9080f67d4738d5f8
Opcode Fuzzy Hash: 63660ca81a40971b87423883e56860b219c1c37cee0312738cdbd499d62f02dd
Instruction Fuzzy Hash: 9D2182B1A0420DABDB04DFA4DC85FEEBBF9FB48714F50452AE901B7280DB74A904CB60

Function 00EE7156 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 00EF4B40: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EF521E

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EE7D3D
__Mtx_unlock.LIBCPMT ref: 00EE7DC8

Part of subcall function 00ED9BB0: InitOnceBeginInitialize.KERNEL32(00FC80C4,00000000,87CF6CF3,00000000,87CF6CF3,00EDA219,00FC80CC,?,?,?,?,?,?,00EDA219,?,?), ref: 00ED9BE5
Part of subcall function 00ED9BB0: InitOnceComplete.KERNEL32(00FC80C4,00000000,00000000), ref: 00ED9C1D

Part of subcall function 00ED9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00ED9A12

Strings

Failed to add event category (, xrefs: 00EE71F0
V, xrefs: 00EE71E4

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$InitOnce$BeginCompleteInitializeMtx_unlock
String ID: Failed to add event category ($V
API String ID: 2287862619-1647955383
Opcode ID: 033d2cc5dcfed5f6e0ffc936dd68953535b357947609d75b343aae5fb014a6ae
Instruction ID: 99bc88f7c2f5e048be53a174402fd559904cb46ec4fe2b3d8442694603899ab9
Opcode Fuzzy Hash: 033d2cc5dcfed5f6e0ffc936dd68953535b357947609d75b343aae5fb014a6ae
Instruction Fuzzy Hash: C9319370914288DFDF04EF60D855BED7BB4EF55304F504099EC462B342EB79AA09DBA2

Function 00EEA7DC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,87CF6CF3,?,?), ref: 00EEA531
__Mtx_unlock.LIBCPMT ref: 00EEA7EC
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEA989

Part of subcall function 00EEF110: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EEF268

Strings

Unexpected return value: , xrefs: 00EEA8CC

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$Mtx_unlockMultipleObjectsWait
String ID: Unexpected return value:
API String ID: 1703231451-3613193034
Opcode ID: 9a4e4e76f54368217d134668caf01ce8eedf85e30ae06736a133efd758d06823
Instruction ID: 11cd5622ec63b3367c9b279868826ee438f5a4057fad48b44eedfacb0ea6a8d9
Opcode Fuzzy Hash: 9a4e4e76f54368217d134668caf01ce8eedf85e30ae06736a133efd758d06823
Instruction Fuzzy Hash: 2521F37090118CABDF18DBA4CC49BECB775EF85314F14526DE0147B3C2DB34AA89CA12

Function 00F45C3A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F45C41
_Mpunct.LIBCPMT ref: 00F45CCE
_Mpunct.LIBCPMT ref: 00F45CE8

Strings

$+xv, xrefs: 00F45CF3

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Mpunct$H_prolog3
String ID: $+xv
API String ID: 4281374311-1686923651
Opcode ID: ff26ca7b506794f2acb8ad6a5be163715e5ef6692c5b2edc0d381b3b28aa0aee
Instruction ID: 3106cc6676128f89371ebbb67dc658e1ae0ed74a3a1f7816278925830fcbb2d9
Opcode Fuzzy Hash: ff26ca7b506794f2acb8ad6a5be163715e5ef6692c5b2edc0d381b3b28aa0aee
Instruction Fuzzy Hash: 6B2190B1904B526FD721EF74C890B3BBEF8AB0C710F04495AE959C7A42E774EA05DB90

Function 00F3DD07 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F3DD0E

Part of subcall function 00F37579: _Maklocstr.LIBCPMT ref: 00F37599
Part of subcall function 00F37579: _Maklocstr.LIBCPMT ref: 00F375B6
Part of subcall function 00F37579: _Maklocstr.LIBCPMT ref: 00F375D3
Part of subcall function 00F37579: _Maklocchr.LIBCPMT ref: 00F375E5
Part of subcall function 00F37579: _Maklocchr.LIBCPMT ref: 00F375F8

_Mpunct.LIBCPMT ref: 00F3DD9B
_Mpunct.LIBCPMT ref: 00F3DDB5

Strings

$+xv, xrefs: 00F3DDC0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Maklocstr$MaklocchrMpunct$H_prolog3
String ID: $+xv
API String ID: 2939335142-1686923651
Opcode ID: 4b961b705d7cf13b1f4ad3c3290c13745c4bbededf82136f67587a5badcbf6b6
Instruction ID: 826db80ea07cf184bf4f2e090e97495a79751365b8e7e7c5814d92fc175097e5
Opcode Fuzzy Hash: 4b961b705d7cf13b1f4ad3c3290c13745c4bbededf82136f67587a5badcbf6b6
Instruction Fuzzy Hash: 242190B1904B526FD726DF74C89073BBEF8AB09320F044A5AE459C7A41D734EA05DB90

Function 00EE7052 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 00ED9BB0: InitOnceBeginInitialize.KERNEL32(00FC80C4,00000000,87CF6CF3,00000000,87CF6CF3,00EDA219,00FC80CC,?,?,?,?,?,?,00EDA219,?,?), ref: 00ED9BE5
Part of subcall function 00ED9BB0: InitOnceComplete.KERNEL32(00FC80C4,00000000,00000000), ref: 00ED9C1D

Part of subcall function 00ED9940: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00ED9A12

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00EE7D3D
__Mtx_unlock.LIBCPMT ref: 00EE7DC8

Strings

P, xrefs: 00EE7077
Service has not been initialized, xrefs: 00EE7083

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: InitIos_base_dtorOncestd::ios_base::_$BeginCompleteInitializeMtx_unlock
String ID: P$Service has not been initialized
API String ID: 920826028-2917841385
Opcode ID: 1089df9930e92cc1a3afe2643733fdee12101117da0a13622e626108ce897001
Instruction ID: 51ba9e0de55f61255593ae5b317a4307b9782d1022d34901899ffae6ece0162d
Opcode Fuzzy Hash: 1089df9930e92cc1a3afe2643733fdee12101117da0a13622e626108ce897001
Instruction Fuzzy Hash: CB018471904288DEDF04EF90D812BEDB7B4EF55310F50506AE84227342EB39A60DDA55

Function 00ED308E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00ED3095
std::_Lockit::_Lockit.LIBCPMT ref: 00ED30A2
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00ED30DF

Strings

bad locale name, xrefs: 00ED30F0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: std::_$H_prolog3Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 4089677319-1405518554
Opcode ID: a9d15a08ced0f70a83a6144711ea3edb815d24238accc7bef36ebba4f8a05de3
Instruction ID: 94977866410f16bfa4881aaea556fca7314053b484b8e5dd59ed70057352a9bf
Opcode Fuzzy Hash: a9d15a08ced0f70a83a6144711ea3edb815d24238accc7bef36ebba4f8a05de3
Instruction Fuzzy Hash: D90162B0805B80DEC731DF79848114BFFE0BF28350B50892FE08E87A41CB34A645DB6A

Function 00EFD6D0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00ED4E6C,87CF6CF3), ref: 00EFD6D5
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00EFD6E5

Strings

SetDefaultDllDirectories, xrefs: 00EFD6DF
kernel32.dll, xrefs: 00EFD6D0

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetDefaultDllDirectories$kernel32.dll
API String ID: 1646373207-2102062458
Opcode ID: d648b9ba30d09b0783f361b3edbba109ee7cc7096dfaeaebde662e1931dc4771
Instruction ID: 25846523dc9c503c9a6dde7fffa74e60e52c66f053a2e454b9ead699adbfb793
Opcode Fuzzy Hash: d648b9ba30d09b0783f361b3edbba109ee7cc7096dfaeaebde662e1931dc4771
Instruction Fuzzy Hash: B3D0123038870E16EE002BB21D0DB6E2B457E82BC2F185C50E105E70D0DDE4C400EB62

Function 00F624F8 Relevance: 6.3, APIs: 4, Instructions: 320COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00F6257F

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 2052368595d85d8921707e714fa8cf7e39a0871388d90fe44b2f9a70ca8f8144
Instruction ID: 6a4ecba943a5c5bba35e78eb743d4dbbf70094aecc2a939e3c9ae289127d6bd0
Opcode Fuzzy Hash: 2052368595d85d8921707e714fa8cf7e39a0871388d90fe44b2f9a70ca8f8144
Instruction Fuzzy Hash: 0CB17A32D04A869FDB11CF28C891BEEBBF5EF55350F24816AE845DB341D6398E01EB61

Function 00F38F69 Relevance: 6.3, APIs: 4, Instructions: 282COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F38F70
_strcspn.LIBCMT ref: 00F38FD8
_strcspn.LIBCMT ref: 00F38FF8
ctype.LIBCPMT ref: 00F39056

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: _strcspn$H_prolog3_ctype
String ID:
API String ID: 838279627-0
Opcode ID: f4ecb78f377a70d98191ad555484290707accc2c802f798b3fd436a8b963ff96
Instruction ID: cda5e3c0cb3395fc1e7be2f943f5e5b06df2a51d8360405c31ca99893546e455
Opcode Fuzzy Hash: f4ecb78f377a70d98191ad555484290707accc2c802f798b3fd436a8b963ff96
Instruction Fuzzy Hash: 7AB14871D0024ADFDF14DFA4C884AEEBBB5FF08320F144019E905BB255D7B49A56EBA1

Function 00F72AF0 Relevance: 6.2, APIs: 4, Instructions: 173COMMON

Download Yara Rule

APIs

Part of subcall function 00ED463F: GetProcessHeap.KERNEL32(?,?,?,00EDE97C,87CF6CF3,?,?,?,?,00F79590,000000FF), ref: 00ED4676

WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,?,?,?,?,00F7FB28,000000FF), ref: 00F72BF4

Part of subcall function 00EF75F0: FindResourceExW.KERNEL32(00000000,00000006,00000000,?,00000000,?,?,?,?,?,00F72B5D,?,00000000), ref: 00EF7628
Part of subcall function 00EF75F0: LoadResource.KERNEL32(00000000,00000000,?,?,?,?,?,00F72B5D,?,00000000,?,?,?,?,?,00F7FB28), ref: 00EF7636
Part of subcall function 00EF75F0: LockResource.KERNEL32(00000000,?,?,?,?,?,00F72B5D,?,00000000,?,?,?,?,?,00F7FB28,000000FF), ref: 00EF7641
Part of subcall function 00EF75F0: SizeofResource.KERNEL32(00000000,00000000,?,?,?,?,?,00F72B5D,?,00000000,?,?,?,?,?,00F7FB28), ref: 00EF764F

FindResourceW.KERNEL32(00000000,?,00000006), ref: 00F72B74

Part of subcall function 00EF7580: LoadResource.KERNEL32(?,?,?,80070057,8007000E,80004005,00000000,?,?,?,?), ref: 00EF7589
Part of subcall function 00EF7580: LockResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00EF497E,?,00000000,00000000), ref: 00EF7594
Part of subcall function 00EF7580: SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00EF497E,?,00000000), ref: 00EF75A8

WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,?,00000000,00000000,00000000,00000000,?,?,00000006), ref: 00F72BAB
WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?,00000000,00000000,00000000,?,?,?,?,?,00F7FB28,000000FF), ref: 00F72C2E

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Resource$ByteCharMultiWide$FindLoadLockSizeof$HeapProcess
String ID:
API String ID: 2838002939-0
Opcode ID: 69676a08e1e8f399a03151a8c07eed3ba642b2633ea89d0ab0730c5bbb438435
Instruction ID: 0b2109ee72506100e8b8c572bdb7ea04d717238514ec4f6d84eccd19863ddbf5
Opcode Fuzzy Hash: 69676a08e1e8f399a03151a8c07eed3ba642b2633ea89d0ab0730c5bbb438435
Instruction Fuzzy Hash: 1C51A131600645AFE7258F18CC89F2EB7E8EB94720F24855EF5499F3D1DBB4A800DB52

Function 00F4C0E1 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00F4C1A8
___AdjustPointer.LIBCMT ref: 00F4C1CB
___AdjustPointer.LIBCMT ref: 00F4C267

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 339046c74da5f0d2a745ce592e61480eca0bc8400d4f1a214832b7a7113d5743
Instruction ID: 8d63c41c2bc50c96bf69fc91f9a45f33300ef504d769e60894a23aee7d57951c
Opcode Fuzzy Hash: 339046c74da5f0d2a745ce592e61480eca0bc8400d4f1a214832b7a7113d5743
Instruction Fuzzy Hash: 47510472A02206AFDB689F94C841B7A7FA4FF44724F14412DEC0597192E7B5ED80EBD0

Function 00F7174E Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00F7181E
_free.LIBCMT ref: 00F71847
SetEndOfFile.KERNEL32(00000000,00F700BA,00000000,00F67369,?,?,?,?,?,?,?,00F700BA,00F67369,00000000), ref: 00F71879
GetLastError.KERNEL32(?,?,?,?,?,?,?,00F700BA,00F67369,00000000,?,?,?,?,00000000), ref: 00F71895

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 3b365cd43cf0cadbb0133a66fbbab11962b167cf4faa897d7bef6bc669f000c4
Instruction ID: 6bfa409ee81ac33815ca14d22b1a9a4b30625ba0500b82c6ee35e0e81ab0f110
Opcode Fuzzy Hash: 3b365cd43cf0cadbb0133a66fbbab11962b167cf4faa897d7bef6bc669f000c4
Instruction Fuzzy Hash: C241B872D006059BDB156FBCCC46B9E37A5BF44370F288516F828E7291E638C849B763

Function 00F63531 Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6090fa9549264770f2a9c8c4cd29dbf805b55d5fedc2e9baba5418a45f11ae7a
Instruction ID: 070453ae340dd7360e37d08c2b13f84d3a8896777bef29da9b1879f692edad32
Opcode Fuzzy Hash: 6090fa9549264770f2a9c8c4cd29dbf805b55d5fedc2e9baba5418a45f11ae7a
Instruction Fuzzy Hash: 094109B2A00344BFD724AF38CC41B5ABBA9EF84720F14852EF016DB381D775AE41A780

Function 00EFEBA0 Relevance: 6.1, APIs: 4, Instructions: 90registryCOMMON

Download Yara Rule

APIs

RegSetKeySecurity.ADVAPI32(00000000,00000000,00000000,00000000), ref: 00EFEBCB
RegEnumKeyExW.ADVAPI32(00000000,00000000,?,00000100,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00EFEC28
RegOpenKeyExW.ADVAPI32(00000000,?,00000000,000F003F,?,?,00000000,00000000), ref: 00EFEC4F

Part of subcall function 00EFEBA0: RegCloseKey.ADVAPI32(?,?,00000000,00000000), ref: 00EFEC7E

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: CloseEnumOpenSecurity
String ID:
API String ID: 611561417-0
Opcode ID: bc1fa29d400fb5e7d787b4acd9c4b0e6a21486f2957f4b25cfe74fcbe3c5b354
Instruction ID: b669de886a5632289ba12a3c6761653f995c647e5c2f49a9b4b8ccd9cdc2a6fa
Opcode Fuzzy Hash: bc1fa29d400fb5e7d787b4acd9c4b0e6a21486f2957f4b25cfe74fcbe3c5b354
Instruction Fuzzy Hash: 3B315272A4021CABDB209F54DD49FFAB7B9EB08700F1005A5FA15B62A1DB74AE50DB90

Function 00F5E0E7 Relevance: 6.1, APIs: 4, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9356a10dc4e807fb2d952ddbeaddc2fd11202f9ccf49b301db38bbc4a9d00f5
Instruction ID: 7e72edae276320f60dad5bada44f0b7c6b823f729dcb5a6b8478b21a1d53bcab
Opcode Fuzzy Hash: a9356a10dc4e807fb2d952ddbeaddc2fd11202f9ccf49b301db38bbc4a9d00f5
Instruction Fuzzy Hash: 7221CF72A04A09AFEB14AF61CC8197B7BADEF143B67104516FE25D7190D734EE04B7A0

Function 00EF75F0 Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 00F4987E: EnterCriticalSection.KERNEL32(00FC77A0,?,00000001,?,00EF86A7,00000000,?,00000001,?,00000000,?,?,00EFC338,-00000010), ref: 00F49889
Part of subcall function 00F4987E: LeaveCriticalSection.KERNEL32(00FC77A0,?,00EF86A7,00000000,?,00000001,?,00000000,?,?,00EFC338,-00000010,?,?,?,87CF6CF3), ref: 00F498B5

FindResourceExW.KERNEL32(00000000,00000006,00000000,?,00000000,?,?,?,?,?,00F72B5D,?,00000000), ref: 00EF7628
LoadResource.KERNEL32(00000000,00000000,?,?,?,?,?,00F72B5D,?,00000000,?,?,?,?,?,00F7FB28), ref: 00EF7636
LockResource.KERNEL32(00000000,?,?,?,?,?,00F72B5D,?,00000000,?,?,?,?,?,00F7FB28,000000FF), ref: 00EF7641
SizeofResource.KERNEL32(00000000,00000000,?,?,?,?,?,00F72B5D,?,00000000,?,?,?,?,?,00F7FB28), ref: 00EF764F

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Resource$CriticalSection$EnterFindLeaveLoadLockSizeof
String ID:
API String ID: 529824247-0
Opcode ID: c6186e84e7eadd7c8441edaa5d70ffcf4ee6cd11ab20f6bdd0a8ced5d105ab70
Instruction ID: a5dea898542fff3d1f6765ce3b58751ec5696d4d3eb95aad8191404d9028b16e
Opcode Fuzzy Hash: c6186e84e7eadd7c8441edaa5d70ffcf4ee6cd11ab20f6bdd0a8ced5d105ab70
Instruction Fuzzy Hash: A011263260C61A5BD7345A1C9C44A7BB7A8DBC0399F121E3DFA93E7290EF71CC05A661

Function 00F75D60 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000,?,00000000,?,00F75B7C,0000FDE9,?,00000000,?), ref: 00F75D8B
GetLastError.KERNEL32(?,00F75B7C,0000FDE9,?,00000000,?), ref: 00F75D95

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 6541a4f542753810dbb564b204b089b71ad8c050bac246f6fce16a2df8a07538
Instruction ID: 87fc293f44016438149b0008d845577be8e6deebb064e6c01d7fc696ab05aefa
Opcode Fuzzy Hash: 6541a4f542753810dbb564b204b089b71ad8c050bac246f6fce16a2df8a07538
Instruction Fuzzy Hash: B111083334420867E7305E59FC09F967758EB90B30F204827F558D61D1D3B19820A754

Function 00F61CA9 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000008,00000016,00000000,00F64E01), ref: 00F61CAE
_free.LIBCMT ref: 00F61D0B
_free.LIBCMT ref: 00F61D41
SetLastError.KERNEL32(00000000,00000006,000000FF), ref: 00F61D4C

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: d98dc918e7a4961cac7894214e91bbde29ddda23af12b44eb6d0a0f0837e70a5
Instruction ID: 64baa3281b744351f1af2a48dc9427fa60e59e06b3ea4a4150aa5c04cd651998
Opcode Fuzzy Hash: d98dc918e7a4961cac7894214e91bbde29ddda23af12b44eb6d0a0f0837e70a5
Instruction Fuzzy Hash: AD110233B406092BDA1176759DC6A6B35A9EBC17B4B2C0334F2268A1D2DE29DC04B260

Function 00F61E00 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00FC80CC,?,?,00F4D742,00F621B7,?,?,00F4872D,?,?,00EDA1ED,0000002C,87CF6CF3), ref: 00F61E05
_free.LIBCMT ref: 00F61E62
_free.LIBCMT ref: 00F61E98
SetLastError.KERNEL32(00000000,00000006,000000FF,?,00F4D742,00F621B7,?,?,00F4872D,?,?,00EDA1ED,0000002C,87CF6CF3), ref: 00F61EA3

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: f53920d4b31bf1e673e7b1a27324632b62c08a076cd9fd6919bf2f3ad4058514
Instruction ID: 1632360a0c44a98ff85c5f02c864c3291ee4e87b3d9fe434cc81b08b1ac3d820
Opcode Fuzzy Hash: f53920d4b31bf1e673e7b1a27324632b62c08a076cd9fd6919bf2f3ad4058514
Instruction Fuzzy Hash: AC11E533A006052BD71136759DC6E2B35A9ABD477472C0334F926CA1E2DE26EC047660

Function 00F33E04 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000001,00000400,?,87CF6CF3,00000000,00000000,00000000,00000000,?,?,?,00EDEE58,00000000,87CF6CF3,?,00000000), ref: 00F33E21
GetLastError.KERNEL32(?,00EDEE58,00000000,87CF6CF3,?,00000000,00000000,87CF6CF3,?), ref: 00F33E2D
WideCharToMultiByte.KERNEL32(00000001,00000000,?,87CF6CF3,00000000,00000000,00000000,00000000,?,00EDEE58,00000000,87CF6CF3,?,00000000,00000000,87CF6CF3), ref: 00F33E53
GetLastError.KERNEL32(?,00EDEE58,00000000,87CF6CF3,?,00000000,00000000,87CF6CF3,?), ref: 00F33E5F

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 0151d0dceae4ef7d62d9f6241172272a3e9149d71838d8ec66b932316b53712d
Instruction ID: 2867d0d745e25b909db87d1e3669efd3e9345f01368baaedae5479eec5983883
Opcode Fuzzy Hash: 0151d0dceae4ef7d62d9f6241172272a3e9149d71838d8ec66b932316b53712d
Instruction Fuzzy Hash: B0011232A0055ABBCF224F96DC08DAB3E66EBD97B1F108415FE0155120C731C962FBA1

Function 00F71647 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00F0860A,87CF6CF3,00FBC218,00000000,00F0860A,?,00F6F9C7,00F0860A,00000001,00F0860A,00F0860A,?,00F65B42,00000000,?,00F0860A), ref: 00F7165E
GetLastError.KERNEL32(?,00F6F9C7,00F0860A,00000001,00F0860A,00F0860A,?,00F65B42,00000000,?,00F0860A,00000000,00F0860A,?,00F66096,00F0860A), ref: 00F7166A

Part of subcall function 00F71630: CloseHandle.KERNEL32(FFFFFFFE,00F7167A,?,00F6F9C7,00F0860A,00000001,00F0860A,00F0860A,?,00F65B42,00000000,?,00F0860A,00000000,00F0860A), ref: 00F71640

___initconout.LIBCMT ref: 00F7167A

Part of subcall function 00F715F0: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00F7161F,00F6F9B4,00F0860A,?,00F65B42,00000000,?,00F0860A,00000000), ref: 00F71603

WriteConsoleW.KERNEL32(00F0860A,87CF6CF3,00FBC218,00000000,?,00F6F9C7,00F0860A,00000001,00F0860A,00F0860A,?,00F65B42,00000000,?,00F0860A,00000000), ref: 00F7168F

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 23e104c6e26c37de4ab8552760215a9c4b27082f6dfed3593fb77815427e686b
Instruction ID: 800f50c918f76d0d0b6d5bdd1dbcdb6903d8e0003a80aeda8b0587dacd7ffa7f
Opcode Fuzzy Hash: 23e104c6e26c37de4ab8552760215a9c4b27082f6dfed3593fb77815427e686b
Instruction Fuzzy Hash: C3F01C36541118BBCF222F95DC09AAA3F26FB493A0F098415FA0D86120CB328820FF91

Function 00F48982 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00F4891F,00000064), ref: 00F489A5
LeaveCriticalSection.KERNEL32(00FC742C,00EE1171,?,00F4891F,00000064,?,?,?,00EE402B,00FC827C,87CF6CF3,?,00EE1171,?), ref: 00F489AF
WaitForSingleObjectEx.KERNEL32(00EE1171,00000000,?,00F4891F,00000064,?,?,?,00EE402B,00FC827C,87CF6CF3,?,00EE1171,?), ref: 00F489C0
EnterCriticalSection.KERNEL32(00FC742C,?,00F4891F,00000064,?,?,?,00EE402B,00FC827C,87CF6CF3,?,00EE1171,?), ref: 00F489C7

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 6a0e66dec4474c1cabbb2e744cdde0b602cfac4fda25fc2a7e441108565d0cc8
Instruction ID: 1ff7f17e54f8b1878ea03797600f7d12c2adec9a5494de03f08d67f3e8c0f6e6
Opcode Fuzzy Hash: 6a0e66dec4474c1cabbb2e744cdde0b602cfac4fda25fc2a7e441108565d0cc8
Instruction Fuzzy Hash: C2E09232A04728FBC7057B90ED0AEED3E29EB09B60B000014F90963161CB624810BFD2

Function 00F5F540 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F5F549

Part of subcall function 00F62098: RtlFreeHeap.NTDLL(00000000,00000000,?,00F6B729,?,00000000,?,?,?,00F6B9CC,?,00000007,?,?,00F6BDD6,?), ref: 00F620AE
Part of subcall function 00F62098: GetLastError.KERNEL32(?,?,00F6B729,?,00000000,?,?,?,00F6B9CC,?,00000007,?,?,00F6BDD6,?,?), ref: 00F620C0

_free.LIBCMT ref: 00F5F55C
_free.LIBCMT ref: 00F5F56D
_free.LIBCMT ref: 00F5F57E

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 791e4c2605ed15b008cd4f1f82888697655b5e654afa89a6502eebe9b7f566be
Instruction ID: 2e694c69e2c3c4bfc4f0510045b9cba1efd7795fd7cdfd1618fc7726c51b0c0a
Opcode Fuzzy Hash: 791e4c2605ed15b008cd4f1f82888697655b5e654afa89a6502eebe9b7f566be
Instruction Fuzzy Hash: 14E09271C94A29AA86A2BF34AE03C493B21A7947907011046F41957232CF3E055AFE91

Function 00F352EC Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F352F3

Part of subcall function 00EFBDF0: std::_Lockit::_Lockit.LIBCPMT ref: 00EFBE2F
Part of subcall function 00EFBDF0: std::_Lockit::_Lockit.LIBCPMT ref: 00EFBE51
Part of subcall function 00EFBDF0: std::_Lockit::~_Lockit.LIBCPMT ref: 00EFBE71
Part of subcall function 00EFBDF0: std::_Lockit::~_Lockit.LIBCPMT ref: 00EFBFFC

_Find_elem.LIBCPMT ref: 00F354EF

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 00F3535B

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Find_elemH_prolog3_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 3042121994-2799312399
Opcode ID: 827858ec6321b5eabeced11fc2eae343568becb657f3dd8ae7daffd01b689885
Instruction ID: 27394fa52de5fa939af40e8874f0feb7d1945859f5a94a0a040d6bb12513d545
Opcode Fuzzy Hash: 827858ec6321b5eabeced11fc2eae343568becb657f3dd8ae7daffd01b689885
Instruction Fuzzy Hash: 19C1E231E046888FDF25DFA4C5917ECBBB2AF91B34F284059D8856B283D7349D46EB10

Function 00F3BBCA Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 316COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F3BBD4

Part of subcall function 00F38616: __EH_prolog3.LIBCMT ref: 00F3861D
Part of subcall function 00F38616: std::_Lockit::_Lockit.LIBCPMT ref: 00F38627
Part of subcall function 00F38616: std::_Lockit::~_Lockit.LIBCPMT ref: 00F38698

_Find_elem.LIBCPMT ref: 00F3BE0E

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 00F3BC4B

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Lockitstd::_$Find_elemH_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 2544715827-2799312399
Opcode ID: 969d66be1c4e417fa490db9073ff66e65b3b83d68eab6e697ab4af2eec9d6121
Instruction ID: 348600efacdbc833d6f16c884454a17172e841cfa7d7b178b09716dae0bbf57d
Opcode Fuzzy Hash: 969d66be1c4e417fa490db9073ff66e65b3b83d68eab6e697ab4af2eec9d6121
Instruction Fuzzy Hash: A3C1A735E042588FDF25DF68C8657ECBBB1BF51330F54409AE949AB282DB348D85EB50

Function 00F3BFA0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 316COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F3BFAA

Part of subcall function 00ED7892: __EH_prolog3_GS.LIBCMT ref: 00ED7899
Part of subcall function 00ED7892: std::_Lockit::_Lockit.LIBCPMT ref: 00ED78A6
Part of subcall function 00ED7892: std::_Lockit::~_Lockit.LIBCPMT ref: 00ED7914

_Find_elem.LIBCPMT ref: 00F3C1E4

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 00F3C021

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: H_prolog3_Lockitstd::_$Find_elemLockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 3328206922-2799312399
Opcode ID: ebd242bd5fbcd7ecef8ca029087b12262c1759f64c3ea77559c58d86cc1edcbc
Instruction ID: bee96363e4791b7e87f2e55d82308b30923ee29f9730104e5289acc45d527607
Opcode Fuzzy Hash: ebd242bd5fbcd7ecef8ca029087b12262c1759f64c3ea77559c58d86cc1edcbc
Instruction Fuzzy Hash: 93C19371D04258CBDF25DFA8C8447EDBBB2BF15320F54809AD885BB282DB349D85EB90

Function 00F5DE2D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00F5DEBD

Strings

pow, xrefs: 00F5DE95, 00F5DEB2

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 846c169a39809e73d953051786d851649804177ba818e172ebe959b50852929d
Instruction ID: 5531826398192e4ad73fd973d370242f2b9d62a03bc23dc61721696adc70c0f6
Opcode Fuzzy Hash: 846c169a39809e73d953051786d851649804177ba818e172ebe959b50852929d
Instruction Fuzzy Hash: D651A0A2E1E20187C7257B14CD4237937D8DB50762F244958F896861A8EFB58CCDB642

Function 00F47B97 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 00F47CF8

Strings

0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00F47C56, 00F47C8D, 00F47C92
-, xrefs: 00F47D26

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: __aulldiv
String ID: -$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 3732870572-1956417402
Opcode ID: 5181fff8bd9ec27c3ab0ba97699bd851a746da58f92cb4722e4eab722e77515f
Instruction ID: 1ea17179e4245d740f1cab044828a19349461f05bcd5c0f601eceaad38e31fe0
Opcode Fuzzy Hash: 5181fff8bd9ec27c3ab0ba97699bd851a746da58f92cb4722e4eab722e77515f
Instruction Fuzzy Hash: 3251E530E0C3899BDF25AE6DC8817BEBFF9AF45320F144469ED81D7241C3749942AB90

Function 00F74440 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00F72AF0: FindResourceW.KERNEL32(00000000,?,00000006), ref: 00F72B74
Part of subcall function 00F72AF0: WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,?,00000000,00000000,00000000,00000000,?,?,00000006), ref: 00F72BAB
Part of subcall function 00F72AF0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?,00000000,00000000,00000000,?,?,?,?,?,00F7FB28,000000FF), ref: 00F72C2E

WritePrivateProfileStructW.KERNEL32(?,00000000,4752434D,00000024,00000002), ref: 00F7453C
WritePrivateProfileStructW.KERNEL32(?,?,00000000,?,00000002), ref: 00F74598

Strings

MCRG, xrefs: 00F74480

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ByteCharMultiPrivateProfileStructWideWrite$FindResource
String ID: MCRG
API String ID: 2178413835-1523812224
Opcode ID: ce26c56a31f94b81e4b784c4299f3ae97b2e4a16c978cf800f9754fac5ffa1a3
Instruction ID: 9c44886942243c7758dfbe9c41b62741befb9f0718c9bc3b78f4a8f60ba9d42d
Opcode Fuzzy Hash: ce26c56a31f94b81e4b784c4299f3ae97b2e4a16c978cf800f9754fac5ffa1a3
Instruction Fuzzy Hash: 3D616971900548EFDB11CFA8C844B9EFBF5FF49320F18825AE815AB3A1DB74A905DB91

Function 00EF71C0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00EF7362
Concurrency::cancel_current_task.LIBCPMT ref: 00EF7367

Strings

'm, xrefs: 00EF71EC, 00EF728C

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: 'm
API String ID: 118556049-146587916
Opcode ID: 86ca15f39ad9b1ade263dd364f26b030dd4af9eb7987e148d18576c928772d29
Instruction ID: c71e06dacaea014b527a7693047efc48347f9d021f6ca55d64a462e6bbd599d6
Opcode Fuzzy Hash: 86ca15f39ad9b1ade263dd364f26b030dd4af9eb7987e148d18576c928772d29
Instruction Fuzzy Hash: 9151C4B19082059FDB24CF28C941B7EBBF5EB48300F10062EE996A7791DB35E944DB91

Function 00F4C6E2 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00F4C707

Strings

MOC, xrefs: 00F4C719
RCC, xrefs: 00F4C721

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 804d2d03e54b36697eeda088146a4e8349caa572cc0fb0de91f7b3afbba8c290
Instruction ID: 7c736dafe0cb0fc7bbd3358edb9a9689ab918fc367176bcea5b277ccc381a919
Opcode Fuzzy Hash: 804d2d03e54b36697eeda088146a4e8349caa572cc0fb0de91f7b3afbba8c290
Instruction Fuzzy Hash: D5413671A01209AFCF16DF98CC81AAEBFB5AF48310F159159FD1467261D3399950EF90

Function 00EDBED0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00EDBFD6
Concurrency::cancel_current_task.LIBCPMT ref: 00EDBFDB

Strings

ios_base::badbit set, xrefs: 00EDBEED

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: ios_base::badbit set
API String ID: 118556049-3882152299
Opcode ID: f92bd1b3875eb43ee71ceb7d70d9ff14a31b417b12ea01339a6f3eb4e0da9c53
Instruction ID: 25077c95f2e7df3993f032671b1b819f91118d52c93c71a2eac895c7a91a6e2a
Opcode Fuzzy Hash: f92bd1b3875eb43ee71ceb7d70d9ff14a31b417b12ea01339a6f3eb4e0da9c53
Instruction Fuzzy Hash: AD31ADB2610609EFC310DF18DC81A5AB7A8FF45314F46562AF8559BB90E774E8268FA0

Function 00F43B60 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F43B67
__cftoe.LIBCMT ref: 00F43BEB

Strings

!%x, xrefs: 00F43B78

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: 363771b855fdc766515243e6be8eceaed60739fa5d4ae3618cdc80e83418af48
Instruction ID: c9957df9e50d393c97556cc1c0e0605ec8d93ec4389fab67c3dd057b54081c46
Opcode Fuzzy Hash: 363771b855fdc766515243e6be8eceaed60739fa5d4ae3618cdc80e83418af48
Instruction Fuzzy Hash: D8313971D0120DABDF04EF94E981AEDBBB6FF48304F204419F905B7251DB39AA46DB64

Function 00F47720 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F47727
__cftoe.LIBCMT ref: 00F477A5

Strings

!%x, xrefs: 00F4773B

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: H_prolog3___cftoe
String ID: !%x
API String ID: 855520168-1893981228
Opcode ID: f1ca2e5c5ceacb9e4bbd3ab8100642dede40bf693f4862173c9b215e99349a62
Instruction ID: 2884186ebdcdf5591b278b4a1c91f28d97b876b2c0698244d011bab3ae2c27e8
Opcode Fuzzy Hash: f1ca2e5c5ceacb9e4bbd3ab8100642dede40bf693f4862173c9b215e99349a62
Instruction Fuzzy Hash: 02314B76D18249AFDF05EF98E841AEEBFB5EF08310F14001AFC44A7242D7759A45EBA0

Function 00ED7A9B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00ED7AA2

Strings

false, xrefs: 00ED7B04
true, xrefs: 00ED7B16

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: H_prolog3_
String ID: false$true
API String ID: 2427045233-2658103896
Opcode ID: 4da9e677d628939ad8f69b60776a291a21641ac83bd0aea703ce72db429caee8
Instruction ID: bc7c6f6bbfe68500e64143459d6d524b6425839bf0973cc2439284db43388566
Opcode Fuzzy Hash: 4da9e677d628939ad8f69b60776a291a21641ac83bd0aea703ce72db429caee8
Instruction Fuzzy Hash: 94218CB1C04248AADB14EFA5C8859AFB7F8FF44700F00805BF945AB352EB74DA05DB61

Function 00EFE5E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

CLSIDFromString.OLE32(0000007B,?), ref: 00EFE650

Strings

{, xrefs: 00EFE627
@, xrefs: 00EFE608

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: FromString
String ID: @${
API String ID: 1694596556-3118734784
Opcode ID: 5650444d287f4df15fda1712b9da798c50ee6111e9cac5e0399a668ac8865d8e
Instruction ID: 567dc19bd7778bb56e526ea17c465a70f5cf9d09cc8587790614a3867e7b3aae
Opcode Fuzzy Hash: 5650444d287f4df15fda1712b9da798c50ee6111e9cac5e0399a668ac8865d8e
Instruction Fuzzy Hash: B701A93160020C9BDB20DF5DDD00BAEB3B8FF58714F41819EB945E7210DE74AA85DB90

Function 00F497CD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00ED44F8: InitializeCriticalSectionEx.KERNEL32(00FC77A0,00000000,00000000,00FC778C,00F497FC,?,?,?,00ED11BA), ref: 00ED44FE
Part of subcall function 00ED44F8: GetLastError.KERNEL32(?,?,?,00ED11BA), ref: 00ED4508

IsDebuggerPresent.KERNEL32(?,?,?,00ED11BA), ref: 00F49800
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00ED11BA), ref: 00F4980F

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00F4980A

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: 0927320aea6640935388f1efddac73ccb7c48b903225f92705aba3366915b110
Instruction ID: cdb127cd4105180a802ca7ec2ad757e5df6ef3225a0156e3688ec5ee9e85b04a
Opcode Fuzzy Hash: 0927320aea6640935388f1efddac73ccb7c48b903225f92705aba3366915b110
Instruction Fuzzy Hash: 64E06D706047108BD760AF28E90A7537BE4AB04744F00882DE89AC2251DBF5D449DBA2

Function 00F75E10 Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,000000FF,00000000,00000000,?,?,?,00F759F1,0000FDE9,?,?,?), ref: 00F75E33
GetLastError.KERNEL32(?,?,00F759F1,0000FDE9,?,?,?), ref: 00F75E3D

Memory Dump Source

Source File: 00000005.00000002.2582496004.0000000000EC1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00EC0000, based on PE: true

Associated: 00000005.00000002.2582462247.0000000000EC0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582593680.0000000000F8E000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582641943.0000000000FBF000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582675943.0000000000FC4000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582710080.0000000000FC6000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000005.00000002.2582754524.0000000000FC9000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ec0000_saBSI.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 590ee22daef0bb25b6104f7e0964dba2f9b5be13acdce46491706600352c000c
Instruction ID: ecccd86b066532ec9b1f423252dcfa5dfed32941f919fe278093417a2c361d26
Opcode Fuzzy Hash: 590ee22daef0bb25b6104f7e0964dba2f9b5be13acdce46491706600352c000c
Instruction Fuzzy Hash: FB110A333006086BE7208E69FC04FABB79CEB95B71F20483BF548D61D1D3B15810A761

Analysis Process: 3yq4abxg.exePID: 5828, Parent PID: 7188COMMON

Execution Graph

Execution Coverage:	16.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	28

Executed Functions

Function 00401014 Relevance: 49.6, APIs: 8, Strings: 20, Instructions: 609
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401964: GetVersionExW.KERNEL32(?), ref: 0040197E

GetCommandLineW.KERNEL32(?,?,00000000), ref: 0040106A

Part of subcall function 0040B6CE: MessageBoxW.USER32(00000000,?,7-Zip,00000010), ref: 0040B6D7

Strings

Cannot load codecs, xrefs: 0040139B
RunProgram, xrefs: 004012AA
Config failed, xrefs: 00401187
Unsupported Windows version, xrefs: 00401031
, xrefs: 00401550
BeginPrompt, xrefs: 004011AB
%%T\, xrefs: 00401666
Cannot open file, xrefs: 00401562
Cannot create temp folder archive, xrefs: 00401359
;!@InstallEnd@!, xrefs: 0040110B
Directory, xrefs: 004011E8
%%T, xrefs: 004016A1
D, xrefs: 004016ED
;!@Install@!UTF-8!, xrefs: 00401110
Progress, xrefs: 004011BB
Cannot find setup.exe, xrefs: 00401641
setup.exe, xrefs: 0040161F
Can't load config info, xrefs: 00401123
<, xrefs: 004014D6
Title, xrefs: 0040119B

Memory Dump Source

Source File: 00000006.00000002.3266472951.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3266267350.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.3266755087.000000000041B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.3266964368.000000000041F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.3267189547.0000000000423000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.3267189547.000000000048E000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_3yq4abxg.jbxd

Similarity

API ID: CommandLineMessageVersion
String ID: $%%T$%%T\$;!@Install@!UTF-8!$;!@InstallEnd@!$<$BeginPrompt$Can't load config info$Cannot create temp folder archive$Cannot find setup.exe$Cannot load codecs$Cannot open file$Config failed$D$Directory$Progress$RunProgram$Title$Unsupported Windows version$setup.exe
API String ID: 1181637900-2003083147
Opcode ID: 3efcf2d1d3a7441ca0b14c4a05f3d02b4c58b5b877e09f9705a96f8599c27fae
Instruction ID: 91a39e4938556500cec03b803b80b81d43ed25c9342cb10cfc7594b58d81729c
Opcode Fuzzy Hash: 3efcf2d1d3a7441ca0b14c4a05f3d02b4c58b5b877e09f9705a96f8599c27fae
Instruction Fuzzy Hash: 533207718001199BCF25EFA2DC42AEDBB79AF14309F10857FE016771E2DE3A5B858B58

Function 004118C5 Relevance: 1.7, APIs: 1, Instructions: 221COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004118CA

Memory Dump Source

Source File: 00000006.00000002.3266472951.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3266267350.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.3266755087.000000000041B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.3266964368.000000000041F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.3267189547.0000000000423000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.3267189547.000000000048E000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_3yq4abxg.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 651cdec31b09320b919117bcac0565adf9cba3c06eb1e06aba22f47291fad8d2
Instruction ID: 410c4654daef7da990a98253d3e66d5b213a9c0a1678a916b5f74a0f15da51b9
Opcode Fuzzy Hash: 651cdec31b09320b919117bcac0565adf9cba3c06eb1e06aba22f47291fad8d2
Instruction Fuzzy Hash: 2491AB70A007459BDB24CFA5C4807EEFBF1BF18304F14452EE65AA37A1D778A884CB99

Function 0040C060 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040C065

Part of subcall function 0040C09F: __EH_prolog.LIBCMT ref: 0040C0A4

Memory Dump Source

Source File: 00000006.00000002.3266472951.0000000000401000.00000020.00000001.01000000.00000011.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3266267350.0000000000400000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.3266755087.000000000041B000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.3266964368.000000000041F000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.3267189547.0000000000423000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000006.00000002.3267189547.000000000048E000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_3yq4abxg.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 0cf3d4201a466e9efd44c790423463a7468b64a5134effa5c2f6563673e48e80
Instruction ID: ceb6fbff95900b16925a007b2a22551dc73fa75ba4de7b3591f4e0892db7cd8f
Opcode Fuzzy Hash: 0cf3d4201a466e9efd44c790423463a7468b64a5134effa5c2f6563673e48e80
Instruction Fuzzy Hash: 44D01271951204EBD7149F95D942BEEB778EF40759F10452FF001A2581C3BD5900C669

Description:	Adversaries may gather information about the victim's host software that can be used during targeting. Information about installed software may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: antivirus, SIEMs, etc.).
Tactics:	Reconnaissance
Data Sources:	Internet Scan: Response Content
Platforms:	PRE
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\WeatherZero\Newtonsoft.Json.dll

C:\Program Files (x86)\WeatherZero\WeatherZero.exe

C:\Program Files (x86)\WeatherZero\WeatherZero.exe.config

C:\Program Files (x86)\WeatherZero\WeatherZeroService.exe

C:\Program Files (x86)\WeatherZero\uninstall.exe

C:\Program Files (x86)\WeatherZero\wz.ico

C:\Program Files\Cheat Engine 7.5\CSCompiler.dll (copy)

C:\Program Files\Cheat Engine 7.5\Cheat Engine.exe (copy)

C:\Program Files\Cheat Engine 7.5\CheatEngine.chm (copy)

Windows Analysis Report
SecuriteInfo.com.Trojan.InstallCore.4077.25967.22716.exe

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre